devrites 7.3.2 → 7.3.4

package/engine/internal/lib/handoff.go

@@ -89,12 +89,9 @@ func RunHandoff(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stdout, "missing_required: %s\n", strings.Join(report.MissingFiles, ", "))
 	}
 	fmt.Fprintf(stdout, "read_next: %s\n", strings.Join(readNext(featureDir), ", "))
-	verdict, err := classifyContinuation(root, slug)
-	if err != nil {
-		fmt.Fprintf(stderr, "handoff: continuation: %v\n", err)
-		return 2
+	if code := RunCheckContinuation(root, []string{slug}, stdout, stderr); code != 0 {
+		return code
 	}
-	writeContinuation(stdout, verdict)
 	if resume {
 		recordMetric(root, slug, string(report.Phase), "resume", "root", 0)
 	}

package/engine/internal/lib/next.go

@@ -73,6 +73,16 @@ func RunNext(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stdout, "blocked: %s\n", unattributedMessage(slug, flagged))
 		exit = 3
 	}
+	if afkPresent(root) {
+		lines, err := FrontierLines(root, slug)
+		if err != nil {
+			fmt.Fprintf(stderr, "next: frontier: %v\n", err)
+			return 2
+		}
+		for _, line := range lines {
+			fmt.Fprintln(stdout, line)
+		}
+	}
 	if report.Phase == state.PhaseBuild {
 		printPlanBatch(stdout, root, slug)
 	}

package/engine/internal/lib/regression.go

@@ -361,11 +361,6 @@ func updateRegressionBaseline(root, slug, baselinePath string, base regressionBa
 			return 3
 		}
 	}
-	// Keep the phase high-water mark: a baseline never forgets the furthest phase.
-	if hasBaseline && base.PhaseOrdinal > current.PhaseOrdinal {
-		current.PhaseOrdinal = base.PhaseOrdinal
-		current.Phase = base.Phase
-	}
 	next := regressionBaseline{
 		Version:             1,
 		UpdatedAt:           time.Now().UTC().Format(time.RFC3339),

package/engine/internal/lib/resolve.go

@@ -11,7 +11,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/devrites/devrites/internal/fsutil"
+	"github.com/devrites/devrites/internal/devritespaths"
 	"github.com/devrites/devrites/internal/markdowntext"
 	"github.com/devrites/devrites/internal/state"
 	"github.com/devrites/devrites/internal/workflow"
@@ -25,11 +25,24 @@ import (
 //	0  resolved         2  no active workspace      3  qid not found
 //	4  qid not open      5  bad arguments
 func Resolve(root string, args []string, stdout, stderr io.Writer) int {
+	return resolveWithLock(root, args, stdout, stderr, state.WithFeatureLockIn)
+}
+
+func resolveWithLock(root string, args []string, stdout, stderr io.Writer, withLock func(*os.Root, string, func() error) error) int {
 	slug := activeSlug(root)
 	if slug == "" {
 		return fail(stderr, "No active workspace. Run "+workflow.ForVerb("spec").Both()+" <feature> first.", 2)
 	}
-	work := featureDir(root, slug)
+	work, err := devritespaths.ExistingFeatureDirChecked(root, slug)
+	if err != nil {
+		return fail(stderr, err.Error(), 2)
+	}
+	// Pin the selected root before waiting; workspace paths may change meanwhile.
+	selectedRoot, err := os.OpenRoot(root)
+	if err != nil {
+		return fail(stderr, err.Error(), 2)
+	}
+	defer func() { _ = selectedRoot.Close() }()
 	qfile := filepath.Join(work, "questions.md")
 	sfile := filepath.Join(work, "state.md")
 	if !isFile(qfile) {
@@ -79,8 +92,13 @@ func Resolve(root string, args []string, stdout, stderr io.Writer) int {
 	}
 
 	code := 0
-	if err := state.WithFeatureLock(root, slug, func() error {
-		code = resolveMutation(slug, mode, qid, payload, qfile, sfile, human, stdout, stderr)
+	if err := withLock(selectedRoot, slug, func() error {
+		ws, err := selectedRoot.OpenRoot(filepath.Join("work", slug))
+		if err != nil {
+			return err
+		}
+		defer func() { _ = ws.Close() }()
+		code = resolveMutation(ws, slug, mode, qid, payload, human, stdout, stderr, writeBundleTargets)
 		return nil
 	}); err != nil {
 		return fail(stderr, err.Error(), 1)
@@ -88,7 +106,7 @@ func Resolve(root string, args []string, stdout, stderr io.Writer) int {
 	return code
 }
 
