devrites 7.3.4 → 7.3.5

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.3.5](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.4...v7.3.5) (2026-11-05)
+
+### Fixed
+
+* **devrites:** enforce global autocomplete scheduling ([#208](https://github.com/ViktorsBaikers/DevRites/issues/208)) ([2e4fdb5](https://github.com/ViktorsBaikers/DevRites/commit/2e4fdb5178f2aa507ba565a70b3c2c86810cc5f7))
+
 ## [7.3.4](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.3...v7.3.4) (2026-11-03)
 
 ### Fixed
@@ -47,6 +53,18 @@ All notable changes to DevRites are documented here. The format follows [Keep a
 
 ### Fixed
 
+- Give an explicitly identified Autocomplete controller structural writer-admission
+  checks for actual successor preparation and source-qualified mixed reservations.
+  Surface fresh global scheduling after returns and prioritize unresolved global
+  work over local Build cursors, while preserving narrow disclosed deferrals,
+  standalone AFK, native review/proof, isolation and Ship approval.
+- Accept one explicit decision-bound canonical sequence roadmap without rewriting
+  historical tables; reject ambiguous owners, stale identities and unsafe paths.
+- Keep writer admission bound to immutable pending-lane paths, current controller
+  identity, disjoint active reservations and the effective global cap. Check the
+  complete writer allowlist against live foreign claims, including symlink
+  aliases, even when optional claim flags are absent or name unrelated paths.
+
 - Use `GH_TOKEN`, then `GITHUB_TOKEN`, then optional bounded noninteractive GitHub
   CLI credential lookup for release API requests. Keep credentials off release
   assets and off-origin redirects, fail explicit invalid credentials, and document

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.3.4`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.4): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.3.5`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.5): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/adr/0039-autocomplete-structural-admission.md

@@ -0,0 +1,87 @@
+# ADR-0039: Structural admission for the native Autocomplete controller
+
+- **Status:** Accepted
+- **Date:** 2026-11-05
+
+## Context
+
+Consumer traces showed a native Autocomplete controller repeatedly completing one
+workspace while leaving recorded continuation preparation unstarted. A global
+frontier report alone did not prevent subsequent local writer admission. The
+controller also recognized a historical workspace rename without resolving the
+conflict between the old roadmap table and current sequence identities.
+
+ADR-0022 and ADR-0024 leave semantic scheduling and model dispatch with native
+hosts. Replacing them with an engine agent bridge, persistent queue, scheduling
+receipts, or heuristic interpretation of reviewer prose would create a second
+orchestration authority. Existing dispatch and lease primitives already retain
+observable preparation accounts, source-qualified reservations and write claims.
+
+## Decision
+
+Narrow ADR-0022's native-scheduling boundary and ADR-0024's policy boundary only
+for structural Autocomplete writer admission:
+
+- Explicit native Autocomplete invocation records `mode: autocomplete` in AFK.
+  This identifies the controller; it grants no readiness, independence or Ship
+  permission. Standalone AFK without this mode retains its existing contract.
+- Before admitting a new Build-wright wave at capacity greater than one, the
+  engine checks immediate successor preparation and the eligible mixed cohort.
+  Preparation is
+  represented by an actual pending native preparation account, current native
+  readiness, or a concrete retained hold. Creating a placeholder or printing a
+  frontier does not satisfy this boundary.
+- A source may disclose a target-specific preparation constraint through
+  `frontier-blocked: <workspace> — <reason>` in its existing evidence ledger.
+  `sequence` names only unresolved historical sequence normalization. These rows
+  defer scheduling obligations; they never waive malformed authority, source
+  readiness, trust boundaries, writer claims, path/capacity limits or proof.
+- An already-ready foreign slice requires an existing mixed lease reservation
+  or an exact source-qualified `serial:` rationale for ordered handoff. A local
+  serial reason or preparation deferral does not discharge foreign admission.
+- A fresh global observation follows a committed dispatch return after mutation
+  and locks settle, even if later claim release fails; its nonzero failure and
+  claim exclusion remain. Rejected/unpersisted returns do not refresh. Global
+  obligations take continuation priority without rewriting local phase cursors
+  or recursively routing local-only work.
+- One explicit canonical `roadmap.md`, bound to the actual sequence root and a
+  unique owner-local decision, may replace historical tables for scheduling.
+  History stays unchanged; duplicate authorities, malformed inputs, conflicting
+  current identities and invalid references fail closed. Native owners decide
+  whether the decision and scope are substantively approved.
+- Initial admission freezes each pending writer lane's normalized allowlist in
+  existing dispatch metadata. Mutable tasks, reused batch labels or replacement
+  lease rows cannot move a retained actor's authority. Exact claim identity and
+  session remain required; claim release or expiry does not prove actor exit.
+  Returned/integrated siblings may free slots for rolling refill.
+
+The engine does not invoke a model, create a native workspace, infer semantic
+independence, judge a rationale's truth, bind a handle to an execution checkout,
+or authorize publishing. Native hosts still execute preparation, dispatch exact
+profiles, reconcile results and obey human and protected-validation gates.
+
+## Alternatives considered
+
+| Option | Why rejected |
+| --- | --- |
+| More reminders and frontier reports only | The observed controller already had that guidance and still skipped preparation. |
+| Automatically accept the newest table or rename prose | Recency and prose do not establish canonical identity or supersession. |
+| Rewrite archived maps to match the current run | Destroys the historical decision rather than recording current authority. |
+| Require every future workspace READY before any writer | Serializes preparation and creates cycles when future plans depend on current repair. |
+| Engine-owned model scheduling, receipts or persistent queue | Duplicates host authority and exceeds the deterministic local boundary. |
+
+## Consequences
+
+Skipping required preparation now refuses an observable writer-admission step
+rather than remaining a narrative warning. Independent work can continue with a
+disclosed specific constraint, without disguising deferred work as completed.
+Canonical normalization has one machine-readable owner and does not require
+altering old evidence or guessing workspace names.
+
+This cannot prove that an arbitrary host obeys every instruction or that a native
+account represents real semantic progress. Runtime claims therefore distinguish
+structural admission, recorded native launches, and actual host behavior.
+
+Guard tests: `engine/internal/lib/frontier_controller_test.go`,
+`engine/internal/lib/frontier_roadmap_test.go`, and
+`engine/tests/autocomplete_global_test.go`.

