devrites 7.3.1 → 7.3.3

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.3.3](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.2...v7.3.3) (2026-11-02)
+
+### Fixed
+
+* **devrites:** harden workflow mutations and host diagnostics ([#206](https://github.com/ViktorsBaikers/DevRites/issues/206)) ([849a7d1](https://github.com/ViktorsBaikers/DevRites/commit/849a7d182c13453f4a542bd2b4c58f9adccebe22))
+
+## [7.3.2](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.1...v7.3.2) (2026-11-02)
+
+### Fixed
+
+* **devrites:** harden lifecycle, installer and host safety ([#205](https://github.com/ViktorsBaikers/DevRites/issues/205)) ([cac2f8a](https://github.com/ViktorsBaikers/DevRites/commit/cac2f8ab657bbe0d44198ed587413779cf5ac44d))
+
 ## [7.3.1](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.0...v7.3.1) (2026-11-01)
 
 ### Fixed
@@ -25,6 +37,16 @@ All notable changes to DevRites are documented here. The format follows [Keep a
 
 ### Fixed
 
+- Confine question resolution to checked workspaces and restore question/cursor
+  files together when publication fails. Bundle rollback now includes the failing
+  target and reports incomplete restoration.
+- Verify Windows root-handle rename protection in resolution race tests while
+  preserving replacement coverage on platforms that permit renaming open roots.
+- Honor explicitly acknowledged backward-phase repair checkpoints in regression
+  baselines while retaining ordinary regression and empty-acceptance checks.
+- Check Pi/omp native role loading in doctor, clarify instruction-only shell
+  boundaries, and validate OMP invocations plus Codex reference documents.
+
 - Recover exact recorded parallel landings after interrupted lease persistence;
   preserve late worker edits, ignored data, extra commits, and missing-checkout
   Git metadata during cleanup.
@@ -43,6 +65,22 @@ All notable changes to DevRites are documented here. The format follows [Keep a
   workspaces or reviving their controller leases.
 - Execute Autocomplete's global frontier at cold Prove/Vet/Review and native wait
   boundaries; preserve frozen candidates, standalone scope, and non-green gates.
+- Preserve selected workspace identity across native command forms, resolver
+  resumes, and handoffs; reject empty answers and invalid wait transitions before
+  publishing question changes.
+- Keep candidate and next-step observations read-only, and retain unfinished Build
+  and Polish work even when their required documents already exist.
+- Confine installer reads and mutations to the validated project root; acquire
+  shared-marker ownership before changing configuration, replay disabled-host
+  update flags, and reject linked pin destinations outside the project.
+- Preserve uninstall ownership after binary-removal failures so ordinary retries
+  work without touching another installation. Stage Windows launcher uninstalls
+  outside the installed image; refuse direct self-removal before project changes.
+- Bind Overhaul scorecards to current calculator inputs and admitted receipts to
+  immutable generation hashes; require complete writer reservations and
+  lane-matched coverage proof.
+- Serialize Overhaul's shared-tree writer observation windows without filtering
+  away unauthorized changes; retain parallel read-only review on immutable inputs.
 
 ## [7.2.8](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.7...v7.2.8) (2026-10-31)
 

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.3.1`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.1): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.3.3`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.3): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -288,6 +288,12 @@ npx devrites@latest uninstall
 npx devrites@latest uninstall --keep-binary
 ```
 
+On Windows, use `npx devrites@latest uninstall` or the Bash `uninstall.sh`
+launcher to remove the shared engine binary. These launchers run a private
+temporary copy so Windows can delete the original installed executable.
+Direct `devrites-engine uninstall` cannot delete its own running image and
+refuses before changing project files; use the launcher or `--keep-binary`.
+
 Run `npx devrites@latest --help` for common flags and
 `npx devrites@latest <command> --help` for command-specific flags.
 
@@ -387,6 +393,10 @@ blocks uninstall and dropped-host pruning, including dry runs, before writes.
 Existing files retain their permission bits. Claude permission ownership is
 recorded before settings replacement, so interrupted merges retain the records
 needed to remove installer-added grants on retry and uninstall.
+User-pinned aliases keep their recorded ownership hashes; refreshing does not
+silently adopt local edits. Shared-config marker collisions fail before writes.
+Legacy hook cleanup matches known shipped commands, not user commands that merely
+mention DevRites.
 Marker-merged files keep user content outside the DevRites block, and
 `.devrites/` runtime state stays in place. `update` reuses the install flags
 recorded in the manifest; flags you pass explicitly win and are recorded. The installer refuses symlinks, junctions, and paths that
@@ -395,8 +405,11 @@ escape the target.
 The optional shared `devrites-engine` binary is the only artifact installed
 outside the project. Before replacement, the staged release binary must report
 the requested version; after installation, the binary at its final path must
-report it again in a new process. The installer keeps a backup until the
-second check passes and restores it on failure.
+report it again in a new process. The selected binary is installed after merge
+preflight but before project payload and version publication, so binary failure
+leaves an ordinary update retry possible. The installer keeps a backup until the
+second check passes and restores it on failure. If restoration also fails, it
+retains the backup and reports its recovery path.
 
 `devrites-engine update` resolves the latest stable release, acquires its
 bundle and platform binary, and hands local paths to the downloaded engine, so
@@ -549,6 +562,9 @@ npm test
 (cd engine && go test ./... -count=1)
 ```
 
