devrites 7.3.3 → 7.3.4

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.3.4](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.3...v7.3.4) (2026-11-03)
+
+### Fixed
+
+* **devrites:** restore global frontier and authenticated updates ([#207](https://github.com/ViktorsBaikers/DevRites/issues/207)) ([05cb719](https://github.com/ViktorsBaikers/DevRites/commit/05cb7198330b7ffa4d7176fc8398ff5a86b13f45))
+
 ## [7.3.3](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.2...v7.3.3) (2026-11-02)
 
 ### Fixed
@@ -34,9 +40,26 @@ All notable changes to DevRites are documented here. The format follows [Keep a
   parallel controller, with rolling landings and refills across workspace sources.
 - Prune clean integrated worker checkouts without discarding transfer branches,
   proof identities, retained lease rows, or running siblings.
-
-### Fixed
-
+- Add read-only `frontier [slug]` reporting across recorded live and archived
+  sequence workspaces, with scoped preparation/repair/wait actions, explicit
+  mixed-workspace selection, and ambiguous-source refusal. Source-local selection
+  exposes the frontier without silently admitting other workspaces.
+
+### Fixed
+
+- Use `GH_TOKEN`, then `GITHUB_TOKEN`, then optional bounded noninteractive GitHub
+  CLI credential lookup for release API requests. Keep credentials off release
+  assets and off-origin redirects, fail explicit invalid credentials, and document
+  headless login and rate-limit recovery without exposing tokens.
+- Continue AFK from the narrow Vet-ready state and from actionable global native
+  preparation, preserving human gates, source cursors, and separate Ship approval.
+- Allow independent refill and capacity reconciliation after a parallel integration
+  failure without clearing its failure status or weakening pending-landing,
+  control-tip, overlap, capacity, or proof guards.
+- Enforce wright fanout and wider-batch guards even when a reslice review admits
+  another round window.
+- Recover a completed dispatch wave's retained claim through an exact recorded
+  return handle after claim-release failure, without replaying result admission.
 - Confine question resolution to checked workspaces and restore question/cursor
   files together when publication fails. Bundle rollback now includes the failing
   target and reports incomplete restoration.

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.3.3`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.3): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.3.4`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.4): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -273,6 +273,15 @@ no-recommendation questions still pause. When bounded recovery runs out,
 agents record a technical blocker instead of asking you. The full contract is
 in [`afk-hitl.md`](pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md).
 
+`devrites-engine frontier [slug]` reports the recorded sequence across live and
+archived workspaces without changing `ACTIVE`, creating workspaces, or launching
+agents. It distinguishes preparation, repair, waiting, and completed work, and
+prints an explicit mixed-workspace selection command when available. A source-local
+`parallel select --from-plan` exposes that frontier but still selects only its own
+workspace unless `--workspaces` is supplied. Native Autocomplete owns preparation
+and semantic admission; the report is neither Build readiness nor Ship approval.
+See the [frontier contract](docs/cli.md#sequence-frontier).
+
 ## Install, update, and remove
 
 ```bash
@@ -419,6 +428,17 @@ release assets. If an older engine reports `missing codex/hooks.json` or asks
 for `--source-dir`, use the npm or verified shell route once to reach a
 release with the self-contained updater.
 
+GitHub release API authentication uses `GH_TOKEN`, then `GITHUB_TOKEN`, then an
+optional, bounded, noninteractive `gh auth token --hostname github.com` lookup.
+GitHub CLI is not required. Credentials go only to the exact GitHub API origin,
+never release assets or off-origin redirects. Explicit invalid credentials fail
+instead of silently falling back to another identity. For a headless machine,
+run `gh auth login --hostname github.com --web` and complete its device-code flow
+in a browser on another device. Do not paste credentials into commands, logs, or
+support reports. `--force` controls managed-file replacement; it does not bypass
+GitHub authentication or rate limits. If authentication does not clear a rate
+limit, wait before retrying.
+
 `/rite-upgrade` is the separate, preservation-first route for reconciling an
 unfinished workspace; it never migrates cursor format or invents historical
 proof. `devrites-engine migrate` owns deterministic v5 schema normalization.

package/docs/cli.md

@@ -43,6 +43,7 @@ devrites-engine observe summary <slug>
 devrites-engine orient <slug>
 devrites-engine observe slice <slug> <SLICE-ID>
 devrites-engine next [slug]
+devrites-engine frontier [slug]
 devrites-engine handoff [slug] [--resume]
 devrites-engine recall --paths <p1,p2,...> [--limit n]
 devrites-engine context [slug] (--phase <p>|--skill <name>) [--role <r>] [--whole]
@@ -90,6 +91,21 @@ downloading assets. `--source-dir` and `--payload-dir` remain the advanced local
 update path for npm, shell, source-checkout, and test callers; a local `--check`
 needs only `--source-dir`.
 
+Release metadata requests to the exact HTTPS `api.github.com` origin use the
+first available credential: `GH_TOKEN`, then `GITHUB_TOKEN`, then optional
+`gh auth token --hostname github.com`. The helper is noninteractive, bounded to
+three seconds and 4 KiB of output; missing, failed, timed-out, or oversized helper
+output does not prevent an unauthenticated request. GitHub CLI is not required.
+An explicitly supplied invalid credential fails; the updater does not silently
+retry under another identity. Credentials are never sent to release assets or
+off-origin redirects. Same-origin GitHub API redirects may retain them.
+
+On a headless machine, run `gh auth login --hostname github.com --web`, then use
+the displayed device code in a browser on another device. Do not put credential
+values in commands, examples, logs, or support reports. `--force` permits
+managed-file replacement, not authentication or rate-limit bypass. Authenticated
+requests can still be rate-limited; wait before retrying when necessary.
+
 ## npm adapter
 
 The `npx devrites` adapter accepts `add` as an alias for `install`, `upgrade` for
@@ -153,12 +169,17 @@ self-contained updater.
   slice checkpoint or phase advance, and treat `BLOCKED` at Seal as NO-GO.
   Never use automatic updates to hide an unreconciled regression.
 - `check continuation [slug]` prints `continuation: required` and
-  `invoke: <next_action>` when `.devrites/AFK` is present, `status` is
-  `running`, no question cursor is set, no blocking or escalating question is
-  open, and `next_action` is an internal phase command (`/rite-vet`,
-  `/rite-build`, not `/rite-ship`). Otherwise it prints `continuation: clear`.