package/docs/adr/README.md

@@ -84,3 +84,4 @@ architecture; per-feature `decisions.md` files stay scoped to that feature.
 | [0036](0036-archive-recall-is-a-read-time-query.md) | Archive recall is a read-time query | Accepted; consistent with 0014/0022 (no engine index or store) | `engine/internal/lib/recall_test.go` |
 | [0037](0037-autocomplete-lands-local-checkpoints.md) | Autocomplete lands local checkpoints and self-resolves own scratch | Accepted; supersedes the ADR-0022 local-commit approval clause | `tests/authority-drift-test.sh` |
 | [0038](0038-engine-flags-unattributed-root-edits.md) | The engine flags unattributed root edits | Accepted; narrows the ADR-0018 no-replacement-enforcement clause for root-edit attribution | `engine/internal/lib/treebaseline_test.go` |
+| [0039](0039-autocomplete-structural-admission.md) | Structural admission for native Autocomplete | Accepted; narrowly amends 0022/0024 for observable writer admission, retains native dispatch and semantic authority | `engine/internal/lib/frontier_controller_test.go`, `engine/internal/lib/frontier_roadmap_test.go`, `engine/tests/autocomplete_global_test.go` |

package/docs/cli.md

@@ -213,7 +213,9 @@ self-contained updater.
   and exits `3` naming the holder when a live claim by another session covers a
   path; `release --session <id> --id <claim>` frees it; `list [--all]` shows
   live (or all) claims; `check [--session <id>] <path>...` is the read-only
-  preflight. Each claim records its host and the claiming session's long-lived
+  preflight. Conflict checks cover logical paths and physical symlink aliases;
+  unresolved physical paths fail closed. Same-session allocation stays exempt.
+  Each claim records its host and the claiming session's long-lived
   processes; when all of them have exited on this host, `list` shows the claim
   `dead` and it no longer conflicts. Other hosts or an unavailable `ps` never
   prove exit. Claims coordinate concurrent same-tree sessions; they never
@@ -285,6 +287,10 @@ The report emits:
 - `frontier-prepare:` for a recorded next Spec cursor or an unambiguous next entry
   in an exact position/workspace table, or `frontier-review-sequence:` artifact
   paths when remaining work or conflicting sequence maps require native review.
+- `frontier-authority: <artifact-path>,...` identifies actual files supplying a
+  valid nonempty scheduling map. For explicit canonical authority it names the
+  owning `roadmap.md` and same-owner `decisions.md`; legacy maps list their actual
+  artifacts without claiming canonical status.
 
 Relations come from exact recorded `sequence_parent` edges, not name prefixes.
 Conflicting identities, cycles, malformed related state, or invalid declared
@@ -295,14 +301,106 @@ Conflicting or amended sequence maps suppress missing-workspace preparation even
 with a recorded Spec cursor until native authority normalization resolves them;
 valid existing live descendants remain visible and eligible for guarded selection.
 
