devrites 7.3.4 → 7.3.5

package/pack/generated/omp/skills/rite-autocomplete/reference/loop.md

@@ -12,6 +12,7 @@ Autocomplete chains existing `/rite-*` workflows without routine-phase pauses. A
 ## Arm AFK once
 
 ```yaml
+mode: autocomplete
 allow_gates: [advisory, validating]
 # max_slices / max_agents / max_minutes / max_review_queue omitted: unlimited
 # continue_sequence: false         # opt out; default chains after Seal GO
@@ -22,18 +23,15 @@ allow_gates: [advisory, validating]
 # notify: "<cmd>"
 ```
 
-Read existing sentinel first. Preserve valid bytes, except
-when this invocation contains `--parallel N`: then write or replace only
-`max_parallel: N` and leave every other key unchanged. Stop if the sentinel is
-malformed. Do not stop because it names `max_slices` / `max_agents` /
-`max_minutes` / `max_review_queue` or only `[advisory]`. If absent, write it
-once after clarity, and include `max_parallel: N` when that flag is present.
-Without the flag, seed a newly created sentinel from retained global lease capacity
-when present; otherwise use fresh-run default 10. Never replace a valid existing
-sentinel's capacity from lease/default. Never write `max_slices` from `--max-slices`.
-It is otherwise read-only: never rewrite it after Vet or reset it on resume. Leftover `expires_at` is ignored
-and never rewritten. **Failing case:** leftover `max_parallel: 1` keeps the run
-serial after `--parallel 5`.
+Read existing AFK first. On each explicit Autocomplete invocation, upsert only
+`mode: autocomplete` and, if supplied, `max_parallel: N`; preserve other fields.
+Missing mode retains standalone AFK behavior until that explicit entry. Invalid
+or duplicate mode fails closed; mode grants neither phase nor action authority.
+If absent, create AFK after clarity with the mode above; capacity is explicit N,
+else retained global lease capacity, else 10. Preserve existing capacity without
+the flag. Nested phases/wakes leave AFK unchanged: no `max_slices` flag seeding,
+expiry rewrite or reset. Legacy slice/agent/time/review limits do not stop this
+controller. **Failing case:** `--parallel 5` retains `max_parallel: 1`.
 
 ### Derive the mutable post-vet budget
 
@@ -43,15 +41,15 @@ remaining. AFK configuration itself stays unchanged.
 
 ### Admit each unattended cycle
 
-Before each phase, review fan-out, recovery, or writer dispatch: cheapest
-readiness check first; reject overlap. Do not stop on `max_agents`,
-`max_minutes`, or `max_review_queue`. Count every leaf result. New activations reset activation-local counters, retaining durable slice/recovery state.
-
-[Build return](skill://rite-build/reference/output.md#caller-owned-continuation).
-Pass `--parallel N`; ignore leftover cap/headroom, remaining-0,
-and `--max-slices` stops. Agent-invented dispatch, wait, tool-call, or turn budgets are not stop conditions.
-An explicit human request to pause or run only a bounded subset still wins.
-Path collisions serialize work; they do not end the run.
+Before each phase, fan-out, recovery or writer: run cheap readiness and reject
+overlap. Before Build admission, execute the shared immediate-successor
+preparation/deferral and global cohort rules; local readiness alone is insufficient.
+Count every leaf result. Explicit activations reset activation-local counters,
+not durable slice/recovery state. Pass resolved `--parallel N` to
+[Build](skill://rite-build/reference/output.md#caller-owned-continuation).
+Ignored legacy budgets and local serial constraints are not whole-run stops.
+Invented ceilings on dispatches, waits, tool calls or turns cannot stop execution;
+human instructions to pause or limit scope still bind.
 Resolve ranked validating/blocking picks via `devrites-engine state resolve`;
 never hand `/rite-resolve` to the user. Escalating, irreversible-risk, access, blocking
 without recommendations, and Seal judgment (`slice: seal`) still pause.
@@ -74,12 +72,12 @@ Workspace files, not chat, carry state. Read/execute each phase skill:
 | 10 | `/rite-seal` | GO/NO-GO; no Git |
 | 11 | `/rite-ship` | only after GO; `--ship` never authorizes Git; stop at literal-GO/native approval |
 