+Native Windows launcher integration tests also require Node and Git for Windows
+(including Git Bash). They exercise the real installed engine through both launchers.
+
 Canonical pack changes belong in `pack/.claude/`. Rebuild host payloads with
 `bash scripts/build-host-artifacts.sh` instead of editing `pack/generated/`.
 See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the development workflow and

package/bin/devrites.mjs

@@ -2,10 +2,10 @@
 // devrites - npx entry point for the engine-owned DevRites installer.
 import { spawn, spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { chmodSync, createReadStream, existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { chmodSync, copyFileSync, createReadStream, existsSync, mkdtempSync, readFileSync, rmSync, statSync } from 'node:fs';
 import { open } from 'node:fs/promises';
 import { constants as osConstants, tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const here = dirname(fileURLToPath(import.meta.url));
@@ -108,6 +108,31 @@ function runEngine(command, args, env) {
   });
 }
 
+function windowsInstalledEngine() {
+  const dirs = (process.env.PATH || '').split(';');
+  if (process.env.NoDefaultCurrentDirectoryInExePath === undefined) dirs.unshift(process.cwd());
+  for (const dir of dirs) {
+    if (!dir) continue;
+    const candidate = resolve(dir.replace(/^"|"$/g, ''), 'devrites-engine.exe');
+    try {
+      if (statSync(candidate, { throwIfNoEntry: false })?.isFile()) return candidate;
+    } catch {}
+  }
+  return null;
+}
+
+function stageWindowsUninstall(engine) {
+  if (!engine || command !== 'uninstall' || process.platform !== 'win32' || temporaryDirs.has(dirname(engine))) return engine;
+  try {
+    // Windows cannot unlink the running installed image; launch a private copy.
+    const staged = join(privateTempDir(), 'devrites-engine.exe');
+    copyFileSync(engine, staged);
+    return staged;
+  } catch (error) {
+    throw new Error(`could not stage devrites-engine for Windows uninstall: ${error.message}`);
+  }
+}
+
 async function acquireEngine() {
   const repo = process.env.DEVRITES_REPO || 'ViktorsBaikers/DevRites';
   const tag = normalizeReleaseTag(process.env.DEVRITES_REF || pkgVersion());
@@ -123,7 +148,8 @@ async function acquireEngine() {
     acquisitionFailure = `${envEngine} reports version '${got}', want ${tag}`;
     return null;
   }
-  if (command === 'uninstall' && spawnSync('devrites-engine', ['uninstall', '-h'], { stdio: 'ignore' }).status === 0) return 'devrites-engine';
+  const installedEngine = command === 'uninstall' && process.platform === 'win32' ? windowsInstalledEngine() : 'devrites-engine';
+  if (command === 'uninstall' && installedEngine && spawnSync(installedEngine, ['uninstall', '-h'], { stdio: 'ignore' }).status === 0) return installedEngine;
 
   // A git checkout's payload can be ahead of the published engine of the same
   // version, so a checkout builds its own engine before downloading one.
@@ -135,7 +161,7 @@ async function acquireEngine() {
   const built = checkout ? null : buildEngine(tag);
   if (built) return built;
 
-  if (command === 'uninstall') return 'devrites-engine';
+  if (command === 'uninstall') return installedEngine;
   const probe = spawnSync('devrites-engine', ['version'], { encoding: 'utf8' });
   if (!probe.error && probe.status === 0 && String(probe.stdout).trim().replace(/^v/, '') === tag.slice(1)) return 'devrites-engine';
   return null;
@@ -316,7 +342,7 @@ if (first && SUBCOMMAND_ALIASES.has(first)) {
 
 let engine;
 try {
-  engine = await acquireEngine();
+  engine = stageWindowsUninstall(await acquireEngine());
 } catch (error) {
   console.error(`devrites: ${error.message}`);
   process.exit(1);

package/docs/cli.md

@@ -143,11 +143,15 @@ self-contained updater.
   against the durable `regression-baseline.json` high-water mark. A lost fact
   prints `REGRESSION: <detail>` and exits `3`. `--update` rewrites the baseline
   under the feature lock at a durable checkpoint and prints each regression it
-  blesses as `REGRESSION-BLESSED`; with no baseline recorded the check reports
-  `unproven` and exits `0`. Recommended placement: compare on a cold resume or
-  scheduled wake before acting on durable state, ratchet after a landed slice
-  checkpoint or phase advance, and treat `BLOCKED` at Seal as NO-GO; `--update`
-  never excuses an unreconciled regression.
+  blesses as `REGRESSION-BLESSED`. A deliberate owner-authorized repair checkpoint
+  may accept a backward phase along with other acknowledged facts: the current
+  phase becomes the new baseline. Ordinary checks never bless losses or change
+  the baseline. If the update would remove every checked acceptance criterion and
+  met gate, `--allow-empty` is also required. With no baseline recorded the check
+  reports `unproven` and exits `0`. Recommended placement: compare on a cold
+  resume or scheduled wake before acting on durable state, ratchet after a landed
+  slice checkpoint or phase advance, and treat `BLOCKED` at Seal as NO-GO.
+  Never use automatic updates to hide an unreconciled regression.
 - `check continuation [slug]` prints `continuation: required` and
   `invoke: <next_action>` when `.devrites/AFK` is present, `status` is
   `running`, no question cursor is set, no blocking or escalating question is
@@ -254,8 +258,12 @@ without it any `answered_by:` line in the resolved block, whatever its indentati
 `state close` transactionally archives a shipped workspace and clears matching
 `ACTIVE`.
 
-The mutating forms share the engine's root-safety, locking, and atomic-write
-boundary.
+Mutations share root-safety checks, feature locks, and atomic per-file writes.
+`state resolve` and `state apply-bundle` restore attempted files after returned
+publication errors; `rollback incomplete` identifies files needing inspection
+and recovery. These multi-file operations are not crash-atomic: process
+termination can leave partial updates, and unlocked readers can see intermediate
+state. Inspect both artifacts before resuming after an interrupted publication.
 