-  Exit `0` either way: `required` means invoke that command, not pause for a
-  human. `handoff` prints the same lines.
+  `invoke: <next_action>` when `.devrites/AFK` is a regular file, `status` is
+  `running` (or specifically `phase=vet,status=ready`), no question cursor is
+  set, no blocking or escalating question is open, and `next_action` is a valid
+  internal phase command, not `/rite-ship`. Other ready statuses do not inherit
+  this exception. It also reports the sequence frontier: when the local cursor
+  is clear but related work needs native preparation, it can print
+  `continuation: required` with `invoke: /rite-autocomplete` and the original
+  source identity. Waiting, human-blocked, or completed work alone does not
+  require continuation. Neither result authorizes Ship, overrides a human gate,
+  or declares an unvetted workspace Build-ready. Successful verdicts exit `0`;
+  malformed or ambiguous state fails visibly. `handoff` prints the same lines.
 - `check drift <slug>` attributes readiness-input drift to the exact artifact.
   `--record` snapshots per-input SHA-256 digests into `readiness-inputs.json`
   under the feature lock after Vet records the aggregate binding; a later
@@ -231,6 +252,62 @@ checked by the root's explicit native re-read checklist. Repository build,
 test, lint, typecheck, schema, and release commands belong to that repository
 or CI.
 
+## Sequence frontier
+
+`devrites-engine frontier [slug]` is a read-only structural report across the
+source's recorded sequence. An explicit slug may name a live or archived
+workspace. Without one, the command uses the selected source; if `ACTIVE` is
+absent, recovery requires a unique archived terminal sequence tip with an exact
+recorded native `/rite-spec <next>` edge. Multiple possible sources fail as ambiguous;
+folder names and numeric suffixes are not authority.
+
+The report emits:
+
+- `frontier: actionable|waiting|blocked|clear`, or `frontier: none` for a
+  non-sequence source.
+- `frontier-source: <slug>` and `frontier-workspace:` rows naming each related
+  workspace's `location=live|archive|missing`, `action=inspect|prepare|repair|wait|complete`,
+  and reason. Archived intermediaries do not hide live descendants, and archived
+  workspaces never become writer candidates.
+  Running or execution-unknown dispatch roles wait; completed writer returns
+  without durable acceptance require native inspection, not another writer launch.
+- `frontier-select-command:` with an explicit `parallel select --from-plan
+  --workspaces ...` command when a live controller is available. Selection still
+  enforces current readiness, recorded dependencies and independence, retained
+  leases, path conflicts, and the repository-wide capacity. `frontier-picks:`
+  names eligible source-qualified slices; `frontier-selection: blocked` names a
+  selection refusal. These are observations, not writer launches.
+  The explicit pool excludes retained dispatch and human/question/scope-held
+  sources; their workspace rows remain visible. `--workspaces` is the exact
+  candidate list; `--slug` identifies the controller, not an implicit candidate.
+  Legacy per-source slice counters never reduce the global writer cap or exclude
+  independent children; recorded workspace-opening limits still apply.
+- `frontier-prepare:` for a recorded next Spec cursor or an unambiguous next entry
+  in an exact position/workspace table, or `frontier-review-sequence:` artifact
+  paths when remaining work or conflicting sequence maps require native review.
+
+Relations come from exact recorded `sequence_parent` edges, not name prefixes.
+Conflicting identities, cycles, malformed related state, or invalid declared
+sequence positions are refused. Missing or stale planning is a repair action,
+not permission to build. Continuation flags and remaining counts constrain new
+workspace preparation without silently discarding existing children.
+Conflicting or amended sequence maps suppress missing-workspace preparation even
+with a recorded Spec cursor until native authority normalization resolves them;
+valid existing live descendants remain visible and eligible for guarded selection.
+
+Under AFK, `next`, `handoff`, and `check continuation` expose the same frontier.
+A source-local `parallel select --from-plan` without `--workspaces` also prints
+the report to stderr, preserving its machine-readable selection on stdout and
+source-local picks: reporting another workspace never silently admits it.
+Native Autocomplete must inspect the returned preparation and review
+actions, read the approved roadmap and recorded restrictions, then invoke the
+owning Spec/Plan/Vet steps or explicit mixed selection. Path disjointness alone
+does not establish semantic independence or lift a planning-only restriction.
+
+The engine does not invoke models, create workspaces, change `ACTIVE`, resolve
+semantic authority, or grant Ship approval. These outputs guide the native host;
+they cannot guarantee that an arbitrary host follows the workflow.