-At phase entry, before cold/local recovery, on landing/reviewer/planning returns
-and before native waits, run `devrites-engine frontier <source>` and execute the
-shared [global frontier pass](skill://devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
-Its report requires authorized preparation/Vet and mixed selection, not a pause.
-Preserve local cursors, pending handles and protected validation windows;
-scheduling precedes owner Seal without changing ordered handoff below.
+At phase entry, before local recovery or waits, execute the
+[global pass](skill://devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
+Consume the fresh frontier emitted after a recorded `dispatch return`; after
+landing, planning/artifact changes or capacity updates, rerun frontier. Execute
+authorized preparation/selection, preserving pending handles, local cursors and
+protected validation windows. Reporting or creating a placeholder is not progress.
 
 Check [stop-conditions.md](stop-conditions.md) before advancing. Discard stale
 pass evidence after source edits. Re-read the selected source before each phase per [phase target binding](skill://devrites-lib/reference/parallel-workspaces.md#phase-target-binding). On a cold resume or
@@ -92,19 +90,14 @@ floor; `--update` never excuses an unreconciled regression.
 
 ## Sequence continuation
 
-Unless `continue_sequence: false`, while sequence budget remains
-([sentinel](skill://devrites-lib/reference/standards/afk-hitl.md#sequence-continuation-continue_sequence-max_workspaces)),
-step 10 does not end the run: leave the sealed workspace unshipped with its
-`Next step: /rite-ship`, then invoke the next recorded continuation
-(`/rite-spec <parent>-<n> "<objective>"` from the parent's `decisions.md` sequence)
-and re-enter step 1. Spend one workspace per opened continuation.
-
-For an already prepared child, do not re-specify. Follow
-[`parallel-workspaces.md`](skill://devrites-lib/reference/parallel-workspaces.md)
-while the owner is still running: honor claims, repair/re-Vet stale readiness,
-and admit only explicitly independent/dependency-satisfied isolated work.
-ACTIVE changes to the child only at normal ordered handoff after the owner Seal;
-resume its durable cursor without a second controller or another opening charge.
+With a recorded successor, opening budget and no opt-out, Seal GO stays internal:
+leave the owner sealed/unshipped with `/rite-ship`, then resume the prepared child
+or invoke its authorized native Spec. Sequence authority follows the
+[shared grammar](skill://devrites-lib/reference/workspace-artifact-schema.md#what-each-file-owns),
+not invented slugs. Charge an opening once; preparation may pipeline before Seal,
+one immediate successor per admitted source, not the whole roadmap at once.
+Reuse the child's durable cursor and controller. ACTIVE changes only at normal
+ordered handoff; early planning or isolated independent Build does not advance it.
 
 Before invoking a continuation, require durable `state.md`
 `sequence_workspaces_remaining > 0`; if absent, first write
@@ -158,18 +151,19 @@ and park it after three escalations while independent work continues.
 
 ## Continuous caller obligation
 
-Green slice/phase checkpoints consume their recorded `next_action` internally;
-only the caller replies finally at completion or a genuine stop.
-Before a reply, `devrites-engine check continuation` must print `continuation: clear`; `required` means invoke `invoke:` now.
-No user-facing reply is permitted while durable state contains agent-owned
-`NEEDS_REPLAN`, an intermediate Plan/Vet action, a distinct retained
-Critical/Important fingerprint below its cap or with an escalation left, runnable
-work independent of a parked fingerprint, or an open blocking question that
-already names a ranked recommended option. Invoke the next internal repair or
-`devrites-engine state resolve` immediately, unless that writer already hit the
-[resolver-failure stop](stop-conditions.md#other-stop-classes). **Failing case:**
-`state resolve` exits 1 on every call and the loop re-invokes it without end. A narrow reviewer closing one finding and exposing another
-Critical/Important invariant is progress, not exhaustion.
+After a green slice or phase, execute its recorded `next_action` internally;
+reply only at completion or a genuine stop.
+
+Before replying, run `devrites-engine check continuation`: `required` means
+consume `invoke:` now; only `clear` permits a final reply. Under controller mode,
+actionable normalization, successor preparation or foreign work precedes local
+Build. Local-only reconciliation, repair, picks or discharged scheduling deferrals
+retain the owning phase edge, not recursive `/rite-autocomplete`.
+Agent-owned NEEDS_REPLAN, budgeted Critical/Important recovery, independent work
+or a recommended blocking answer stays internal. Invoke repair or `state resolve`
+unless the [resolver-failure stop](stop-conditions.md#other-stop-classes) applies.
+A distinct invariant is progress, not exhaustion; repeated failed resolver calls
+without correction are not progress.
 