-func resolveMutation(slug, mode, qid, payload, qfile, sfile string, human bool, stdout, stderr io.Writer) int {
+func resolveMutation(ws *os.Root, slug, mode, qid, payload string, human bool, stdout, stderr io.Writer, publish func(*os.Root, []*bundleTarget) error) int {
 	type resolution struct{ qid, status, text string }
 	var entries []resolution
 	switch mode {
@@ -125,15 +143,13 @@ func resolveMutation(slug, mode, qid, payload, qfile, sfile string, human bool,
 	if len(entries) == 0 {
 		return 0
 	}
-	// #nosec G304 -- questions.md path inside the feature workspace
-	qdata, err := os.ReadFile(qfile)
+	qdata, err := ws.ReadFile("questions.md")
 	if err != nil {
-		return fail(stderr, "questions.md missing at "+qfile, 2)
+		return fail(stderr, fmt.Sprintf("read questions.md: %v", err), 2)
 	}
-	// #nosec G304 -- state.md path inside the feature workspace
-	sdata, err := os.ReadFile(sfile)
+	sdata, err := ws.ReadFile("state.md")
 	if err != nil {
-		return fail(stderr, fmt.Sprintf("read state %s: %v", sfile, err), 1)
+		return fail(stderr, fmt.Sprintf("read state.md: %v", err), 1)
 	}
 	lines := splitLinesNoTrailing(qdata)
 	nextState := sdata
@@ -147,13 +163,14 @@ func resolveMutation(slug, mode, qid, payload, qfile, sfile string, human bool,
 			return fail(stderr, err.Error(), 1)
 		}
 	}
-	if err := fsutil.WriteFileAtomic(qfile, joinRecords(lines), 0o644); err != nil {
-		return fail(stderr, err.Error(), 1)
+	targets := []*bundleTarget{
+		{rel: "questions.md", before: qdata, existed: true, after: joinRecords(lines)},
 	}
 	if !bytes.Equal(nextState, sdata) {
-		if err := fsutil.WriteFileAtomic(sfile, nextState, 0o644); err != nil {
-			return fail(stderr, fmt.Sprintf("update state %s: %v", sfile, err), 1)
-		}
+		targets = append(targets, &bundleTarget{rel: "state.md", before: sdata, existed: true, after: nextState})
+	}
+	if err := publish(ws, targets); err != nil {
+		return fail(stderr, err.Error(), 1)
 	}
 	switch mode {
 	case "answer":

package/engine/internal/parallel/cli.go

@@ -73,6 +73,10 @@ func runPathDisjoint(args []string, stdin io.Reader, stdout, stderr io.Writer) i
 	return ExitOK
 }
 
+// FrontierNotices exposes related work without broadening source-local selection.
+// main wires it from lib to avoid an import cycle.
+var FrontierNotices func(root, slug string) ([]string, error)
+
 func cmdSelect(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	root := ""
 	slug := ""
@@ -148,21 +152,18 @@ func cmdSelect(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 			return ExitUsage
 		}
 		if sawWorkspaces {
-			order := []string{slug}
+			order := strings.Split(workspaces, ",")
 			seen := make(map[string]bool)
 			if err := validateSlug(slug); err != nil {
 				fmt.Fprintf(stderr, "parallel select: %v\n", err)
 				return ExitUsage
 			}
-			for _, target := range strings.Split(workspaces, ",") {
+			for _, target := range order {
 				if err := validateSlug(target); err != nil || seen[target] {
 					fmt.Fprintf(stderr, "parallel select: invalid or duplicate workspace %q\n", target)
 					return ExitUsage
 				}
 				seen[target] = true
-				if target != slug {
-					order = append(order, target)
-				}
 			}
 			if _, err := controllerLease(root, slug); err != nil {
 				fmt.Fprintf(stderr, "parallel select: %v\n", err)
@@ -199,6 +200,16 @@ func cmdSelect(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 				slices = append(slices, ready...)
 			}
 		} else {
+			if FrontierNotices != nil {
+				notices, err := FrontierNotices(root, slug)
+				for _, notice := range notices {
+					fmt.Fprintln(stderr, notice)
+				}
+				if err != nil {
+					fmt.Fprintf(stderr, "parallel select: frontier: %v\n", err)
+					return ExitBlocked
+				}
+			}
 			if PlanReady == nil {
 				fmt.Fprintln(stderr, "parallel select: --from-plan is unavailable in this build")
 				return ExitBlocked