+
 ## Acceptance ledger
 
 `gates` operates the `gates.md` ledger inside a feature workspace: one gate per

package/docs/command-map.md

@@ -41,8 +41,8 @@ The Go surface is intentionally closed and deterministic:
 
 | Lane | Commands | Owner |
 |---|---|---|
-| Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check preconditions <slug> [--slice <SLICE-ID>]`, `check seal`, `check slice <slug> <SLICE-ID>`, `check task-graph`, `check regression <slug> [--update]`, `check continuation [slug]`, `check drift <slug> [--record]`, `check windows <slug>`, `check dup`, `check path-disjoint`, `parallel select`, `check skill-trust`, `check indexes`, `detect commands [--root <dir>] [--json]` | Candidate validates/hashes the strict project manifest; readiness checks phase files, the required `tasks.md` slice graph, or emits the vetted Build-input binding; `check preconditions` runs the `test-plan.md` preflight rows whose `Run at` is `vet` (or `pre-dispatch <SLICE>`) with candidate-bound transcripts; seal checks final files/open gates, that graph and binding, then exact candidate bindings. `check slice` preflights one slice before wright dispatch — contract present, exact Writer allowlist paths, `Satisfies` AC ids resolvable, bounded scope — so a malformed slice fails before a writer context is spent. `check indexes` reports install manifest and optional code-index directory presence as JSON. `parallel select` returns the greedy path-disjoint subset ≤ cap from the supplied ready slices, or with `--from-plan` from tasks.md slices whose dependencies state.md checks built. `check regression` compares current workspace progress against the durable `regression-baseline.json` high-water mark and `--update` ratchets it at a checkpoint, so a lost slice, unchecked criterion, or reopened question fails closed instead of passing silently. `check continuation` prints `required` and the phase command to invoke when AFK, `status=running`, and `next_action` is an internal phase edge; `clear` otherwise. Exit 0 either way. `handoff` prints the same lines. `check windows` scans the feature diff for newly introduced deferral markers (TODO/FIXME/skipped test/stub idioms) and fails when any lacks a `windows.md` waiver row — silent deferrals block the seal. `check dup` reports advisory near-duplicate clusters that survive renaming (normalized token shingles, transitive clusters, distance-boosted rank, `*`-marked diff overlap, stable content hashes, `.devrites/dup-ignore` dismissal ledger) — leads for reviewer triage, never a gate. `check drift` attributes readiness-input drift to the exact artifact: `--record` snapshots per-input SHA-256 digests into `readiness-inputs.json` under the feature lock, and a later compare names each `changed`/`missing`/`added` input (falling back to the aggregate `eng-review.md` binding plus mtime candidates when no baseline exists) so a stale-binding repair starts at the right file — advisory, never a gate. `detect commands` resolves the repository's own test/lint/vet/build commands (Makefile targets, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager) so `gates.md` `CHECK` lines and proof steps cite real wiring instead of invented commands — read-only, no installs, no execution. |
-| Workspace observation | `observe summary`, `orient`, `observe slice <slug> <SLICE-ID>`, `next`, `handoff` | JSON workspace snapshot for agents (cursor, task graph, `artifact_budgets`, `bulk_files`); `orient` is an alias for `observe summary`. `observe slice` prints one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. `next` prints the minimal remaining lifecycle path plus advisory skips (e.g. clarify at zero open questions). `handoff` emits the deterministic resume record (cursor, `awaiting_human`, blocking question gates, ledger reduction with unmet/stale ids, dead ends, read-next order, continuation verdict) — the `/rite-handoff` spine and compaction-fallback entry. |
+| Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check preconditions <slug> [--slice <SLICE-ID>]`, `check seal`, `check slice <slug> <SLICE-ID>`, `check task-graph`, `check regression <slug> [--update]`, `check continuation [slug]`, `check drift <slug> [--record]`, `check windows <slug>`, `check dup`, `check path-disjoint`, `parallel select`, `check skill-trust`, `check indexes`, `detect commands [--root <dir>] [--json]` | Candidate validates/hashes the strict project manifest; readiness checks phase files, the required `tasks.md` slice graph, or emits the vetted Build-input binding; `check preconditions` runs the `test-plan.md` preflight rows whose `Run at` is `vet` (or `pre-dispatch <SLICE>`) with candidate-bound transcripts; seal checks final files/open gates, that graph and binding, then exact candidate bindings. `check slice` preflights one slice before wright dispatch — contract present, exact Writer allowlist paths, `Satisfies` AC ids resolvable, bounded scope — so a malformed slice fails before a writer context is spent. `check indexes` reports install manifest and optional code-index directory presence as JSON. `parallel select` returns the greedy path-disjoint subset ≤ cap from the supplied ready slices, or with `--from-plan` from tasks.md slices whose dependencies state.md checks built; source-local selection reports the sequence frontier without silently admitting other workspaces. `check regression` compares current workspace progress against the durable `regression-baseline.json` high-water mark and `--update` ratchets it at a checkpoint, so a lost slice, unchecked criterion, or reopened question fails closed instead of passing silently. `check continuation` prints `required` and the phase command when AFK, `status=running` (or specifically `phase=vet,status=ready`), and an internal phase edge passes human/question guards; actionable global preparation may instead require `/rite-autocomplete`, never Ship authorization. Successful `required`/`clear` verdicts exit 0; malformed or ambiguous state fails visibly. `handoff` prints the same lines. `check windows` scans the feature diff for newly introduced deferral markers (TODO/FIXME/skipped test/stub idioms) and fails when any lacks a `windows.md` waiver row — silent deferrals block the seal. `check dup` reports advisory near-duplicate clusters that survive renaming (normalized token shingles, transitive clusters, distance-boosted rank, `*`-marked diff overlap, stable content hashes, `.devrites/dup-ignore` dismissal ledger) — leads for reviewer triage, never a gate. `check drift` attributes readiness-input drift to the exact artifact: `--record` snapshots per-input SHA-256 digests into `readiness-inputs.json` under the feature lock, and a later compare names each `changed`/`missing`/`added` input (falling back to the aggregate `eng-review.md` binding plus mtime candidates when no baseline exists) so a stale-binding repair starts at the right file — advisory, never a gate. `detect commands` resolves the repository's own test/lint/vet/build commands (Makefile targets, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager) so `gates.md` `CHECK` lines and proof steps cite real wiring instead of invented commands — read-only, no installs, no execution. |