 The number of completed repair/Vet cycles, context pressure, compaction, session
 duration, and nested completion never turn checkpoints into handoffs. Persist and

package/pack/generated/omp/skills/rite-autocomplete/reference/stop-conditions.md

@@ -28,24 +28,27 @@ Fully escalated fingerprints park unless remaining owner is human.
 
 ## Not stops: internal technical routing
 
-AFK + `status=running` + an internal phase `next_action` is not a stop. `devrites-engine check continuation` prints `required` for that cursor and `clear` for `/rite-ship`, `awaiting_human`, a question cursor, or an open blocking or escalating question.
-
-`NEEDS_REPLAN` is not a stop condition under active Autocomplete. It blocks
-forward work, persists the return cursor, and invokes Plan repair plus Recovery
-Vet inline. The same applies to nested `STOP`/`Next step` when its decision is
-agent-owned.
-
-Agent-owned backtracking is not a stop condition while its exact causal
-fingerprint has budget: invoke earlier phase, affected Vet, remediation, proof;
-resume origin. Three no-progress corrections spend only that fingerprint's current
-strategy: escalate inline to the next class (shared root cause, diagnostic
-amplification, boundary redesign) with fresh budget, without permission. After
-three escalations per activation it parks; finish independent work, then stop once.
-Preserve reproduction, attempts, and dead ends; never offer `/rite-plan unblock`
-or another routine phase command. A new user-issued `/rite-autocomplete`
-reopens parked fingerprints with fresh escalation; wakes and compaction do not.
-Closure is progress; a separately evidenced Critical/Important invariant starts
-its own cap and cannot extend the closed one.
+For AFK `status=running`, consume an internal phase edge. In
+`mode: autocomplete`, actionable global normalization, preparation or foreign
+work takes priority over local Build; local-only picks do not recurse through
+Autocomplete. Source human/Ship holds remain binding, while independent
+authorized planning can continue. `clear` is reply permission, not Ship approval.
+
+A preparation refusal routes native work or a narrow disclosed scheduling
+deferral under the [global pass](skill://devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
+Deferral removes only its named scheduling obligation from repeated continuation:
+it neither makes a placeholder prepared nor waives readiness, malformed authority,
+claims, isolation, proof or human gates. Qualified foreign serial handoff is a
+separate rule. Revisit deferrals when their constraint changes.
+
+Agent-owned NEEDS_REPLAN or nested STOP persists the return cursor and invokes
+Plan repair, affected Recovery Vet, remediation and proof inline. Three
+no-progress corrections spend that fingerprint's strategy; escalate through
+shared root cause, diagnostic amplification and boundary redesign without asking.
+After three escalations, park it and finish independent work. Preserve attempts;
+resume through `/rite-autocomplete`, not a routine phase command. A new explicit
+invocation reopens parked fingerprints; wakes/compaction do not. Closure is
+progress; a distinct Critical/Important invariant gets its own cap.
 