 The root scans and rechecks `questions.md` to allocate the next unused qid,
 manages Clarify return fields without rewriting unrelated Markdown, charges an

package/docs/engine/commands.md

@@ -20,7 +20,7 @@ workflow strategy.
 | `parallel select --cap <1-10> [--root <dir>] [--slug <controller>] [--from-plan [--workspaces <slug,...>] \| <json-file> \| -]` | Choose a plan-order path-disjoint ready subset, seeded by all retained repository-controller slots and paths. `--from-plan` uses canonical built checkpoints, local and declared workspace producer dependencies, exact write sets and required dependency manifests. The internal `--workspaces` data-source parameter pools recorded forward continuations with current readiness and explicit native-vetted per-slice declarations; blocked/stale/missing candidates print scoped notices without hiding other ready work. Foreign identities print `<workspace>/<slice>`. |
 | `parallel <create\|add\|integrate\|prune\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | One repository controller owns isolated workers across source workspaces. `create` accepts a single initial worker; `create`/`add --cap N` persist the global admission capacity. Explicit `add --cap N --json -` with stdin `[]` updates capacity only; lowering below active count refuses without canceling workers. A completed retained lease can refill at unchanged control tip. `record-green` and per-slice `integrate --slice <workspace/id> --apply-to-control` target source-qualified lanes (bare IDs mean controller lanes); integration keeps exact ancestry/path/dirty-work checks and lands `WIP(<source>):`. `prune` removes only verified clean integrated checkouts, retaining branches, proof identities, lease rows and controller. Status exposes the retained controller and pending landing; cleanup preserves salvage/unknown work. |
 | `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. A `Dependencies` ID may carry a `(via <interface>)` suffix (empty or unclosed is a malformed token); prints a non-blocking `ADVISORY edge:` line (and records an `edge-advisory` metric) for each edge with no via, or whose via text is not a case-insensitive substring of the dependency's `Consumes / Produces:`. Prints `schedule: <n> slices in <r> build rounds at cap 10` (the `/rite-build` batch selection replayed over each slice's Writer allowlist, else Files likely touched, plus the manifest parallel select reserves; omitted when a slice has no path) and a non-blocking `ADVISORY hub:` line (top five; records a `hub-advisory` metric) for each path, compared case-folded, that three or more slices without `Serial rationale:` write. Advisories print only when the graph is valid. |
-| `check regression <slug> [--update]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark; `--update` ratchets the baseline forward under the feature lock and prints each blessed regression. |
+| `check regression <slug> [--update [--allow-empty]]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark. Ordinary checks block lost facts without changing the baseline. `--update` records the current facts under the feature lock and prints each blessed regression; a deliberate owner-authorized repair checkpoint can accept a backward phase as the new baseline. Removing every checked AC and met gate also requires `--allow-empty`. Never automatically bless an unreconciled regression. |
 | `check continuation [slug]` | Print whether an armed AFK run must invoke its cursor instead of replying. `continuation: required` plus `invoke: <next_action>` when `.devrites/AFK` is a regular file, `status` is `running`, `question_id` is empty, no blocking or escalating question is open, and `next_action` is an internal phase command (`/rite-spec` through `/rite-seal`, including `/rite-plan`, not `/rite-ship` or `/rite-autocomplete`). Otherwise `continuation: clear` with a one-line `reason`. Exit `0` either way. `handoff` prints the same lines. |
 | `check drift <slug> [--record]` | Attribute readiness-input changes to the exact artifact. `--record` writes the per-input `readiness-inputs.json` digest baseline under the feature lock; without it the workspace diffs current inputs against that baseline (or falls back to the aggregate binding recorded in `eng-review.md`). Advisory: exit `0` on drift; a corrupt baseline exits `3`. A `test-plan.md` change limited to exact `Workflow Artifact reviewed identity: <64hex>` lines is reported as `reviewed-identity-only` (ADR-0034). `--record` also stores each slice's proof bytes (its `tasks.md` block plus the `test-plan.md` lines naming it); both modes print `ADVISORY proportion:` for a slice whose proof grew over 2x since that baseline or carries over 3x the median proof per AC. |
 | `check windows <slug> [--worktree\|--staged\|--base <ref>\|--since-dispatch <wave>]` | Fail on deferral and bar-lowering markers the change introduces without a waiver row in the workspace's `windows.md`: added TODO/FIXME/XXX/HACK, skipped/focused-test and stub idioms, checker suppressions, one-line empty catch; removed `deleted-test` files and net `removed-assertion` lines in remaining test files. `--since-dispatch <wave>` reports only `deleted-test`/`removed-assertion` against the work-tree snapshot (`tree` in `dispatch.json`) recorded when that build wright wave opened, untracked files included; it takes no `--cwd` and records the `windows-since` metric. |
@@ -38,7 +38,7 @@ workflow strategy.
 | `handoff [slug] [--resume]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, in-flight dispatch waves (`inflight_wave:` lines: phase, state, pending roles, slices), missing required files, the canonical read-next order, and the same `continuation:` lines as `check continuation`. Read-only unless `--resume`, which appends one `resume` event (role root) to `metrics.jsonl`; `metrics summary` then reports minutes from each resume to the next dispatch. The `/rite-handoff` spine and the compaction-fallback entry point. |
 | `recall --paths <p1,p2,...> [--limit n]` | Read-time query over `.devrites/archive/`: list archived features whose `touched-files.md` candidate manifest covers a queried project-relative path (exact or directory prefix, case-folded), ranked by overlap count, then newest archive-directory mtime, then slug (default 10 features). Each feature prints up to 8 `archive/<slug>/<file>:<line>` pointers, then `+N more`: `decisions.md` `DEC-###` entries and `## Carry-forward constraints` bullets whose `Files:` overlap (or a constraint naming no files), plus `review.md`/`seal.md`/`drift.md` lines that mention a queried path; fenced examples are ignored. Never writes, caches, or indexes (no metric either); symlinked archive entries are refused. An unreadable archive file prints `unreadable:` and the scan continues. Exit `0` (including `recall: no archive`), `1` invalid archive directory, `2` usage. |
 | `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`), unless `.devrites/AFK` `max_parallel` is 2 or more or a parallel lease is `running` (the bundle stays whole); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