+| Workspace observation | `observe summary`, `orient`, `observe slice <slug> <SLICE-ID>`, `next`, `frontier [slug]`, `handoff` | JSON workspace snapshot for agents (cursor, task graph, `artifact_budgets`, `bulk_files`); `orient` is an alias for `observe summary`. `observe slice` prints one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. `next` prints the minimal remaining lifecycle path plus advisory skips (e.g. clarify at zero open questions). `frontier` reports recorded live/archive sequence relations, scoped actions, explicit mixed selection, and native preparation/review needs without changing ACTIVE or admitting writers; ambiguous source recovery refuses. Under AFK, `next` and `handoff` expose the same frontier while retaining the source cursor. `handoff` emits the deterministic resume record (cursor, `awaiting_human`, blocking question gates, ledger reduction with unmet/stale ids, dead ends, read-next order, continuation verdict) — the `/rite-handoff` spine and compaction-fallback entry. |
 | Context packets, dispatch waves, metrics, claims, notes | `context [slug] (--phase <p> \| --skill <name>) [--role <r>] [--trigger a,b]`, `dispatch <slug> <open\|start\|seal\|return\|status\|abandon>`, `candidate freeze`, `packet`, `metrics record`, `metrics summary`, `claim <add\|release\|list\|check>`, `note <add\|list\|check\|rm>` | `context` emits one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest — a dispatch target reads it instead of selecting files; `--skill` works without a workspace when `--out` is given. `dispatch` owns the launch-wave barrier (seal needs a handle per role; return needs seal; the last start seals; open --claim-session/--claim takes the wave's file claim, released by the completing return or abandon --release) and auto-records dispatch/return metrics. `candidate freeze` writes a wave's frozen `packets/<w>.diff` + `.sha256`; `packet` renders and lints one role's by-reference packet. `metrics` owns the append-only `metrics.jsonl` ledger. `claim` owns the append-only `.devrites/claims.jsonl` ledger — advisory, session-scoped file claims with TTL so concurrent same-tree sessions see each other's write intent before edits collide (conflict exits 3; never a substitute for one-writer-per-worktree). `note` owns the anchored `notes.md` ledger — notes bound to verbatim code quotes, regraded `exact`/`moved`/`stale`/`ambiguous`/`lost` as the code drifts; `check seal` refuses non-`exact` anchors. `check diff-scope` is the mechanical changed-paths ⊆ allowlist gate run before reviewer dispatch. |
 | Atomic workspace state | `state resolve`, `state merge-manifest`, `state apply-bundle <slug> <bundle.json>... [--dry-run]`, `state set <slug> key=value... [--unset key]`, `state append <slug> <ledger.md> --heading <text> --body-file <path\|->`, `state close`, `migrate [--dry-run] [--answer id=choice]` | Go owns answer/drop/batch resolution, the recorded predecessor-chain manifest union for a release milestone, the all-or-nothing apply of plan-drafter hunk bundles (base-hash pins, unique non-overlapping anchors, no lost IDs, no new task-graph or budget defect, no appended dated delta section), cursor writes (known phase, engine-owned schema, no return-cursor overwrite; an AFK pause names auto-pickable questions), append-only ledger sections that refuse a duplicate heading, transactional close, and fail-closed v5 schema normalization. |
 | Acceptance ledger | `gates scaffold`, `gates status`, `gates run [--timeout N]`, `gates reverify [--timeout N]`, `gates lint [--strict]`, `gates precheck <slug> --worktree <path> [--slice <SLICE-ID>]`, `gates attest <id> <note>`, `gates abandon <id> <why>` | Go owns the `gates.md` ledger: per-outcome gates whose runnable `CHECK`/`CWD` must exactly match a `test-plan.md` Build-entry preflight row, evidence bound to the gate definition digest (stale = unmet), `ABANDON:` handoffs, oracle lint, and the wright's never-evidence `precheck` of `RUN: writer` gates. Readiness/seal require a parse-clean, all-met ledger whenever `gates.md` is a required artifact. |

package/docs/engine/commands.md

@@ -9,7 +9,7 @@ workflow strategy.
 | Command | Deterministic responsibility |
 | --- | --- |
 | `install [flags]` | Install manifest-owned host artifacts and the optional shared binary. |
-| `update [flags]` | Refresh an existing managed installation. |
+| `update [flags]` | Refresh an existing managed installation. Release API authentication uses `GH_TOKEN`, then `GITHUB_TOKEN`, then optional bounded noninteractive `gh auth token --hostname github.com`; explicit invalid credentials fail. Never sends credentials to assets or off-origin redirects. `--force` does not bypass rate limits. See [release authentication](../cli.md#updates). |
 | `uninstall [flags]` | Remove managed artifacts while preserving runtime workspace state. |
 | `check candidate <slug>` | Validate the strict manifest and compute the content-bound project-candidate identity. Exits `3` when the manifest omits a path the feature's `WIP(<slug>):` checkpoint commits changed (net from the feature base to HEAD). Also exits `3` with `unattributed root edit: <paths>` while the feature's `tree-baseline.json` tripwire flags a product path (ADR-0038; see `dispatch`). |
 | `check readiness <slug>` | Check target-Phase files, open human gates from Clarify onward, the `tasks.md` slice graph when that artifact is required, canonical `AC-###` presence in `tasks.md`/`test-plan.md` when those artifacts are required, and the current stable Build-input binding when applicable. Leaving Vet with a `Run at` column, a slice whose `Files likely touched`/`Writer allowlist` names a dependency manifest or lockfile needs a `dependency-dry-run SLICE-###` row at `vet` with a passing transcript. Leaving Vet, every slice `state.md` does not check built (a deferred `Satisfies: none` slice excepted) must also pass the Build-entry `check slice` contract; each failure prints one `invariant: slice-check:` line naming the slice and its exact `check slice` reason, to fix in `/rite-plan` before READY. |
@@ -17,11 +17,11 @@ workflow strategy.