 Spent consumptive-action authorization is not technical-recovery exhaustion.
 It blocks another execution; retained new Critical/Important evidence still
@@ -74,14 +77,10 @@ Without a safe seam, escalate or park; only a real human/risk/scope gate stops f
 - **Clarify:** material `open`/unowned decision coverage or a
   low-confidence high-consequence assumption. Continue the initial interview;
   never arm AFK early.
-- **Seal:** report remaining NO-GO with every blocker/fix direction; never round
-  up to GO. Resolve recommended-option blocking questions internally; recover
-  agent-owned findings and re-enter Seal. A first NO-GO is not a stop:
-  recover every agent-owned blocker (missing or unbound proof, a reviewer gap root
-  can close, a finding with a fix direction, a missing `review.md` verdict), then
-  re-enter Seal. The unattended `N` to accepting Important risks means repair, not
-  stop. Stop only for blockers that need a human: accepting a risk, changing scope
-  or an acceptance criterion, or access. Record each one as a question.
+- **Seal:** NO-GO never rounds up to GO. Recover agent-owned missing/unbound proof,
+  reviewer gaps and findings, then re-enter Seal; declining Important-risk
+  acceptance means repair. A human-owned risk, scope/acceptance change or access
+  blocker remains a question. A first repairable NO-GO is not a handoff.
 - **Reslice:** execute its marked action before deciding continue/stop.
 - **Slice budget:** do not stop on `--max-slices`. Leftover
   pre-existing remaining value, explicit flag, sentinel cap, or post-vet pending count
@@ -91,8 +90,9 @@ Without a safe seam, escalate or park; only a real human/risk/scope gate stops f
   another session blocks only work on those paths; run independent work, re-check,
   and stop only when nothing independent remains. `released`/`dead` claims are
   reconciled per [§ Cancellation](skill://devrites-lib/reference/parallel-dispatch.md#cancellation-and-terminal-reconciliation).
-- **Resource envelope:** overlapping run or missing AFK after arm still stops.
-  Do not stop on `--max-slices`, `max_agents`, `max_minutes`, or `max_review_queue`.
+- **Resource envelope:** overlapping controllers, missing AFK after arm or invalid/
+  duplicate mode fail closed. Ignored slice/agent/time/review ceilings do not stop
+  Autocomplete; mode itself grants no authority.
 - **Confidence:** intent still cannot become testable acceptance after interview.
 - **Repeated failure:** not a stop. Escalate; fully escalated fingerprints park.
   Stop only when no independent work remains.

package/pack/generated/omp/skills/rite-build/reference/parallel-batch.md

@@ -4,11 +4,11 @@
 
 Opt-in only. Default `/rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.md).
 
-Autocomplete runs `devrites-engine frontier <source>` and executes shared
-[`parallel-workspaces.md`](skill://devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier):
-it owns preparation, global admission and controller routing. Standalone Build
-stays source-local; frontier notices from `parallel select --from-plan` do not
-expand its picks. Autocomplete consumes `frontier-select-command`, then this lifecycle.
+Autocomplete executes the shared [global pass](skill://devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+before local writers: actual immediate-successor preparation or narrow disclosed
+deferral, then global cohort admission. Consume fresh dispatch-return scheduling.
+Standalone Build stays local; select notices never broaden its picks. A placeholder
+is not preparation; one successor pipelines safely without preparing the whole roadmap.
 
 ## Entry
 
@@ -17,13 +17,15 @@ expand its picks. Autocomplete consumes `frontier-select-command`, then this lif
 | omitted / `--parallel 1` | Serial one-slice |
 | `--parallel N` (**2≤N≤10**) | N is a **cap**, not a quota: run the largest eligible set ≤ N |
 | non-integer / `N≤0` / `N>10` | Hard refuse (no silent clamp) |
-| Autocomplete `--parallel N` | N is the cap for this run; leftover sentinel `max_parallel` is ignored, then `/rite-autocomplete` writes or replaces only `max_parallel: N` |
+| Autocomplete `--parallel N` | Global cap for this run; controller entry upserts mode and explicit capacity, preserving other AFK fields |
 | Autocomplete, no flag | Same path, cap from sentinel `max_parallel` else 10; serial only when ineligible |
 
 AFK caps `N`. Charge each green sibling once after its successful landing;
 rejected/unlanded work charges zero, without undoing prior landed accounting.
 `parallel create` refuses another retained repository controller.
-Reconcile retained repair-round artifacts by exact causal fingerprint before honoring a stored blocked status/verdict. Blocked status, round count, or distinct finding alone cannot stop cold resume: establish missing or stale review coverage under step 4; repair unless a stop condition remains evidenced.
+Cold resume reconciles retained repair artifacts by exact fingerprint. A blocked
+label, round count or distinct finding alone does not stop: establish current
+review coverage under step 4 and repair unless a genuine stop remains.
 