package/engine/internal/parallel/ops.go

@@ -217,8 +217,8 @@ type AddOpts struct {
 	Capacity int
 }
 
-// Add refills freed slots of a running lease: each new slice gets a worktree
-// from the current control tip, under the same path-disjoint and cap rules as
+// Add refills freed slots of a running, integrate-failed, or complete lease:
+// each new slice gets a worktree from the current control tip, under the same path-disjoint and cap rules as
 // the slices still active. Landed (integrated) slices no longer claim paths.
 // An explicit Capacity with no Slices changes only the bound, not lease status.
 func Add(opts AddOpts) (lease *Lease, err error) {
@@ -262,8 +262,8 @@ func addLocked(opts AddOpts) (*Lease, error) {
 	if opts.Capacity == 0 {
 		opts.Capacity = leaseCapacity(lease)
 	}
-	if lease.Status != StatusRunning && lease.Status != StatusComplete {
-		return nil, fmt.Errorf("add requires status=running|complete (have %s)", lease.Status)
+	if lease.Status != StatusRunning && lease.Status != StatusIntegrateFailed && lease.Status != StatusComplete {
+		return nil, fmt.Errorf("add requires status=running|integrate-failed|complete (have %s)", lease.Status)
 	}
 	head, err := revParse(opts.Root, expectedControl(lease))
 	if err != nil {
@@ -329,7 +329,9 @@ func addLocked(opts AddOpts) (*Lease, error) {
 	lease.Slices = append(lease.Slices, made...)
 	lease.N = len(lease.Slices)
 	lease.Capacity = opts.Capacity
-	lease.Status = StatusRunning
+	if lease.Status == StatusComplete {
+		lease.Status = StatusRunning
+	}
 	if err := WriteLease(leasePath, lease); err != nil {
 		rollback()
 		return nil, err

package/engine/internal/parallel/repository.go

@@ -167,6 +167,19 @@ func controllerLease(root, controller string) (*repositoryLease, error) {
 	return found, nil
 }
 
+// ControllerLease returns the retained repository controller without changing its lease.
+// A lease in another checkout requires recovery at that explicit control root.
+func ControllerLease(repoRoot string) (string, *Lease, error) {
+	found, err := controllerLease(repoRoot, "")
+	if err != nil || found == nil {
+		return "", nil, err
+	}
+	if found.root != resolvedPath(repoRoot) {
+		return "", nil, fmt.Errorf("repository controller lease retained by %s at %s; recover at its explicit root", found.controller, found.root)
+	}
+	return found.controller, found.lease, nil
+}
+
 // WorkspaceLeased protects both controller and source workspaces until cleanup.
 // devritesRoot is explicit; closeout holds WithControlLock through its rename.
 func WorkspaceLeased(devritesRoot, workspace string) (bool, error) {

package/engine/internal/release/release.go

@@ -16,10 +16,12 @@ import (
 	"net/netip"
 	"net/url"
 	"os"
+	"os/exec"
 	"path"
 	"path/filepath"
 	"regexp"
 	"runtime"
+	"strconv"
 	"strings"
 	"time"
 )
@@ -162,13 +164,13 @@ func binaryNameFor(goos, goarch string) (string, error) {
 }
 
 func fetchJSON(ctx context.Context, rawURL string, out any) error {
-	resp, err := get(ctx, rawURL)
+	resp, err := get(ctx, rawURL, true)
 	if err != nil {
 		return err
 	}
 	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode < 200 || resp.StatusCode > 299 {
-		return fmt.Errorf("%s returned %s", resp.Request.URL.Redacted(), resp.Status)
+		return responseError(resp)
 	}
 	if resp.ContentLength > maxJSONBytes {
 		return fmt.Errorf("JSON response exceeds %d bytes", maxJSONBytes)
@@ -228,13 +230,13 @@ func downloadVerified(ctx context.Context, rawURL, destination, filename string,
 }
 
 func download(ctx context.Context, rawURL, destination string, maxBytes int64, mode fs.FileMode) error {
-	resp, err := get(ctx, rawURL)
+	resp, err := get(ctx, rawURL, false)
 	if err != nil {
 		return err
 	}
 	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode < 200 || resp.StatusCode > 299 {
-		return fmt.Errorf("%s returned %s", resp.Request.URL.Redacted(), resp.Status)
+		return responseError(resp)
 	}
 	if resp.ContentLength > maxBytes {
 		return fmt.Errorf("download exceeds %d bytes", maxBytes)
@@ -274,7 +276,7 @@ func download(ctx context.Context, rawURL, destination string, maxBytes int64, m
 	return nil
 }
 