 | `check preconditions <slug> [--slice SLICE-###] [--timeout N]` | Run the `test-plan.md` Build-entry preflight rows whose optional `Run at` cell is `vet` (with `--slice`, `pre-dispatch <SLICE>`); `action` rows and rows without the cell never run. Writes one candidate-bound transcript per row under `references/gates/preflight-*/`; a row passes on exit 0. A `pre-dispatch` row whose newest transcript passed is kept, not re-run: it is a pre-edit baseline, so a re-dispatch never runs it against the slice's own edits; changing its command or cwd retires the pass. Exit `3` on any failure or an invalid `Run at` value. |
 | `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. `check readiness` and `check seal` also block a `scripts/` test driver that a tasks.md Writer allowlist plans or touched-files.md lists when no gates.md `CHECK` runs it and no `Driver waiver: <path> — DEC-### <reason>` line cites a recorded decision; waived drivers print as `note: unexecuted driver (waived by DEC-###): <path>` lines, on pass or block. |
 | `check path-disjoint [--root <dir>] [<json-file> | -]` | Verify slice path sets are pairwise disjoint. |
-| `parallel select --cap <1-10> [--root <dir>] [--slug <controller>] [--from-plan [--workspaces <slug,...>] \| <json-file> \| -]` | Choose a plan-order path-disjoint ready subset, seeded by all retained repository-controller slots and paths. `--from-plan` uses canonical built checkpoints, local and declared workspace producer dependencies, exact write sets and required dependency manifests. The internal `--workspaces` data-source parameter pools recorded forward continuations with current readiness and explicit native-vetted per-slice declarations; blocked/stale/missing candidates print scoped notices without hiding other ready work. Foreign identities print `<workspace>/<slice>`. |
+| `parallel select --cap <1-10> [--root <dir>] [--slug <controller>] [--from-plan [--workspaces <slug,...>] \| <json-file> \| -]` | Choose a plan-order path-disjoint ready subset, seeded by all retained repository-controller slots and paths. `--from-plan` uses canonical built checkpoints, local and declared workspace producer dependencies, exact write sets and required dependency manifests. Without `--workspaces`, it also reports the full recorded sequence frontier but keeps source-local picks; other workspaces are never silently admitted. The explicit `--workspaces` data-source parameter pools recorded forward continuations with current readiness and explicit native-vetted per-slice declarations; blocked/stale/missing candidates print scoped notices without hiding other ready work. Foreign identities print `<workspace>/<slice>`. |
 | `parallel <create\|add\|integrate\|prune\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | One repository controller owns isolated workers across source workspaces. `create` accepts a single initial worker; `create`/`add --cap N` persist the global admission capacity. Explicit `add --cap N --json -` with stdin `[]` updates capacity only; lowering below active count refuses without canceling workers. A completed retained lease can refill at unchanged control tip. `record-green` and per-slice `integrate --slice <workspace/id> --apply-to-control` target source-qualified lanes (bare IDs mean controller lanes); integration keeps exact ancestry/path/dirty-work checks and lands `WIP(<source>):`. `prune` removes only verified clean integrated checkouts, retaining branches, proof identities, lease rows and controller. Status exposes the retained controller and pending landing; cleanup preserves salvage/unknown work. |
 | `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. A `Dependencies` ID may carry a `(via <interface>)` suffix (empty or unclosed is a malformed token); prints a non-blocking `ADVISORY edge:` line (and records an `edge-advisory` metric) for each edge with no via, or whose via text is not a case-insensitive substring of the dependency's `Consumes / Produces:`. Prints `schedule: <n> slices in <r> build rounds at cap 10` (the `/rite-build` batch selection replayed over each slice's Writer allowlist, else Files likely touched, plus the manifest parallel select reserves; omitted when a slice has no path) and a non-blocking `ADVISORY hub:` line (top five; records a `hub-advisory` metric) for each path, compared case-folded, that three or more slices without `Serial rationale:` write. Advisories print only when the graph is valid. |
 | `check regression <slug> [--update [--allow-empty]]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark. Ordinary checks block lost facts without changing the baseline. `--update` records the current facts under the feature lock and prints each blessed regression; a deliberate owner-authorized repair checkpoint can accept a backward phase as the new baseline. Removing every checked AC and met gate also requires `--allow-empty`. Never automatically bless an unreconciled regression. |
-| `check continuation [slug]` | Print whether an armed AFK run must invoke its cursor instead of replying. `continuation: required` plus `invoke: <next_action>` when `.devrites/AFK` is a regular file, `status` is `running`, `question_id` is empty, no blocking or escalating question is open, and `next_action` is an internal phase command (`/rite-spec` through `/rite-seal`, including `/rite-plan`, not `/rite-ship` or `/rite-autocomplete`). Otherwise `continuation: clear` with a one-line `reason`. Exit `0` either way. `handoff` prints the same lines. |
+| `check continuation [slug]` | Print whether an armed AFK run must invoke its cursor instead of replying. `continuation: required` plus `invoke: <next_action>` requires a regular `.devrites/AFK`, `status=running` or specifically `phase=vet,status=ready`, empty `question_id`, no blocking/escalating question, and a valid internal phase command (`/rite-spec` through `/rite-seal`, including `/rite-plan`, not `/rite-ship` or `/rite-autocomplete`). Also emits the sequence frontier; a clear local cursor with actionable global preparation can require `invoke: /rite-autocomplete` while preserving the source identity. Waiting, human-blocked, or completed work alone does not require continuation. Neither route authorizes Ship or bypasses human/readiness gates. Successful `required`/`clear` verdicts exit `0`; malformed or ambiguous state fails visibly. `handoff` prints the same lines. |
 | `check drift <slug> [--record]` | Attribute readiness-input changes to the exact artifact. `--record` writes the per-input `readiness-inputs.json` digest baseline under the feature lock; without it the workspace diffs current inputs against that baseline (or falls back to the aggregate binding recorded in `eng-review.md`). Advisory: exit `0` on drift; a corrupt baseline exits `3`. A `test-plan.md` change limited to exact `Workflow Artifact reviewed identity: <64hex>` lines is reported as `reviewed-identity-only` (ADR-0034). `--record` also stores each slice's proof bytes (its `tasks.md` block plus the `test-plan.md` lines naming it); both modes print `ADVISORY proportion:` for a slice whose proof grew over 2x since that baseline or carries over 3x the median proof per AC. |
 | `check windows <slug> [--worktree\|--staged\|--base <ref>\|--since-dispatch <wave>]` | Fail on deferral and bar-lowering markers the change introduces without a waiver row in the workspace's `windows.md`: added TODO/FIXME/XXX/HACK, skipped/focused-test and stub idioms, checker suppressions, one-line empty catch; removed `deleted-test` files and net `removed-assertion` lines in remaining test files. `--since-dispatch <wave>` reports only `deleted-test`/`removed-assertion` against the work-tree snapshot (`tree` in `dispatch.json`) recorded when that build wright wave opened, untracked files included; it takes no `--cwd` and records the `windows-since` metric. |
 | `check dup [slug] [--all\|--worktree\|--staged\|--base <ref>] [--min-lines n] [--threshold f] [--ignore-file <path>] [--limit n] [--exclude <csv>]` | Report near-duplicate code clusters that survive comment stripping, literal collapsing, and identifier renaming — token-shingle matches chained into segments, clustered transitively, ranked with bounded path/line-distance boosts. Diff modes mark units overlapping changed hunks with `*`; stable content-derived cluster hashes let `.devrites/dup-ignore` dismissals survive line moves but resurface on structural edits. Staged mode reads index blobs and excludes untracked files. Bounded heuristic: successful scans/leads exit `0`; usage, unavailable input, and partial scans exit `2`. |
@@ -35,6 +35,7 @@ workflow strategy.