-| `dispatch <slug> <open\|start\|seal\|return\|status\|abandon\|attribute>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; the start that gives the last role its handle seals the wave, and an explicit seal on a sealed wave is a no-op; `open --claim-session <id> --claim <path>... [--claim-ttl <minutes>]` records one file claim for the wave in claims.jsonl and exits `3`, creating no wave and no claim, while a live foreign session holds an overlapping path; the return that completes the wave releases that claim; `abandon --release` releases it on any other host-confirmed terminal path (a stop or a refused launch); re-opening an abandoned wave inherits its kept claim or, with new claim flags, replaces and releases it; claim flags apply to open only and `--release` to abandon only; start/return auto-record metrics, `return --outcome findings|no-findings|gap` records the role's Outcome line, and `abandon` records its reason, so `metrics summary` shows per-role yield and lost waves. Bare `status` prints every open, sealed, or abandoned wave and folds complete waves into one `N complete wave(s) (use --all)` line; `--all` lists every wave; it still exits nonzero while any wave is open or sealed. For a reviewer, auditor, or test-analyst role, `return --result <file>` stores the return verbatim as `packets/<wave>-<role>.return.md` (exit `3` if that file exists), derives the outcome from its `Outcome:`/`Counts:` head (a malformed or inconsistent head records `gap` with a warning, never `no-findings`), exits `3` when an explicit `--outcome` disagrees, and records each `Finding:` row's `role|slice|file|section|severity` key, so `metrics summary` adds per-role `resolution: resolved re-raised open late` counts. A `--result` file that already is that `packets/` path is kept as the stored return. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer-only wave (for example a Build slice review) may take it, uncapped, so its `Finding:` keys name that slice; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts) or tells the agent to read an installed `agents/devrites-*.md`/`.toml` role contract (on the line or under a "Read …" heading or label; canonical `pack/` paths excepted), and a wright wave's `--contract` gets the same role-contract check; a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. Under `.devrites/AFK` max_parallel >= 2, a build wright wave that leaves `parallel select --from-plan` picks unstarted exits `3` (printing the batch, the command and the parallel-batch lifecycle) until evidence.md records `serial: <skipped ids> — <reason>`; a repair round or a running lease slice does not waive those picks, and a reason that only says the skipped slice is repairing, already started, or in a wave does not count. A wave naming two or more slices needs one `--role slice-wright.<SLICE-ID>` per slice; one shared role exits `3`. HITL runs are never width-refused. A build wright `--contract` must name `gates precheck` under `Writer-safe checks:` when gates.md has a `RUN: writer` gate. `open` exits `3` when a `--role` names no pack agent in a project-level install (a `.<lane>` suffix is allowed), and lints a reviewer packet against the wave's roles, so a recheck may name its own role's fingerprint. Root-edit tripwire (ADR-0038): the first `open` records `<feature>/tree-baseline.json`, which maps dirty product paths outside `.devrites/` and `.scratch/` to their mode plus SHA-256, accepted as user work. The return that completes a wright wave (any phase) adds its slice write sets and claim paths. `open` exits `3` with `unattributed root edit: <paths>` while a dirty product path differs from that baseline and no live claim or in-flight wright wave covers it, unless the new wright wave covers the path through `--claim` or a slice write set. `attribute --reason <evidence> --path <path>...` records owner work, gate output, a standalone wright, or a sanctioned root write for flagged paths only. Each finding writes an `unattributed-edit` metrics row. The engine never reverts a file, and a workspace without the baseline is never blocked. |
+| `dispatch <slug> <open\|start\|seal\|return\|status\|abandon\|attribute>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; the start that gives the last role its handle seals the wave, and an explicit seal on a sealed wave is a no-op; `open --claim-session <id> --claim <path>... [--claim-ttl <minutes>]` records one file claim for the wave in claims.jsonl and exits `3`, creating no wave and no claim, while a live foreign session holds an overlapping path; the return that completes the wave releases that claim; `abandon --release` releases it on any other host-confirmed terminal path (a stop or a refused launch); wave IDs are single-use, including after abandonment; a new attempt needs a new ID, and retained overlapping writer claims require explicit release or host-grounded termination rather than TTL expiry or session reuse; claim flags apply to open only and `--release` to abandon only; start/return auto-record metrics, `return --outcome findings|no-findings|gap` records the role's Outcome line, and `abandon` records its reason, so `metrics summary` shows per-role yield and lost waves. Bare `status` prints every open, sealed, or abandoned wave and folds complete waves into one `N complete wave(s) (use --all)` line; `--all` lists every wave; it still exits nonzero while any wave is open or sealed. For a reviewer, auditor, or test-analyst role, `return --result <file>` stores the return verbatim as `packets/<wave>-<role>.return.md` (exit `3` if that file exists), derives the outcome from its `Outcome:`/`Counts:` head (a malformed or inconsistent head records `gap` with a warning, never `no-findings`), exits `3` when an explicit `--outcome` disagrees, and records each `Finding:` row's `role|slice|file|section|severity` key, so `metrics summary` adds per-role `resolution: resolved re-raised open late` counts. A `--result` file that already is that `packets/` path is kept as the stored return. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer-only wave (for example a Build slice review) may take it, uncapped, so its `Finding:` keys name that slice; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts) or tells the agent to read an installed `agents/devrites-*.md`/`.toml` role contract (on the line or under a "Read …" heading or label; canonical `pack/` paths excepted), and a wright wave's `--contract` gets the same role-contract check; a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. Under `.devrites/AFK` max_parallel >= 2, a build wright wave that leaves `parallel select --from-plan` picks unstarted exits `3` (printing the batch, the command and the parallel-batch lifecycle) until evidence.md records `serial: <skipped ids> — <reason>`; a repair round or a running lease slice does not waive those picks, and a reason that only says the skipped slice is repairing, already started, or in a wave does not count. A wave naming two or more slices needs one `--role slice-wright.<SLICE-ID>` per slice; one shared role exits `3`. HITL runs are never width-refused. A build wright `--contract` must name `gates precheck` under `Writer-safe checks:` when gates.md has a `RUN: writer` gate. `open` exits `3` when a `--role` names no pack agent in a project-level install (a `.<lane>` suffix is allowed), and lints a reviewer packet against the wave's roles, so a recheck may name its own role's fingerprint. Root-edit tripwire (ADR-0038): the first `open` records `<feature>/tree-baseline.json`, which maps dirty product paths outside `.devrites/` and `.scratch/` to their mode plus SHA-256, accepted as user work. The return that completes a wright wave (any phase) adds its slice write sets and claim paths. `open` exits `3` with `unattributed root edit: <paths>` while a dirty product path differs from that baseline and no live claim or in-flight wright wave covers it, unless the new wright wave covers the path through `--claim` or a slice write set. `attribute --reason <evidence> --path <path>...` records owner work, gate output, a standalone wright, or a sanctioned root write for flagged paths only. Each finding writes an `unattributed-edit` metrics row. The engine never reverts a file, and a workspace without the baseline is never blocked. |