-func get(ctx context.Context, rawURL string) (*http.Response, error) {
+func get(ctx context.Context, rawURL string, authenticate bool) (*http.Response, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
 	if err != nil {
 		return nil, fmt.Errorf("build release request: %w", err)
@@ -284,9 +286,94 @@ func get(ctx context.Context, rawURL string) (*http.Response, error) {
 	}
 	req.Header.Set("Accept", "application/vnd.github+json")
 	req.Header.Set("User-Agent", "devrites-engine")
+	if authenticate && isGitHubAPI(req.URL) {
+		token, err := githubToken(ctx)
+		if err != nil {
+			return nil, err
+		}
+		if token != "" {
+			req.Header.Set("Authorization", "Bearer "+token)
+		}
+	}
 	return httpClient.Do(req)
 }
 
+func isGitHubAPI(u *url.URL) bool {
+	return u != nil && u.User == nil && strings.EqualFold(u.Scheme, "https") &&
+		(strings.EqualFold(u.Host, "api.github.com") || strings.EqualFold(u.Host, "api.github.com:443"))
+}
+
+// credentialOutput bounds untrusted helper output without accepting a truncated token.
+type credentialOutput struct {
+	data [4096]byte
+	n    int
+}
+
+func (out *credentialOutput) Write(p []byte) (int, error) {
+	if len(p) > len(out.data)-out.n {
+		return 0, errors.New("GitHub credential helper output exceeds limit")
+	}
+	out.n += copy(out.data[out.n:], p)
+	return len(p), nil
+}
+
+// githubToken follows gh's environment precedence without requiring gh to be installed.
+func githubToken(ctx context.Context) (string, error) {
+	token := os.Getenv("GH_TOKEN")
+	if token == "" {
+		token = os.Getenv("GITHUB_TOKEN")
+	}
+	if token == "" {
+		lookupCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
+		defer cancel()
+		cmd := exec.CommandContext(lookupCtx, "gh", "auth", "token", "--hostname", "github.com")
+		cmd.Env = append(os.Environ(), "GH_PROMPT_DISABLED=1", "GIT_TERMINAL_PROMPT=0")
+		cmd.Stderr = io.Discard
+		cmd.WaitDelay = 100 * time.Millisecond
+		var output credentialOutput
+		cmd.Stdout = &output
+		err := cmd.Run()
+		if ctx.Err() != nil {
+			return "", ctx.Err()
+		}
+		if err != nil {
+			return "", nil
+		}
+		token = strings.TrimSpace(string(output.data[:output.n]))
+	}
+	for _, char := range token {
+		if char < '!' || char > '~' {
+			return "", errors.New("invalid GitHub credential; check GH_TOKEN, GITHUB_TOKEN, or gh auth login --hostname github.com")
+		}
+	}
+	return token, nil
+}
+
+func responseError(resp *http.Response) error {
+	message := fmt.Sprintf("release request returned HTTP %d %s", resp.StatusCode, http.StatusText(resp.StatusCode))
+	switch resp.StatusCode {
+	case http.StatusUnauthorized, http.StatusForbidden:
+		message += "; check GH_TOKEN/GITHUB_TOKEN (environment tokens take precedence) or run gh auth login --hostname github.com"
+	case http.StatusTooManyRequests:
+		message += "; GitHub API rate limit reached; use GH_TOKEN/GITHUB_TOKEN or gh auth login --hostname github.com, or wait before retrying"
+	}
+	if resp.StatusCode == http.StatusForbidden && resp.Header.Get("X-RateLimit-Remaining") == "0" {
+		message += "; GitHub API rate limit reached"
+	}
+	if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden || resp.StatusCode == http.StatusTooManyRequests {
+		if reset, err := strconv.ParseInt(resp.Header.Get("X-RateLimit-Reset"), 10, 64); err == nil && reset >= 0 && reset <= 253402300799 {
+			message += "; rate limit resets at " + time.Unix(reset, 0).UTC().Format(time.RFC3339)
+		}
+		retry := resp.Header.Get("Retry-After")
+		if seconds, err := strconv.ParseUint(retry, 10, 32); err == nil {
+			message += fmt.Sprintf("; retry after %d seconds", seconds)
+		} else if date, err := http.ParseTime(retry); err == nil {
+			message += "; retry after " + date.UTC().Format(time.RFC3339)
+		}
+	}
+	return errors.New(message)
+}
+
 func validateURL(u *url.URL) error {
 	if u == nil || u.Hostname() == "" {
 		return errors.New("release URL has no host")
@@ -303,6 +390,10 @@ func validateURL(u *url.URL) error {
 }
 