 | `orient <slug>` | Alias for `observe summary`. |
 | `observe slice <slug> <SLICE-ID>` | Print one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. |
 | `next [slug]` | Print the minimal remaining lifecycle path plus advisory skips; in Build also `eligible_now:`, `batch:` and the `select-command:` (`parallel select --root <project> --slug <slug> --cap N --from-plan`, N = AFK max_parallel else 10) that reproduces the batch. Prints `blocked: unattributed root edit: ...` after `open-questions:` and exits `3` while the ADR-0038 tripwire flags a product path; the rest of the output still prints. |
+| `frontier [slug]` | Read-only report across exact recorded sequence relations, including archived intermediaries and live descendants. Emits `frontier: actionable\|waiting\|blocked\|clear` (`none` for a non-sequence source), `frontier-source:`, and `frontier-workspace:` rows with location, `inspect\|prepare\|repair\|wait\|complete` action, and reason. Emits `frontier-select-command:`, `frontier-picks:`, `frontier-selection: blocked`, `frontier-prepare:`, or `frontier-review-sequence:` where applicable. Explicit slug may be archived; absent ACTIVE recovery requires a unique archived terminal tip with a recorded native Spec edge, otherwise refuses ambiguity. Never changes ACTIVE, restores archives, creates workspaces, or launches writers. Native preparation and semantic admission remain required; see [sequence frontier](../cli.md#sequence-frontier). |
 | `handoff [slug] [--resume]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, in-flight dispatch waves (`inflight_wave:` lines: phase, state, pending roles, slices), missing required files, the canonical read-next order, and the same `continuation:` lines as `check continuation`. Read-only unless `--resume`, which appends one `resume` event (role root) to `metrics.jsonl`; `metrics summary` then reports minutes from each resume to the next dispatch. The `/rite-handoff` spine and the compaction-fallback entry point. |
 | `recall --paths <p1,p2,...> [--limit n]` | Read-time query over `.devrites/archive/`: list archived features whose `touched-files.md` candidate manifest covers a queried project-relative path (exact or directory prefix, case-folded), ranked by overlap count, then newest archive-directory mtime, then slug (default 10 features). Each feature prints up to 8 `archive/<slug>/<file>:<line>` pointers, then `+N more`: `decisions.md` `DEC-###` entries and `## Carry-forward constraints` bullets whose `Files:` overlap (or a constraint naming no files), plus `review.md`/`seal.md`/`drift.md` lines that mention a queried path; fenced examples are ignored. Never writes, caches, or indexes (no metric either); symlinked archive entries are refused. An unreadable archive file prints `unreadable:` and the scan continues. Exit `0` (including `recall: no archive`), `1` invalid archive directory, `2` usage. |
 | `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`), unless `.devrites/AFK` `max_parallel` is 2 or more or a parallel lease is `running` (the bundle stays whole); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
@@ -58,6 +59,10 @@ workflow strategy.
 | `overhaul <records\|admit\|snapshot\|score\|bench\|render> ...` | Deterministic tools behind the standalone `/overhaul` skill: run-record generations and cross-record validation, worker-receipt admission and quote anchoring, index-safe baseline snapshots and per-attempt deltas, exact-rational readiness scoring, benchmark ratio intervals, and escaped offline review/report views. Operates only on explicit run-area and repository paths. See [Overhaul tools](#overhaul-tools). |
 | `version` | Print the engine version. |
 
+Under AFK, `next`, `handoff`, and `check continuation` include the sequence
+frontier without replacing the source-local cursor. Reporting actionable work
+does not authorize Build or Ship, and cannot guarantee native-host compliance.
+
 For `context --role`, optional `devrites-` prefixes and `.lane` suffixes resolve
 the base specialist's contract, workspace read-set, and role-specific rules.
 The full label remains in bundle filenames and attribution. Reviewer

package/engine/commands.go

@@ -48,7 +48,7 @@ func rootModeFor(command string, args []string) rootMode {
 			return rootLenient
 		}
 		return rootUnused
-	case "orient", "next", "context", "metrics", "dispatch", "handoff", "note", "packet":
+	case "orient", "next", "frontier", "context", "metrics", "dispatch", "handoff", "note", "packet":
 		return rootStrictUsage
 	case "candidate":
 		if subcommand == "freeze" {

package/engine/help.go

@@ -189,7 +189,7 @@ func shouldPrintHelp(args []string) bool {
 		return true
 	}
 	switch args[0] {
-	case "check", "state", "observe", "parallel", "gates", "claim", "detect", "note", "metrics", "handoff", "context", "orient", "migrate", "overhaul", "next", "dispatch", "secret-scan", "open-visual", "recall", "packet", "candidate":
+	case "check", "state", "observe", "parallel", "gates", "claim", "detect", "note", "metrics", "handoff", "context", "orient", "migrate", "overhaul", "next", "frontier", "dispatch", "secret-scan", "open-visual", "recall", "packet", "candidate":
 		return len(args) >= 2 && args[1] == "help"
 	default:
 		return false
@@ -231,6 +231,8 @@ func commandHelp(args []string) (string, bool) {
 		return orientUsage, true
 	case "next":
 		return nextUsage, true
+	case "frontier":
+		return "usage: devrites-engine frontier [slug]", true
 	case "handoff":
 		return handoffUsage, true
 	case "recall":

package/engine/internal/lib/continuation.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/devrites/devrites/internal/devritespaths"
 	"github.com/devrites/devrites/internal/gate"
+	"github.com/devrites/devrites/internal/markdowntext"
 	"github.com/devrites/devrites/internal/state"
 	"github.com/devrites/devrites/internal/workflow"
 )
@@ -44,7 +45,21 @@ func RunCheckContinuation(root string, args []string, stdout, stderr io.Writer)
 		fmt.Fprintf(stderr, "check continuation: %v\n", err)
 		return 2
 	}
+	var frontier []string
+	if afkPresent(root) {
+		frontier, err = FrontierLines(root, slug)
+		if err != nil {
+			fmt.Fprintf(stderr, "check continuation: frontier: %v\n", err)
+			return 2
+		}
+		if !verdict.Required && len(frontier) > 0 && frontier[0] == "frontier: actionable" {
+			verdict = continuationVerdict{Required: true, Invoke: "/rite-autocomplete", Source: slug, Reason: "global frontier requires native preparation, authority review, or selection; no Ship approval"}
+		}
+	}
 	writeContinuation(stdout, verdict)
+	for _, line := range frontier {
+		fmt.Fprintln(stdout, line)
+	}
 	return 0
 }
 
@@ -59,12 +74,16 @@ func classifyContinuation(root, slug string) (continuationVerdict, error) {
 	}
 	invoke, internal, err := internalPhaseEdge(report.NextAction, slug)
 	if err != nil {
-		return continuationVerdict{}, err
+		if !frontierBoundSpec(root, slug, report.NextAction) {
+			return continuationVerdict{}, err
+		}
+		// A successor Spec belongs to the global controller, never this source's phase invocation.