+An optional `roadmap.md` becomes current scheduling authority when it contains
+either `Sequence root:` or `Decision:`. Both headers are then required:
+
+```markdown
+Sequence root: actual-anchor-slug
+Decision: DEC-017
+
+| Position | Workspace |
+| --- | --- |
+| 1 | actual-anchor-slug |
+| 2 | actual-renamed-child |
+```
+
+Exactly one related live or archived workspace may own this explicit map.
+`Decision: DEC-NNN` must identify exactly one `## DEC-NNN` heading in that
+owner's `decisions.md`; the root must match the actual chain anchor. Exactly
+one table must have contiguous positions from 1 and unique valid workspace
+slugs, matching every related recorded position and exact successor. Folder
+numbering, prose amendments, and unenrolled workspaces confer no authority.
+A valid explicit map supersedes historical tables in `decisions.md`, `spec.md`,
+and headerless `roadmap.md` for scheduling only; preserve those historical bytes.
+Without either header, `roadmap.md` retains conservative legacy parsing.
+Partial/malformed headers, multiple owners, invalid root/decision/table, or a
+symlink/unreadable explicit map fail closed without legacy fallback. Use native
+authority normalization to record the approved actual identities while retaining
+history. Structural validation establishes identity, not semantic approval,
+independence, Build readiness, or Ship permission.
+
 Under AFK, `next`, `handoff`, and `check continuation` expose the same frontier.
 A source-local `parallel select --from-plan` without `--workspaces` also prints
 the report to stderr, preserving its machine-readable selection on stdout and
 source-local picks: reporting another workspace never silently admits it.
-Native Autocomplete must inspect the returned preparation and review
-actions, read the approved roadmap and recorded restrictions, then invoke the
-owning Spec/Plan/Vet steps or explicit mixed selection. Path disjointness alone
-does not establish semantic independence or lift a planning-only restriction.
+Native Autocomplete must inspect returned preparation/review actions and read
+the exact `frontier-authority:` paths plus recorded restrictions before invoking
+Spec/Plan/Vet or mixed selection. This read is required even when the owner is an
+archived ancestor or another related workspace outside the local read-next bundle.
+Path disjointness alone establishes neither semantic independence nor permission
+to lift a planning-only restriction.
+
+### Autocomplete controller admission
+
+The existing `/rite-autocomplete` invocation writes or upserts `mode: autocomplete`
+in `.devrites/AFK`; no extra flag is needed. It preserves other sentinel fields
+unless an explicit `--parallel N` changes capacity. Mode identifies the native
+controller, not authorization. Standalone AFK without mode retains its behavior;
+duplicate or invalid mode requires normalization rather than silently disabling
+the controller gate.
+
+With controller mode and global capacity above one, a new Build wright
+`dispatch open` checks structural global scheduling before writing claims, history,
+or a round. It checks one immediate recorded successor per admitted source, not
+the whole future sequence:
+
+- Missing permitted successor: start its native Spec/Plan/Vet preparation and
+  retain actual launched planning/review handles before admitting the writer.
+- Existing successor: require pending preparation handles, a current native
+  Build-ready binding, or its concrete human/dependency hold. A placeholder
+  state/spec or a prose claim that preparation happened is insufficient.
+- Opted-out or exhausted future opening and source human/question holds do not
+  invent new preparation obligations. Unresolved sequence authority requires
+  native normalization.
+
+For a concrete preparation constraint, retain
+`frontier-blocked: <successor-slug> — <specific constraint>` in the source's
+`evidence.md`. For unresolved historical normalization on otherwise-valid local
+work use `frontier-blocked: sequence — <specific constraint>`. These deferrals
+remain visible for native review; they grant no approval, readiness, or claim
+that normalization succeeded. Neither waives malformed canonical authority,
+invalid AFK/path/readiness/security checks, or already-ready foreign Build.
+A generic local `serial: SLICE-002 — <reason>` does not waive cross-workspace
+preparation. A discharged deferral does not repeatedly trigger controller work.
+
+Ready independent foreign sources must participate in explicit repository-wide
+mixed selection and lease capacity/path reservations. Reserve the cohort with
+`parallel create/add`; source waves may then open separately. A concrete
+`serial: other-workspace/SLICE-001 — <constraint>` can retain an ordered handoff
+for that exact foreign pick; an unqualified local serial reason cannot silently
+omit it. This does not waive successor preparation or readiness, dependencies,
+runtime/path isolation, actor claims, or reviewer/proof windows.
+Dispatch `controller_batch` is an opaque cohort-instance admission identity,
+recording initial whole-wave, source-qualified live-lease admission, never proof
+of actor checkout, cwd, or runtime profile. Immutable `admitted_paths` snapshots
+retain each pending writer lane's normalized allowlist. Missing snapshots or
+changed reservations require actor reconciliation; mutable tasks cannot backfill
+authority. Returned/integrated siblings may release slots for rolling refill.
+Exact claim identity/session remains required; release or expiry does not stop
+an actor. Retained unbound or other-cohort writers hold new actors; later lease
+IDs cannot retrofit them. Native exact cwd/profile checks remain required.
+Unsupported isolation permits truthful local-owner serial work and normal
+ordered handoff, never an early same-tree foreign writer.
+
+Controller continuation prioritizes actionable global normalization, preparation,
+and foreign work over a direct local Build invocation while preserving the local
+phase cursor. Local-only ready work does not recursively invoke Autocomplete.
+After a committed dispatch return, a fresh global scheduling result resurfaces
+the next obligation—even if later claim release fails; its nonzero failure and
+claim exclusion remain. Rejected or unpersisted returns do not refresh.
+Ordinary status reads remain read-only. Protected reviewer/proof windows defer
+unsafe landing, not independent planning. No such transition invokes Ship or
+launches a model through the engine.
 