 func checkRedirect(req *http.Request, via []*http.Request) error {
+	// net/http forwards sensitive headers to subdomains; GitHub tokens must not follow.
+	if !isGitHubAPI(req.URL) {
+		req.Header.Del("Authorization")
+	}
 	if len(via) >= 10 {
 		return errors.New("stopped after 10 redirects")
 	}

package/engine/internal/rootfacts/facts.go

@@ -257,6 +257,17 @@ func inspectWorkspaceState(facts *Facts) {
 	if root == "" {
 		return
 	}
+	work := filepath.Join(root, "work")
+	if info, err := os.Lstat(work); err == nil && info.Mode()&os.ModeSymlink != 0 && !safepath.WithinResolved(work, root) {
+		facts.Hazards = append(facts.Hazards, Hazard{
+			ID:          "DRV-WORKSPACE-SYMLINK-ESCAPE",
+			Severity:    "error",
+			Message:     fmt.Sprintf("workspace path %q resolves outside the selected root", work),
+			Remediation: fmt.Sprintf("rm %s", shellQuote(work)),
+			Refuse:      true,
+		})
+		return
+	}
 	entries, err := os.ReadDir(filepath.Join(root, "work"))
 	if err == nil {
 		for _, entry := range entries {

package/engine/internal/state/lock_other.go

@@ -18,6 +18,10 @@ func acquireLock(path string) (*fileLock, error) {
 	if err != nil {
 		return nil, fmt.Errorf("acquire lock: %w", err)
 	}
+	return lockOpened(f, path)
+}
+
+func lockOpened(f *os.File, path string) (*fileLock, error) {
 	return &fileLock{f: f}, nil
 }
 

package/engine/internal/state/write.go

@@ -76,25 +76,66 @@ func AppendLog(path, record string) error {
 // is released automatically even if the process dies mid-operation (crash-safe);
 // see lock_unix.go / lock_other.go.
 func WithFeatureLock(root, slug string, fn func() error) error {
+	if !devritespaths.ValidSlug(slug) {
+		return fmt.Errorf("lock feature %q: not a feature slug", slug)
+	}
+	// The caller-selected root may be new; descendants are created through it.
+	if err := os.MkdirAll(root, 0o755); err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	selected, err := os.OpenRoot(root)
+	if err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	defer func() { _ = selected.Close() }()
+	return WithFeatureLockIn(selected, slug, fn)
+}
+
+// WithFeatureLockIn locks a feature within root without following escaping
+// symlinks. The caller retains ownership of root.
+func WithFeatureLockIn(root *os.Root, slug string, fn func() error) error {
 	if !devritespaths.ValidSlug(slug) {
 		return fmt.Errorf("lock feature %q: not a feature slug", slug)
 	}
 	// Keep the lock outside the movable workspace; never unlink it on release.
-	lockDir := filepath.Join(root, ".locks", "features", slug)
-	if err := os.MkdirAll(lockDir, 0o755); err != nil {
+	lockDir := filepath.Join(".locks", "features", slug)
+	if err := root.MkdirAll(lockDir, 0o755); err != nil {
 		return fmt.Errorf("lock feature %q: %w", slug, err)
 	}
-	return WithLock(filepath.Join(lockDir, ".lock"), func() error {
-		if _, err := os.Lstat(filepath.Join(root, "archive", slug)); err == nil {
-			return fmt.Errorf("lock feature %q: workspace is closed (archived)", slug)
-		} else if !errors.Is(err, fs.ErrNotExist) {
-			return fmt.Errorf("lock feature %q: %w", slug, err)
-		}
-		if err := os.MkdirAll(featureDir(root, slug), 0o755); err != nil {
-			return fmt.Errorf("lock feature %q: %w", slug, err)
-		}
-		return fn()
-	})
+	lockPath := filepath.Join(lockDir, ".lock")
+	// Separate atomic creation from opening a concurrent creator's lock.
+	f, err := root.OpenFile(lockPath, os.O_CREATE|os.O_EXCL|os.O_RDWR, 0o644)
+	if errors.Is(err, fs.ErrExist) {
+		f, err = root.OpenFile(lockPath, os.O_RDWR, 0)
+	}
+	if err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	l, err := lockOpened(f, filepath.Join(root.Name(), lockPath))
+	if err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	defer func() { _ = l.release() }()
+	held, err := f.Stat()
+	if err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	current, err := root.Lstat(lockPath)
+	if errors.Is(err, fs.ErrNotExist) || (err == nil && !os.SameFile(held, current)) {
+		return fmt.Errorf("lock feature %q: %w", slug, ErrWorkspaceMoved)
+	}
+	if err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	if _, err := root.Lstat(filepath.Join("archive", slug)); err == nil {
+		return fmt.Errorf("lock feature %q: workspace is closed (archived)", slug)
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	if err := root.MkdirAll(filepath.Join("work", slug), 0o755); err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
+	}
+	return fn()
 }
 