 | `candidate freeze <slug> --wave <w> (--slice <SLICE-ID> \| --paths <path>...) [--base <ref>] [--worktree <path>]` | Writes packets/<w>.diff (tracked changes vs base, default HEAD, plus untracked files as /dev/null diffs) and packets/<w>.sha256 (base, diff digest, per-file sha256, aggregate check-candidate digest); never replaces a wave's frozen candidate with a different one. `--worktree <path>` (requires `--base`) reads the same path set from a parallel sibling's linked worktree before it lands: the path must be a symlink-free worktree top level that `git worktree list` names, shares the control repository, and is neither a submodule nor the control checkout. It exits `3` on uncommitted path-set changes there and adds a `head <sha>` row naming the worktree HEAD (the transfer commit); packets stay in the control workspace. |
 | `packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]` | Renders one reviewer/auditor/test-analyst or same-worktree slice-wright by-reference packet (packets/<w>.<role>.md, or packets/<w>.contract.md for a wright) naming the context bundle (the .recheck bundle with `--recheck`) and frozen diff. It copies packets/<w>.sha256 (header rows only when large), lists a wright slice's tasks.md `Tests/proof` as its first writer-safe check, resolves `--checks` through gates.md and approved preflight rows (adding `gates precheck` for `RUN: writer` gates), and accepts only anchored `--focus` rows (a doubt-reviewer's 1-3 row claim is required). It runs the dispatch open lints on a draft and never replaces a prior packet with a refused one (exit `3`). |
 | `metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]` | Append an event to the workspace's `metrics.jsonl` ledger. |
@@ -46,11 +46,11 @@ workflow strategy.
 | `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows every unreleased claim (live, expired, dead) plus one `N released (use --all)` count; `--all` includes released rows; a claim whose holding session has provably exited on this host shows `dead` and no longer conflicts. `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |
 | `note <add\|list\|check\|rm> <slug> ...` | Anchored workspace notes in `notes.md`: `add <slug> <subject> <quote> <title> [body]` binds a note to a verbatim quote in one repository file and assigns `NOTE-###`; `list` and `check` regrade each anchor `exact`/`moved`/`stale`/`ambiguous`/`lost` by searching the repo for the quote (dependency and workspace trees excluded); `check --repair` rewrites a `moved` subject to its new file; `rm` deletes by ID. `check seal` refuses a malformed `notes.md` and any non-`exact` anchor. |
 | `gates <scaffold\|status\|run\|reverify\|lint\|precheck\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. `run`/`reverify --transcripts` atomically publishes a private redacted v2 executed transcript, or returns its verified originating record unchanged, under `references/gates/<gate-id>/`; legacy v1/reuse-only logs cannot authorize reuse. `precheck <slug> --worktree <path> [--slice <SLICE-ID>]` runs every `RUN: writer` gate and `check windows` against the wright's worktree (with `--slice`, it prints `SKIP <gate-id>` for a gate whose id only other unbuilt slices name in `tasks.md`, since gate ids reuse `AC-###` ids; a gate no slice names still runs), prints PASS/FAIL per gate id, exits `3` on any FAIL or on a malformed ledger, and writes no ledger, EVIDENCE line or transcript (`check windows` still appends its metric event); its output is never evidence. |
-| `state resolve <qid> "<answer>"` | Resolve an open question and update `questions.md` plus `state.md` atomically. |
-| `state merge-manifest <slug> [pred...]` | Fold the recorded predecessor chain's manifests into the release candidate manifest. |
+| `state resolve <qid> "<answer>"` | Resolve an open question and update `questions.md` plus `state.md` under the feature lock, with rollback on returned publication errors. Per-file writes are atomic; the pair is not crash-atomic. Incomplete rollback requires inspection and recovery. |
+| `state merge-manifest <slug> [pred...]` | Fold the complete recorded predecessor chain's manifests into the release candidate manifest. Numbered sequences must reach position 1 through consecutive, unique positive positions; explicit predecessor lists cannot omit recorded members. Fully unnumbered legacy chains remain supported. Invalid or missing members leave the manifest unchanged. |
 | `state set <slug> <key>=<value>... [--unset <key>]...` | Write `state.md` cursor fields all-or-nothing under the feature lock. Refuses an unknown `phase`, the engine-owned `schema` row, a pipe or line break in a value, and an overwrite of a saved `return_phase`/`return_next_action`. Setting `status=awaiting_human` under `.devrites/AFK` prints each open question the sentinel's `allow_gates` auto-picks. |
 | `state append <slug> <ledger.md> --heading "<text>" --body-file <path\|->` | Append one `## <heading>` section to `assumptions.md`, `decisions.md`, `drift.md`, `evidence.md`, or `questions.md` atomically. Refuses a heading that already exists outside fenced code and a body line that opens another `#`/`##` section; for a new `questions.md` `q-` entry, also refuses a non-open status, a missing or unknown gate, a raised_at that is not a full RFC 3339 timestamp, options outside 2-4 concrete choices plus the closing "Something else" escape hatch, `(Recommended)` on any option but 1, and `proposed:` without a `(Recommended)` option 1 (or option 1 without `proposed:`); question or entry length is advisory only; reports an advisory when the ledger passes its line budget, and blocks (exit 3, nothing written) when a ledger other than evidence.md would land at or above 1.5x its line or byte budget without a covering `Budget override: <=N lines; <reason>` (N at most 2x the line budget). |
-| `state close <slug>` | Archive a shipped workspace and clear matching `ACTIVE`. |
+| `state close <slug>` | Archive a workspace and clear matching `ACTIVE`. Final phases/statuses enforce Seal structure, candidate freshness, release-union integrity, retained reviewer settlement, and runnable gate origins before mutation. Explicit nonfinal exits remain physical archival, not proof of delivery. |
 | `migrate <slug> [--dry-run] [--answer id=choice]` | Normalize a pre-v5 workspace to the current schema; fail-closed, one-shot. |
 | `secret-scan [--staged] [--stdin] [slug]` | Scan exact staged blobs, stdin, or touched regular files for credential material. |
 | `open-visual <path-or-name> [--slug <slug>] [--no-open]` | Resolve a local visual HTML file, optionally open it in the OS browser, warn if the sibling outline is missing or inventory ids are absent from HTML, and print agent path tips. No network. |
@@ -65,6 +65,38 @@ The full label remains in bundle filenames and attribution. Reviewer
 `--outcome findings|no-findings|gap`; omitting both refuses the return without
 changing the wave or releasing its claim. Non-reviewer returns are unchanged.
 