 The engine does not invoke models, create workspaces, change `ACTIVE`, resolve
 semantic authority, or grant Ship approval. These outputs guide the native host;

package/docs/engine/commands.md

@@ -35,7 +35,7 @@ workflow strategy.
 | `orient <slug>` | Alias for `observe summary`. |
 | `observe slice <slug> <SLICE-ID>` | Print one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. |
 | `next [slug]` | Print the minimal remaining lifecycle path plus advisory skips; in Build also `eligible_now:`, `batch:` and the `select-command:` (`parallel select --root <project> --slug <slug> --cap N --from-plan`, N = AFK max_parallel else 10) that reproduces the batch. Prints `blocked: unattributed root edit: ...` after `open-questions:` and exits `3` while the ADR-0038 tripwire flags a product path; the rest of the output still prints. |
-| `frontier [slug]` | Read-only report across exact recorded sequence relations, including archived intermediaries and live descendants. Emits `frontier: actionable\|waiting\|blocked\|clear` (`none` for a non-sequence source), `frontier-source:`, and `frontier-workspace:` rows with location, `inspect\|prepare\|repair\|wait\|complete` action, and reason. Emits `frontier-select-command:`, `frontier-picks:`, `frontier-selection: blocked`, `frontier-prepare:`, or `frontier-review-sequence:` where applicable. Explicit slug may be archived; absent ACTIVE recovery requires a unique archived terminal tip with a recorded native Spec edge, otherwise refuses ambiguity. Never changes ACTIVE, restores archives, creates workspaces, or launches writers. Native preparation and semantic admission remain required; see [sequence frontier](../cli.md#sequence-frontier). |
+| `frontier [slug]` | Read-only report across exact recorded sequence relations, including archived intermediaries and live descendants. Emits `frontier: actionable\|waiting\|blocked\|clear` (`none` for a non-sequence source), `frontier-source:`, and `frontier-workspace:` rows with location, `inspect\|prepare\|repair\|wait\|complete` action, and reason. Emits `frontier-select-command:`, `frontier-picks:`, `frontier-selection: blocked`, `frontier-prepare:`, or `frontier-review-sequence:` where applicable. Explicit slug may be archived; absent ACTIVE recovery requires a unique archived terminal tip with a recorded native Spec edge, otherwise refuses ambiguity. One explicit `roadmap.md` owner anywhere in the related live/archive chain may supersede historical maps for scheduling: both `Sequence root:` and `Decision:` headers, a unique owner-local decision heading, and one contiguous position/workspace table must match recorded identities and successors. Either header claims this format; invalid authority fails closed without legacy fallback. Headerless maps retain legacy parsing. Native normalization preserves historical bytes; structural identity is not semantic approval. Never changes ACTIVE, restores archives, creates workspaces, or launches writers. Native preparation and semantic admission remain required; see [sequence frontier](../cli.md#sequence-frontier). |
 | `handoff [slug] [--resume]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, in-flight dispatch waves (`inflight_wave:` lines: phase, state, pending roles, slices), missing required files, the canonical read-next order, and the same `continuation:` lines as `check continuation`. Read-only unless `--resume`, which appends one `resume` event (role root) to `metrics.jsonl`; `metrics summary` then reports minutes from each resume to the next dispatch. The `/rite-handoff` spine and the compaction-fallback entry point. |
 | `recall --paths <p1,p2,...> [--limit n]` | Read-time query over `.devrites/archive/`: list archived features whose `touched-files.md` candidate manifest covers a queried project-relative path (exact or directory prefix, case-folded), ranked by overlap count, then newest archive-directory mtime, then slug (default 10 features). Each feature prints up to 8 `archive/<slug>/<file>:<line>` pointers, then `+N more`: `decisions.md` `DEC-###` entries and `## Carry-forward constraints` bullets whose `Files:` overlap (or a constraint naming no files), plus `review.md`/`seal.md`/`drift.md` lines that mention a queried path; fenced examples are ignored. Never writes, caches, or indexes (no metric either); symlinked archive entries are refused. An unreadable archive file prints `unreadable:` and the scan continues. Exit `0` (including `recall: no archive`), `1` invalid archive directory, `2` usage. |