 // WithLock runs fn while holding the same exclusive advisory lock as

package/engine/main.go

@@ -26,6 +26,7 @@ Usage:
   devrites-engine install [flags]          Install DevRites skills, agents, and host configuration
   devrites-engine update [flags]           Update an existing DevRites install in place
   devrites-engine uninstall [flags]        Remove a DevRites install, preserving runtime state
+  devrites-engine frontier [slug]          Discover related ready work and native preparation without writes
   devrites-engine check candidate <slug>   Validate and hash the closed project candidate
   devrites-engine check readiness <slug>   Check required files, tasks.md graph, and Build-input binding
   devrites-engine check readiness --emit-binding <slug>  Emit the stable Build-input binding for Vet
@@ -76,10 +77,10 @@ Usage:
                                          Resolve test/lint/vet/build commands from the repository's own wiring
   devrites-engine parallel <subcommand>   Deterministic parallel worktree lease/create/integrate/prune/cleanup
   devrites-engine gates <subcommand> <slug>  Machine-checked gates.md ledger: scaffold/status/run/reverify/lint/precheck/attest/abandon
-  devrites-engine state resolve <qid> "<ans>"  Resolve an open question and update state atomically
+  devrites-engine state resolve <qid> "<ans>"  Resolve an open question with locked, rollback-protected state updates
   devrites-engine state merge-manifest <slug> [pred...]  Fold the recorded predecessor chain's manifests into the release candidate manifest
   devrites-engine state apply-bundle <slug> <bundle.json>... [--dry-run]
-                                         Validate and apply plan-drafter hunk bundles atomically
+                                         Validate and apply plan-drafter hunk bundles with locked, rollback-protected updates
   devrites-engine state set <slug> <key>=<value>... [--unset <key>]
                                          Write state.md cursor fields atomically (known phase, no return-cursor overwrite)
   devrites-engine state append <slug> <ledger.md> --heading "<text>" --body-file <path|->
@@ -126,6 +127,7 @@ func init() {
 	// parallel cannot import lib (lib imports it), so `parallel select --from-plan` gets the plan-derived ready set through this hook.
 	parallel.PlanReady = lib.PlanReady
 	parallel.WorkspaceReady = lib.WorkspaceReady
+	parallel.FrontierNotices = lib.FrontierNotices
 	// `gates precheck` runs `check windows` through this hook for the same reason.
 	acceptance.WindowsCheck = lib.RunCheckWindows
 	// ...and `gates precheck --slice` learns which writer gates to skip.
@@ -169,6 +171,8 @@ func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		return cmdOrient(root, args[1:], stdout, stderr)
 	case "next":
 		return lib.RunNext(root, args[1:], stdout, stderr)
+	case "frontier":
+		return lib.RunFrontier(root, args[1:], stdout, stderr)
 	case "handoff":
 		return lib.RunHandoff(root, args[1:], stdout, stderr)
 	case "recall":