+		invoke, internal = "", false
 	}
 	if !afkPresent(root) {
 		return continuationVerdict{Reason: "no AFK sentinel"}, nil
 	}
-	if report.Status != "running" {
+	if report.Status != "running" && !(report.Phase == state.PhaseVet && report.Status == "ready") {
 		if report.Status == "" {
 			return continuationVerdict{Reason: "status unset"}, nil
 		}
@@ -75,7 +94,17 @@ func classifyContinuation(root, slug string) (continuationVerdict, error) {
 	if err != nil {
 		return continuationVerdict{}, err
 	}
-	if qid, ok := state.CursorField(strings.Split(string(data), "\n"), state.CursorQuestionID); ok && strings.TrimSpace(qid) != "" {
+	structural, err := markdowntext.Structural(data)
+	if err != nil {
+		return continuationVerdict{Reason: "malformed source cursor; native normalization required"}, nil
+	}
+	cursorLines := strings.Split(string(structural), "\n")
+	for _, key := range []string{state.CursorPhase, state.CursorStatus, state.CursorNextAction, state.CursorQuestionID} {
+		if _, _, err := frontierField(cursorLines, key); err != nil {
+			return continuationVerdict{Reason: err.Error() + "; native normalization required"}, nil
+		}
+	}
+	if qid, ok := state.CursorField(cursorLines, state.CursorQuestionID); ok && strings.TrimSpace(qid) != "" {
 		return continuationVerdict{Reason: "question cursor set"}, nil
 	}
 	// #nosec G304 -- questions.md inside the checked feature workspace
@@ -93,7 +122,7 @@ func classifyContinuation(root, slug string) (continuationVerdict, error) {
 	if !internal {
 		return continuationVerdict{Reason: "next_action is not an internal phase edge"}, nil
 	}
-	return continuationVerdict{Required: true, Invoke: invoke, Source: slug, Reason: "AFK status=running internal phase edge"}, nil
+	return continuationVerdict{Required: true, Invoke: invoke, Source: slug, Reason: "AFK status=" + report.Status + " internal phase edge"}, nil
 }
 
 func afkPresent(root string) bool {

package/engine/internal/lib/dispatch.go

@@ -52,6 +52,8 @@ An abandoned writer's unreleased claim blocks overlapping writers across every
 live or archived feature in this repository, even in the same session or after
 TTL expiry, until explicit release or proven host termination.
 return --handle, when supplied, must match the role's recorded host handle.
+Completed return replay requires the exact recorded role and --handle and only
+reconciles claim release; failed release exits nonzero without undoing the return.
 status --wave exits
 nonzero until that wave is complete; bare status lists every open, sealed,
 or abandoned wave, folds complete waves into one count line (--all lists
@@ -150,32 +152,36 @@ func loadDispatch(root, slug string) (*dispatchFile, string, error) {
 }
 
 func loadDispatchFile(path string) (*dispatchFile, string, error) {
-	f := &dispatchFile{Waves: map[string]*dispatchWave{}}
 	data, err := os.ReadFile(path) // #nosec G304 -- path is a validated feature workspace artifact
 	if os.IsNotExist(err) {
-		return f, path, nil
+		return &dispatchFile{Waves: map[string]*dispatchWave{}}, path, nil
 	}
 	if err != nil {
 		return nil, path, err
 	}
-	f = &dispatchFile{}
+	f, err := decodeDispatch(data)
+	return f, path, err
+}
+
+func decodeDispatch(data []byte) (*dispatchFile, error) {
+	f := &dispatchFile{}
 	if err := json.Unmarshal(data, f); err != nil {
-		return nil, path, fmt.Errorf("dispatch.json is not valid JSON: %w", err)
+		return nil, fmt.Errorf("dispatch.json is not valid JSON: %w", err)
 	}
 	if f.Waves == nil {
-		return nil, path, fmt.Errorf("dispatch.json is malformed (missing waves)")
+		return nil, fmt.Errorf("dispatch.json is malformed (missing waves)")
 	}
 	// Validate every account before any caller can use or mutate the ledger.