+Generated packets bind an immutable wave/role context snapshot and its actual
+SHA-256, not a mutable generic or recheck bundle. Workspace overrides retain their
+validated metadata namespace; foreign paths, escapes, and linked context parents
+cannot replace that authority.
+
+Seal and final closeout require settled native accounts for every launched role;
+open/sealed proof, custom, and writer roles block too. At least one actual reviewer
+account remains required. Abandoned proof/reviewer accounts need a genuinely newer
+settled account with the same canonical phase, role, and exact unordered slice set,
+a distinct native handle, and valid start/return times. An abandoned writer or
+claim-holder instead needs its actual native returns or host-confirmed termination
+recorded by `dispatch abandon --release`; replacement work alone cannot prove death.
+That command records `terminal_at` even for a claimless or refused launch, without
+fabricating returned work or review approval. A failed claim release cannot stamp it.
+An empty, missing, or malformed dispatch ledger cannot establish settlement.
+Every met runnable gate must retain its approved, bound execution origin, including
+complete v2 metadata/footer and matching body bytes when unredacted and untruncated.
+These final checks do not rerun proof commands.
+
+Feature mutation locks live at `.devrites/.locks/features/<slug>/.lock`, outside
+movable workspace directories, and remain held through archival and `ACTIVE`
+updates. A closed slug cannot recreate a work directory through a stale writer.
+Stop existing controllers before upgrading, then restart them together; old and
+new lock protocols must not run concurrently.
+
+Vet readiness identities bind normalized `gates.md` definitions: gate membership,
+IDs, titles, `CHECK`, `EXPECT`, `CWD`, `INPUTS`, and `RUN`. Checkbox, evidence, and
+progress changes do not invalidate Vet; changing an oracle or converting a
+runnable gate to manual requires Plan repair and re-Vet. Older identities that
+omitted these definitions require normal re-Vet after upgrade, never a manual
+hash refresh or inferred approval.
+
 `help`, `-h`, and `--help` print this operational inventory. Each operational
 command and subcommand also accepts `-h` / `--help` and prints that command's
 usage to stdout without requiring a workspace. `version` and `--version` print