 | `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`), unless `.devrites/AFK` `max_parallel` is 2 or more or a parallel lease is `running` (the bundle stays whole); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
@@ -62,6 +62,51 @@ workflow strategy.
 Under AFK, `next`, `handoff`, and `check continuation` include the sequence
 frontier without replacing the source-local cursor. Reporting actionable work
 does not authorize Build or Ship, and cannot guarantee native-host compliance.
+For a valid nonempty map, `frontier-authority: <artifact-path>,...` exposes actual
+authority files. Canonical maps name owner `roadmap.md` and owner-local
+`decisions.md`; valid legacy maps name their artifacts without a canonical claim.
+Native preparation must read those exact paths and restrictions, including
+archived/related owners absent from the local context read-next bundle.
+
+Native `/rite-autocomplete` automatically upserts AFK `mode: autocomplete`
+(no new flag), preserving other fields except an explicit `--parallel N` capacity
+update. Missing mode retains standalone AFK behavior; invalid/duplicate mode
+fails closed. With mode and global cap >1, Build wright `dispatch open` checks
+global scheduling before claims/history/round writes: prepare one immediate
+recorded successor per source, with actual pending planning/review handles,
+current native readiness, or a concrete human/dependency hold; placeholders do
+not count. Opt-out, exhausted opening budgets, and source human/question holds
+remain binding. Unresolved authority requires native normalization.
+
+Source `evidence.md` may retain `frontier-blocked: <successor-slug> — <specific constraint>`
+or `frontier-blocked: sequence — <specific constraint>` as a visible scheduling
+deferral, never approval or completed normalization. Generic local `serial:`
+does not waive preparation. Ready foreign picks require mixed selection and
+global lease capacity/path reservations, or an exact qualified
+`serial: other-workspace/SLICE-001 — <constraint>` ordered handoff. Cohort waves
+need not open atomically. Opaque `controller_batch` identifies admission to an
+existing lease cohort instance; reusing a batch label creates no actor entitlement.
+It proves no actor checkout/cwd/runtime isolation and cannot retrofit a retained
+writer. Immutable per-slice `admitted_paths` retain only each pending actor lane;
+missing snapshots or changed reservations require actor reconciliation, not
+backfill from mutable tasks. Returned/integrated siblings may release slots for
+refill. Exact claim identity/session remains required even after release/expiry.
+Readiness, dependencies, actor claims and proof windows still apply.
+Target-specific blocking defers preparation, not ready foreign Build. Sequence
+blocking covers historical normalization only for otherwise-valid local work;
+malformed canonical authority and invalid AFK/path/readiness/security still fail.
+Discharged deferrals do not repeatedly trigger controller work. Native reviews
+constraint substance and verifies exact actor cwd/profile. Retained unbound or
+other-cohort writers hold new actors; unsupported isolation requires local-owner
+serial work and ordered handoff, never early same-tree foreign writing.
+
+Controller continuation prioritizes actionable global work over direct local
+Build without replacing the local cursor or looping on local-only ready work.
+Committed dispatch returns emit fresh scheduling after locks release even if
+later claim release fails; preserve that nonzero failure and claim exclusion.
+Rejected/unpersisted returns do not refresh; status reads stay read-only.
+Protected reviewer/proof windows constrain landing, not independent planning.
+See [controller admission](../cli.md#autocomplete-controller-admission).
 