 	for name, w := range f.Waves {
 		if w == nil || strings.TrimSpace(name) == "" || strings.TrimSpace(w.Phase) == "" || len(w.Roles) == 0 ||
 			!slices.Contains([]string{"open", "sealed", "complete", "abandoned"}, w.State) {
-			return nil, path, fmt.Errorf("wave %q is malformed (invalid phase, state or roles)", name)
+			return nil, fmt.Errorf("wave %q is malformed (invalid phase, state or roles)", name)
 		}
 		handles := map[string]bool{}
 		allStarted, allReturned := true, true
 		for role, r := range w.Roles {
 			if r == nil || strings.TrimSpace(role) == "" {
-				return nil, path, fmt.Errorf("wave %q role %q is malformed (missing account)", name, role)
+				return nil, fmt.Errorf("wave %q role %q is malformed (missing account)", name, role)
 			}
 			started := r.Handle != ""
 			if started != (r.StartedAt != "") || r.Returned != (r.ReturnedAt != "") ||
@@ -183,19 +189,19 @@ func loadDispatchFile(path string) (*dispatchFile, string, error) {
 				(w.State == "open" && r.Returned) ||
 				((w.State == "sealed" || w.State == "complete") && !started) ||
 				(w.State == "complete" && !r.Returned) {
-				return nil, path, fmt.Errorf("wave %q role %q is malformed (inconsistent start or return)", name, role)
+				return nil, fmt.Errorf("wave %q role %q is malformed (inconsistent start or return)", name, role)
 			}
 			allStarted = allStarted && started
 			allReturned = allReturned && r.Returned
 			if started {
 				start, startErr := time.Parse(time.RFC3339Nano, r.StartedAt)
 				if startErr != nil {
-					return nil, path, fmt.Errorf("wave %q role %q is malformed (invalid start timestamp)", name, role)
+					return nil, fmt.Errorf("wave %q role %q is malformed (invalid start timestamp)", name, role)
 				}
 				if r.Returned {
 					end, endErr := time.Parse(time.RFC3339Nano, r.ReturnedAt)
 					if endErr != nil || end.Before(start) {
-						return nil, path, fmt.Errorf("wave %q role %q is malformed (invalid return timestamp)", name, role)
+						return nil, fmt.Errorf("wave %q role %q is malformed (invalid return timestamp)", name, role)
 					}
 				}
 			}
@@ -204,32 +210,32 @@ func loadDispatchFile(path string) (*dispatchFile, string, error) {
 			}
 		}
 		if (w.State == "open" && allStarted) || (w.State == "sealed" && allReturned) {
-			return nil, path, fmt.Errorf("wave %q is malformed (inconsistent barrier state)", name)
+			return nil, fmt.Errorf("wave %q is malformed (inconsistent barrier state)", name)
 		}
 		if w.AbandonedAt != "" {
 			if _, err := time.Parse(time.RFC3339Nano, w.AbandonedAt); err != nil || w.State != "abandoned" {
-				return nil, path, fmt.Errorf("wave %q is malformed (invalid abandonment timestamp)", name)
+				return nil, fmt.Errorf("wave %q is malformed (invalid abandonment timestamp)", name)
 			}
 		}
 		if w.TerminalAt != "" {
 			terminal, err := time.Parse(time.RFC3339Nano, w.TerminalAt)
 			abandoned, abandonErr := time.Parse(time.RFC3339Nano, w.AbandonedAt)
 			if err != nil || abandonErr != nil || w.State != "abandoned" || terminal.Before(abandoned) {
-				return nil, path, fmt.Errorf("wave %q is malformed (invalid terminal timestamp)", name)
+				return nil, fmt.Errorf("wave %q is malformed (invalid terminal timestamp)", name)
 			}
 			for _, account := range w.Roles {
 				for _, stamp := range []string{account.StartedAt, account.ReturnedAt} {
 					if stamp != "" {
 						at, _ := time.Parse(time.RFC3339Nano, stamp)
 						if terminal.Before(at) {
-							return nil, path, fmt.Errorf("wave %q is malformed (terminal timestamp precedes account)", name)
+							return nil, fmt.Errorf("wave %q is malformed (terminal timestamp precedes account)", name)
 						}
 					}
 				}
 			}
 		}
 	}
-	return f, path, nil
+	return f, nil
 }
 
 func saveDispatch(path string, f *dispatchFile) error {
@@ -543,7 +549,7 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 
 	case "return":
 		w := getWave()
-		if w == nil || w.State != "sealed" {
+		if w == nil || (w.State != "sealed" && w.State != "complete") {
 			return fail("wave %q is not sealed (state %s)", wave, waveState(w))
 		}
 		r := w.Roles[role]
@@ -553,6 +559,15 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 		if handle != "" && handle != r.Handle {
 			return fail("handle %q does not match role %q's recorded handle %q", handle, role, r.Handle)
 		}
+		if w.State == "complete" {
+			if !r.Returned || handle == "" || r.Handle == "" || w.Claim == "" {
+				return fail("completed wave %q needs a returned role, its recorded --handle, and an owned claim to reconcile", wave)
+			}
+			if !releaseWaveClaim(root, wave, w, stdout, stderr) {
+				return 3
+			}
+			return 0
+		}
 		if r.Returned {
 			return fail("role %q already returned", role)
 		}
@@ -594,8 +609,8 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 		if all {
 			absorbWave(root, slug, w, stderr)
 		}
-		if all && w.Claim != "" {
-			releaseWaveClaim(root, wave, w, stdout, stderr)
+		if all && w.Claim != "" && !releaseWaveClaim(root, wave, w, stdout, stderr) {
+			return 3
 		}
 		if stored != "" {
 			head, _, _ := strings.Cut(note, " slice=")
@@ -721,11 +736,11 @@ func checkAbandonedWriterClaims(root string, paths []string) error {
 	return nil
 }
 
-// releaseWaveClaim releases w's claim; explicit terminal abandonment also
-// reconciles a verified prior release. A failure only warns.
+// releaseWaveClaim releases w's claim or reconciles a verified prior release.
+// Callers surface failure without undoing the recorded return or abandonment.
 func releaseWaveClaim(root, wave string, w *dispatchWave, stdout, stderr io.Writer) bool {
 	n, err := releaseClaim(root, w.ClaimSession, w.Claim)
-	if w.State == "abandoned" && errors.Is(err, errClaimAlreadyReleased) {
+	if errors.Is(err, errClaimAlreadyReleased) {
 		fmt.Fprintf(stdout, "dispatch: wave %s claim %s already released\n", wave, w.Claim)
 		return true
 	}
@@ -914,21 +929,21 @@ func admitWrightRounds(root, slug string, f *dispatchFile, w *dispatchWave, revi
 	if kind == "wright" {
 		lines = append(lines, "dispatch: ADVISORY: wright contract reminder: name the writer-safe checks the wright runs (syntax/type/lint, unit and self-check suites, a narrow local smoke) and never forbid them; only artifact-producing, consumptive, or full canonical gates stay root-owned")
 	}
+	if kind == "wright" {
+		if refusal := wrightFanoutRefusal(w); refusal != "" {
+			fmt.Fprintln(stderr, refusal)
+			return nil, 3
+		}
+		if refusal := widerBatchRefusal(root, slug, w.Slices); refusal != "" {
+			fmt.Fprintln(stderr, refusal)
+			return nil, 3
+		}
+	}
 	if len(overCap) == 0 {
 		if review != "" {
 			fmt.Fprintf(stderr, "dispatch: --reslice-review given but no slice has reached its %d-round cap\n", wrightRoundsPerReview)
 			return nil, 2
 		}
-		if kind == "wright" {
-			if refusal := wrightFanoutRefusal(w); refusal != "" {
-				fmt.Fprintln(stderr, refusal)
-				return nil, 3
-			}
-			if refusal := widerBatchRefusal(root, slug, w.Slices); refusal != "" {
-				fmt.Fprintln(stderr, refusal)
-				return nil, 3
-			}
-		}
 		return lines, 0
 	}
 	if review == "" {