package/docs/engine/workspace-schema.md

@@ -157,8 +157,9 @@ not runtime authorities. See
 
 - New question IDs are `q-YYYY-MM-DD-NNN`. The root scans all same-day headers,
   chooses the next unused suffix, re-reads immediately before append, and
-  recomputes on collision. `state resolve` remains the atomic answer/drop/batch
-  writer; it does not allocate IDs.
+  recomputes on collision. `state resolve` remains the locked, rollback-protected
+  answer/drop/batch writer; it does not allocate IDs. Paired file updates are not
+  a crash-atomic transaction.
 - The root directly owns later-phase Clarify entry/restore cursor edits and AFK
   slice accounting, preserving unrelated Markdown. See
   [`state-schema.md`](state-schema.md).
@@ -187,7 +188,7 @@ The engine provides only:
 - `check seal`: final file completeness and open-human-gate checks, the
   `tasks.md` slice graph, then the readiness-binding recheck, then exact
   candidate bindings after that aggregate gate passes;
-- atomic `state resolve` answer/drop/batch and transactional `state close`;
+- locked, rollback-protected `state resolve` answer/drop/batch and transactional `state close`;
 - secret scanning, version reporting, and local install lifecycle primitives.
 
 A marker or file can satisfy structural presence without proving semantic

package/docs/release.md

@@ -24,8 +24,11 @@ version and run these steps:
 
 The release archive
 consumes the validated generated files from the same Git index as the rest of
-its payload. Package and release installs validate and copy
-`pack/generated/{claude,codex,omp,pi,devin}`. When a shell install or update shim runs from a
+its payload. Prior build outputs under `engine/dist/` remain excluded even when
+indexed.
+
+Package and release installs validate and copy
+`pack/generated/{claude,codex,omp,pi,devin,dsh}`. When a shell install or update shim runs from a
 source checkout whose generated payload is incomplete, the shim may regenerate
 the missing host payload before handing that local candidate to the engine. The
 engine itself only validates and copies host payloads; it never generates them.

package/engine/Makefile

@@ -1,7 +1,7 @@
 BINARY  := devrites
 DIST    := dist
-# darwin/amd64 kept for Intel Macs; the five targets the release matrix ships.
-PLATFORMS := darwin/arm64 darwin/amd64 linux/amd64 linux/arm64 windows/amd64
+# darwin/amd64 kept for Intel Macs; the six targets the release matrix ships.
+PLATFORMS := darwin/arm64 darwin/amd64 linux/amd64 linux/arm64 windows/amd64 windows/arm64
 
 .PHONY: build test test-race vet quality govulncheck lint cover crosscompile clean
 

package/engine/internal/acceptance/newfinal_origins.go

@@ -0,0 +1,39 @@
+package acceptance
+
+import "fmt"
+
+// CheckRetainedOrigins checks current runnable met gates without executing commands.
+// Historical candidate labels remain valid when the definition and INPUTS match.
+func CheckRetainedOrigins(root, slug string) error {
+	work, ledgerPath, testPlanPath, project, err := featurePaths(root, slug)
+	if err != nil {
+		return err
+	}
+	text, err := ReadLedgerFile(ledgerPath)
+	if err != nil {
+		return err
+	}
+	doc := ParseLedger(text)
+	if len(doc.Errors) != 0 {
+		return fmt.Errorf("retained gate origins: invalid %s: %v", GatesFile, doc.Errors)
+	}
+	approved := loadTestPlan(testPlanPath)
+	for _, gate := range doc.Gates {
+		if gate.Check == "" || GateState(gate, doc) != StateMet {
+			continue
+		}
+		if !Approved(gate.Check, gate.Cwd, approved) {
+			return fmt.Errorf("gate %s: CHECK/CWD is not approved by current test-plan.md; restore the approved definition and record its passing origin", gate.ID)
+		}
+		if gate.Inputs != "" {
+			inputs, err := InputsDigest(project, gate.Inputs)
+			if err != nil || inputs == "" || inputs != recordedInputs(gate) {
+				return fmt.Errorf("gate %s: retained origin does not match current INPUTS; record a passing approved check against current inputs", gate.ID)
+			}
+		}
+		if passingOrigin(work, gate) == "" {
+			return fmt.Errorf("gate %s: no usable retained passing origin; record the approved check with gates run --transcripts", gate.ID)
+		}
+	}
+	return nil
+}

package/engine/internal/acceptance/preconditions.go

@@ -44,13 +44,20 @@ func PreflightRowsPassed(root, slug string, rows []PreflightRow) (bool, error) {
 	return true, nil
 }
 
-// PreflightPassed reports whether the row's newest transcript under
-// <work>/references/gates/ records RESULT: pass. The transcript records its
-// candidate but the lookup does not compare it: Vet writes workspace artifacts
-// after the run, and only a change to the row's command or cwd retires a pass.
+// PreflightPassed requires the newest transcript to be a complete passing record
+// for this row. Historical candidate labels do not retire an unchanged row.
 func PreflightPassed(work string, row PreflightRow) bool {
-	dir := filepath.Join(work, "references", "gates", transcriptGateName(PreflightGateID(row)))
-	entries, err := os.ReadDir(dir)
+	dir, err := transcriptDirectory(work, PreflightGateID(row), false)
+	if err != nil {
+		return false
+	}
+	defer func() { _ = dir.Close() }()
+	listing, err := dir.Open(".")
+	if err != nil {
+		return false
+	}
+	entries, err := listing.ReadDir(-1)
+	_ = listing.Close()
 	if err != nil {
 		return false
 	}
@@ -67,11 +74,10 @@ func PreflightPassed(work string, row PreflightRow) bool {
 	if newest == "" {
 		return false
 	}
-	// #nosec G304 -- transcript path built from the workspace and a sanitized row id
-	body, err := os.ReadFile(filepath.Join(dir, newest))
-	// Only the header counts: command output could print the verdict line.
-	header, _, _ := strings.Cut(string(body), "--- OUTPUT ---")
-	return err == nil && strings.Contains(header, "\nRESULT: pass\n")
+	body, err := readTranscript(dir, newest)
+	gate := &Gate{ID: PreflightGateID(row), Title: row.Gate, Check: row.Command, Cwd: row.Cwd,
+		Expect: "exit 0 (Expected: " + valueOr(row.Expected, "unstated") + ")"}
+	return err == nil && validTranscript(string(body), gate, nil)
 }
 