 For `context --role`, optional `devrites-` prefixes and `.lane` suffixes resolve
 the base specialist's contract, workspace read-set, and role-specific rules.

package/engine/internal/lib/claims.go

@@ -239,21 +239,39 @@ func validSession(s string) bool {
 	return true
 }
 
-// claimConflicts returns live claims by other sessions overlapping any path: a
-// claimed directory covers every path beneath it, and vice versa.
-func claimConflicts(live []*claimRecord, session string, paths []string) []*claimRecord {
+// claimConflicts checks logical and physical overlap for other live sessions:
+// a claimed directory covers every path beneath it, and vice versa.
+func claimConflicts(root string, live []*claimRecord, session string, paths []string) ([]*claimRecord, error) {
 	var out []*claimRecord
+	var physical []string
 	for _, rec := range live {
 		if rec.Session == session {
 			continue
 		}
-		if slices.ContainsFunc(rec.Paths, func(held string) bool {
+		overlaps := slices.ContainsFunc(rec.Paths, func(held string) bool {
 			return slices.ContainsFunc(paths, func(p string) bool { return claimPathsOverlap(held, p) })
-		}) {
+		})
+		if !overlaps {
+			if physical == nil {
+				var err error
+				physical, err = physicalClaimPaths(root, paths)
+				if err != nil {
+					return nil, err
+				}
+			}
+			held, err := physicalClaimPaths(root, rec.Paths)
+			if err != nil {
+				return nil, fmt.Errorf("claim %s: %w", rec.ID, err)
+			}
+			overlaps = slices.ContainsFunc(held, func(h string) bool {
+				return slices.ContainsFunc(physical, func(p string) bool { return claimPathsOverlap(h, p) })
+			})
+		}
+		if overlaps {
 			out = append(out, rec)
 		}
 	}
-	return out
+	return out, nil
 }
 
 // claimPathsOverlap folds case always: on a case-sensitive filesystem a false
@@ -482,6 +500,37 @@ func addClaimTargets(root, session, reason string, ttl int, raw, workspaces []st
 	return id, code
 }
 
+// Caller holds the repository claims lock through new-wave publication.
+func checkWriterClaimsLocked(root, session string, paths []string) error {
+	if len(paths) == 0 {
+		return nil
+	}
+	latest, order, bad, err := readClaims(claimsPath(root))
+	if err != nil {
+		return err
+	}
+	if bad > 0 {
+		return fmt.Errorf("%d unparsed ledger line(s); cannot rule out a writer claim", bad)
+	}
+	probe := newHolderProbe()
+	retained, err := retainedWriterConflicts(root, latest, paths, probe)
+	if err != nil {
+		return err
+	}
+	if len(retained) > 0 {
+		return fmt.Errorf("abandoned writer still holds claim %s on %s; confirm host termination and use dispatch abandon --release before retrying", retained[0].ID, strings.Join(retained[0].Paths, ","))
+	}
+	conflicts, err := claimConflicts(root, probe.withoutGone(liveClaims(latest, order, time.Now().UTC())), session, paths)
+	if err != nil {
+		return err
+	}
+	if len(conflicts) > 0 {
+		rec := conflicts[0]
+		return fmt.Errorf("live writer claim %s on %s held by session %q until %s", rec.ID, strings.Join(rec.Paths, ","), rec.Session, rec.ExpiresAt)
+	}
+	return nil
+}
+
 func claimAddLocked(path, session, reason string, ttl int, paths, admissionPaths []string, stdout, stderr io.Writer) (string, int) {
 	latest, order, bad, err := readClaims(path)
 	if err != nil {
@@ -503,7 +552,11 @@ func claimAddLocked(path, session, reason string, ttl int, paths, admissionPaths
 		printConflicts(stderr, retained)
 		return "", 3
 	}
-	conflicts := claimConflicts(probe.withoutGone(liveClaims(latest, order, now)), session, paths)
+	conflicts, err := claimConflicts(filepath.Dir(path), probe.withoutGone(liveClaims(latest, order, now)), session, admissionPaths)
+	if err != nil {
+		fmt.Fprintf(stderr, "claim: %v\n", err)
+		return "", 3
+	}
 	if len(conflicts) > 0 {
 		printConflicts(stderr, conflicts)
 		return "", 3
@@ -698,7 +751,11 @@ func claimCheckLocked(root, session string, paths []string, stdout, stderr io.Wr
 		printConflicts(stdout, retained)
 		return 3
 	}
-	conflicts := claimConflicts(probe.withoutGone(liveClaims(latest, order, time.Now().UTC())), session, paths)
+	conflicts, err := claimConflicts(root, probe.withoutGone(liveClaims(latest, order, time.Now().UTC())), session, paths)
+	if err != nil {
+		fmt.Fprintf(stderr, "claim: %v\n", err)
+		return 2
+	}
 	if len(conflicts) > 0 {
 		printConflicts(stdout, conflicts)
 		return 3