 // RunPreconditions is `check preconditions <slug> [--slice S]`: it executes

package/engine/internal/acceptance/transcript.go

@@ -236,6 +236,11 @@ func readTranscript(dir *os.Root, name string) ([]byte, error) {
 }
 
 func validOrigin(raw string, gate *Gate, evidence []string) bool {
+	return validTranscript(raw, gate, evidence)
+}
+
+// validTranscript validates complete executed records; evidence additionally binds ledger proof.
+func validTranscript(raw string, gate *Gate, evidence []string) bool {
 	const footer = "TRANSCRIPT_SHA256: "
 	end := strings.LastIndex(raw, footer)
 	if end < 0 || raw[end:] != footer+OutputDigest(raw[:end])+"\n" {
@@ -261,14 +266,25 @@ func validOrigin(raw string, gate *Gate, evidence []string) bool {
 	for key, want := range map[string]string{
 		"GATE": transcriptMetadata(gate.ID), "TITLE": transcriptMetadata(gate.Title),
 		"COMMAND": transcriptMetadata(gate.Check), "CWD": transcriptMetadata(valueOr(gate.Cwd, ".")),
-		"EXPECT": transcriptMetadata(gate.Expect), "DEFINITION_SHA256": evidence[1],
-		"INPUTS": transcriptMetadata(valueOr(gate.Inputs, "none")), "INPUTS_SHA256": valueOr(evidence[4], "none"),
-		"RESULT": "pass", "EXIT": "0", "OUTPUT_SHA256": evidence[2], "OUTPUT_BYTES": evidence[3],
+		"EXPECT": transcriptMetadata(gate.Expect), "DEFINITION_SHA256": DefinitionDigest(gate),
+		"INPUTS": transcriptMetadata(valueOr(gate.Inputs, "none")),
+		"RESULT": "pass", "EXIT": "0",
 	} {
 		if got, exists := fields[key]; !exists || got != want {
 			return false
 		}
 	}
+	if evidence != nil && (fields["DEFINITION_SHA256"] != evidence[1] || fields["OUTPUT_SHA256"] != evidence[2] ||
+		fields["OUTPUT_BYTES"] != evidence[3] || fields["INPUTS_SHA256"] != valueOr(evidence[4], "none")) {
+		return false
+	}
+	if fields["INPUTS_SHA256"] != "none" && !transcriptDigestRE.MatchString(fields["INPUTS_SHA256"]) {
+		return false
+	}
+	bytes, err := strconv.ParseInt(fields["OUTPUT_BYTES"], 10, 64)
+	if err != nil || bytes < 0 || !transcriptDigestRE.MatchString(fields["OUTPUT_SHA256"]) {
+		return false
+	}
 	started, err := time.Parse(time.RFC3339Nano, fields["STARTED"])
 	if err != nil || started.IsZero() {
 		return false
@@ -286,7 +302,10 @@ func validOrigin(raw string, gate *Gate, evidence []string) bool {
 		return false
 	}
 	truncated, err := strconv.ParseBool(fields["TRUNCATED"])
-	return err == nil && len(output) <= maxTranscriptOutput && (!truncated || len(output) == maxTranscriptOutput)
+	if err != nil || len(output) > maxTranscriptOutput || (truncated && len(output) != maxTranscriptOutput) {
+		return false
+	}
+	return redactions != 0 || truncated || (bytes == int64(len(output)) && fields["OUTPUT_SHA256"] == OutputDigest(output))
 }
 
 func exitLabel(outcome RunOutcome) string {

package/engine/internal/gate/gate.go

@@ -316,23 +316,25 @@ var (
 	specAcceptanceClaimRE       = regexp.MustCompile(`(?im)^\s{0,3}#{1,6}\s+.*acceptance criteria|\bAC-\d+\b`)
 )
 
-// specClaimsAcceptance reports whether structural (unfenced) spec text looks
+// specClaimsAcceptance reports whether spec prose looks
 // like it carries acceptance criteria, so a parse that finds none is a defect
 // in the spec rather than a spec with nothing to map.
 func specClaimsAcceptance(spec []byte) bool {
-	structural, err := markdowntext.Structural(spec)
+	structural, err := markdowntext.Prose(spec)
 	return err == nil && specAcceptanceClaimRE.Match(structural)
 }
 
-// specUnreadAcceptanceProblems names acceptance text the parser skips: ids that
-// are not exactly three digits and acceptance headings after the first
-// canonical one, which would otherwise escape the coverage check.
+// specUnreadAcceptanceProblems names acceptance text the parser skips:
+// noncanonical ids/headings and declarations outside the canonical section.
 func specUnreadAcceptanceProblems(spec []byte) []string {
-	structural, err := markdowntext.Structural(spec)
+	structural, err := markdowntext.Prose(spec)
 	if err != nil {
 		return nil
 	}
 	var problems []string
+	for _, id := range state.AcceptanceDeclarationsOutsideSection(spec) {
+		problems = append(problems, fmt.Sprintf("spec.md declares %s outside the first `## Acceptance criteria` section, so the gate does not check it", id))
+	}
 	seen := map[string]bool{}
 	readHeading := false
 	for _, line := range strings.Split(string(structural), "\n") {