package/engine/internal/lib/continuation.go

@@ -40,6 +40,11 @@ func RunCheckContinuation(root string, args []string, stdout, stderr io.Writer)
 		}
 		return code
 	}
+	mode, err := autocompleteMode(root)
+	if err != nil {
+		fmt.Fprintf(stderr, "check continuation: %v\n", err)
+		return 2
+	}
 	verdict, err := classifyContinuation(root, slug)
 	if err != nil {
 		fmt.Fprintf(stderr, "check continuation: %v\n", err)
@@ -52,7 +57,7 @@ func RunCheckContinuation(root string, args []string, stdout, stderr io.Writer)
 			fmt.Fprintf(stderr, "check continuation: frontier: %v\n", err)
 			return 2
 		}
-		if !verdict.Required && len(frontier) > 0 && frontier[0] == "frontier: actionable" {
+		if mode && frontierGlobalPriority(slug, frontier) || !mode && !verdict.Required && len(frontier) > 0 && frontier[0] == "frontier: actionable" {
 			verdict = continuationVerdict{Required: true, Invoke: "/rite-autocomplete", Source: slug, Reason: "global frontier requires native preparation, authority review, or selection; no Ship approval"}
 		}
 	}

package/engine/internal/lib/dispatch.go

@@ -116,7 +116,9 @@ type dispatchWave struct {
 	ResliceReviewed []string                 `json:"reslice_reviewed,omitempty"`
 	Claim           string                   `json:"claim,omitempty"`
 	ClaimSession    string                   `json:"claim_session,omitempty"`
-	Tree            string                   `json:"tree,omitempty"` // work tree at a build wright open, for check windows --since-dispatch
+	Tree            string                   `json:"tree,omitempty"`             // work tree at a build wright open, for check windows --since-dispatch
+	ControllerBatch string                   `json:"controller_batch,omitempty"` // cohort admission identity, not evidence of actor checkout
+	AdmittedPaths   map[string][]string      `json:"admitted_paths,omitempty"`   // immutable normalized write sets, keyed by source-local slice
 }
 
 // dispatchClaim carries the wave-claim flags; ttl 0 means unset.
@@ -341,20 +343,61 @@ func RunDispatch(root string, args []string, stdout, stderr io.Writer) int {
 	// Serialize load-modify-save so concurrent start/return calls never lose
 	// an update and strand the wave short of complete.
 	code := 0
-	if err := state.WithFeatureLock(root, slug, func() error {
-		// Feature → claims is the lock order; never acquire another feature.
-		return state.WithLock(claimsPath(root)+".lock", func() error {
-			code = dispatchLocked(root, slug, sub, phase, wave, role, handle, reason, roles, sliceIDs, review, contract, packet, outcome, result, all, claim, stdout, stderr)
-			return nil
+	recordedReturn := false
+	mutate := func() error {
+		return state.WithFeatureLock(root, slug, func() error {
+			// Controller → feature → claims; never acquire another feature.
+			return state.WithLock(claimsPath(root)+".lock", func() error {
+				code = dispatchLocked(root, slug, sub, phase, wave, role, handle, reason, roles, sliceIDs, review, contract, packet, outcome, result, all, claim, stdout, stderr, &recordedReturn)
+				return nil
+			})
 		})
-	}); err != nil {
+	}
+	controllerOpen := false
+	if sub == "open" && strings.EqualFold(phase, "build") {
+		for _, candidate := range roles {
+			controllerOpen = controllerOpen || strings.Contains(candidate, "wright")
+		}
+	}
+	if controllerOpen {
+		mode, err := autocompleteMode(root)
+		if err != nil {
+			fmt.Fprintf(stderr, "dispatch: BLOCKED: %v\n", err)
+			return 3
+		}
+		controllerOpen = mode
+	}
+	var lockErr error
+	if controllerOpen {
+		lockErr = parallel.WithControlLock(root, mutate)
+	} else {
+		lockErr = mutate()
+	}
+	if err := lockErr; err != nil {
 		fmt.Fprintf(stderr, "dispatch: %v\n", err)
 		return 3
 	}
+	if recordedReturn {
+		mode, err := autocompleteMode(root)
+		if err != nil {
+			fmt.Fprintf(stderr, "dispatch: return recorded; global scheduling: %v\n", err)
+			return 3
+		}
+		if mode {
+			lines, err := FrontierLines(root, slug)
+			if err != nil {
+				fmt.Fprintf(stderr, "dispatch: return recorded; global scheduling: %v\n", err)
+				return 3
+			}
+			for _, line := range lines {
+				fmt.Fprintln(stdout, line)
+			}
+		}
+	}
 	return code
 }
 
-func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, roles, sliceIDs []string, review, contract, packet, outcome, result string, all bool, claim dispatchClaim, stdout, stderr io.Writer) int {
+func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, roles, sliceIDs []string, review, contract, packet, outcome, result string, all bool, claim dispatchClaim, stdout, stderr io.Writer, recordedReturn *bool) int {
 	f, path, err := loadDispatch(root, slug)
 	if err != nil {
 		fmt.Fprintf(stderr, "dispatch: %v\n", err)
@@ -392,6 +435,16 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 		if err := lintKnownRoles(root, phase, roles); err != nil {
 			return fail("BLOCKED: %v", err)
 		}
+		if isBuildWrightWave(w) {
+			binding, notices, err := autocompleteWriterAdmission(root, slug, w, f)
+			if err != nil {
+				return fail("BLOCKED: %v", err)
+			}
+			w.ControllerBatch = binding
+			for _, notice := range notices {
+				fmt.Fprintln(stdout, notice)
+			}
+		}
 		rounds, code := admitWrightRounds(root, slug, f, w, review, stderr)
 		if code != 0 {
 			return code
@@ -428,10 +481,16 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 		}
 		admissionPaths := slices.Clone(claimPaths)
 		if isWrightWave(w) {
-			admissionPaths = append(admissionPaths, sliceWriteSet(root, slug, w.Slices)...)
+			if len(w.AdmittedPaths) > 0 {
+				for _, id := range w.Slices {
+					admissionPaths = append(admissionPaths, w.AdmittedPaths[id]...)
+				}
+			} else {
+				admissionPaths = append(admissionPaths, sliceWriteSet(root, slug, w.Slices)...)
+			}
 		}
 		if len(claimPaths) == 0 {
-			if err := checkAbandonedWriterClaims(root, admissionPaths); err != nil {
+			if err := checkWriterClaimsLocked(root, claim.session, admissionPaths); err != nil {
 				return fail("BLOCKED: %v", err)
 			}
 		}
@@ -566,6 +625,7 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 			if !releaseWaveClaim(root, wave, w, stdout, stderr) {
 				return 3
 			}
+			*recordedReturn = true
 			return 0
 		}
 		if r.Returned {
@@ -604,6 +664,7 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 			}
 			return fail("%v", err)
 		}
+		*recordedReturn = true
 		recordMetricNote(root, slug, w.Phase, "return", role, note)
 		fmt.Fprintf(stdout, "dispatch: %s returned (wave %s %s)\n", role, wave, w.State)
 		if all {
@@ -714,28 +775,6 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 	return 2
 }
 
-// Caller holds the repository claims lock through new-wave publication.
-func checkAbandonedWriterClaims(root string, paths []string) error {
-	if len(paths) == 0 {
-		return nil
-	}
-	latest, _, bad, err := readClaims(claimsPath(root))
-	if err != nil {
-		return err
-	}
-	if bad > 0 {
-		return fmt.Errorf("%d unparsed ledger line(s); cannot rule out an abandoned writer claim", bad)
-	}
-	conflicts, err := retainedWriterConflicts(root, latest, paths, newHolderProbe())
-	if err != nil {
-		return err
-	}
-	if len(conflicts) > 0 {
-		return fmt.Errorf("abandoned writer still holds claim %s on %s; confirm host termination and use dispatch abandon --release before retrying", conflicts[0].ID, strings.Join(conflicts[0].Paths, ","))
-	}
-	return nil
-}
-
 // releaseWaveClaim releases w's claim or reconciles a verified prior release.
 // Callers surface failure without undoing the recorded return or abandonment.
 func releaseWaveClaim(root, wave string, w *dispatchWave, stdout, stderr io.Writer) bool {
@@ -1039,6 +1078,13 @@ func wrightLane(role string) (string, bool) {
 // errors are never refused: the check widens the batch, it never stops a
 // wave that already starts every remaining pick.
 func widerBatchRefusal(root, slug string, wave []string) string {
+	mode, modeErr := autocompleteMode(root)
+	if modeErr != nil {
+		return fmt.Sprintf("dispatch: BLOCKED: %v", modeErr)
+	}
+	if mode {
+		return ""
+	}
 	capN := min(afkMaxParallel(root), parallel.MaxParallelSlices)
 	if capN < 2 {
 		return ""