 ## Dynamic selection and re-batching
 
@@ -89,14 +91,14 @@ Before `parallel select`, add each slice's hidden write surfaces (list owner:
 snapshot directory, formatter sweep — and compare paths case-folded
 (`src/Api.ts` = `src/api.ts`); `--from-plan` adds the manifest/lockfile for a package.
 Slices colliding on either run serially; the rest
-stay eligible. Record `serial: <ids> — <surface>` in `evidence.md`. Under AFK
-with `max_parallel ≥ 2`, `dispatch open` refuses a build wright wave narrower
-than the from-plan batch until that wave holds the other picks or `serial:`
-names each skipped one. Repairing a slice, or a slice already in the lease,
-does not waive them. A `serial:` reason that only says the skipped slice is
-repairing, already started, or in a wave does not count. HITL is never refused. **Failing
-case:** two slices each add a dependency, run in parallel, and integrate fails or
-lands a broken lockfile.
+stay eligible. Record `serial: <ids> — <surface>` in `evidence.md`. AFK cap≥2
+refuses narrower Build-wright waves until other picks are started/reserved or
+each skipped pick has a substantive serial reason. Repairing/already-started/in-wave
+alone is not a reason. Controller admission also includes ready foreign picks:
+only exact `serial: child/SLICE-001 — <reason>` can defer that foreign lane; bare
+`SLICE-001` is local. Preparation `frontier-blocked:` cannot waive ready Build
+picks or safety gates. Qualified unsupported-isolation deferral preserves truthful
+owner dispatch/ordered handoff, never early same-tree foreign Build. HITL stays unchanged.
 
 ## Control vs workers
 

package/pack/generated/pi/skills/devrites-lib/reference/parallel-workspaces.md

@@ -12,65 +12,45 @@ candidate bindings and proof belong to that source. A missing source artifact
 routes its prerequisite; it never falls back to another workspace's artifacts.
 An explicit valid workspace does not require ACTIVE to name it or to exist.
 
-Carry that source through Spec → Clarify → Temper → Define/Plan → Vet and later
-Build/Converge/Prove/Polish/Review/Seal/Ship entrypoints. Use existing slug arguments
-where supported, including `context <source>` and `handoff <source> --resume`.
-For qid-only `state resolve` (including `--drop`/`--batch`), keep its existing argv
-and bind the call with `DEVRITES_ROOT=<absolute-control>/.devrites` and
-`DEVRITES_WORKSPACE=<absolute-control>/.devrites/work/<source>`. The override is a
-workspace path, not a slug. Apply this environment only to that invocation;
-neither a fabricated resolver slug argument nor process-global environment
-mutation is routing. Use the same source binding for nested recommended answers.
-
-Preparing or running an admitted future source preserves the ordered owner's
-ACTIVE and retained writer/controller. Ordinary standalone Spec still sets ACTIVE;
-explicit `--lookahead` still stops at planning/Vet and never becomes a Build root.
+Carry SOURCE through every phase, nested resolution and cold handoff. Use existing
+slug arguments (`context <source>`, `handoff <source> --resume`). Qid-only
+`state resolve` retains its argv: bind only that invocation's `DEVRITES_ROOT` and
+`DEVRITES_WORKSPACE` as above, never a fabricated resolver slug or process-global
+change. Early future work preserves ACTIVE and the retained controller.
+Standalone Spec still sets ACTIVE; `--lookahead` remains planning/Vet-only.
 Target binding changes neither phase approval nor Ship authority.
 
 ## Authority and admission
 
-Resolve one controlling root and ordered lifecycle owner. `.devrites/ACTIVE` stays
-on that owner until normal sequence handoff; scheduling a future slice does not
-advance ACTIVE or create a second Build root. One repository-global lease owns
-control-tip mutations. Resume its controller, source identities and retained
-handles before admitting more work; status queried via ACTIVE/source reports the
-actual retained controller even after ordered handoff. Another retained
-controller is not bypassable; no extra cursor pointer is needed.
-
-The existing `--parallel N` is one global active-writer cap, not a target guarantee:
-explicit invocation value, else AFK `max_parallel`, else retained lease capacity
-on resume, else 10. Explicit 1 means one writer, not one writer per workspace.
-Review queues obey host capacity and existing reviewer caps separately; neither
-capacity nor a Reslice cap waiver waives required named-role fanout or proof gates.
-
-Use the engine frontier below for recorded source-related sequence membership.
-Honor `continue_sequence: false`, opening budget and human bounded requests.
-Charge each opening once; reuse prepared children and their cursor.
-Unrelated directories or user-mentioned slugs are not automatic enrollment.
-Respect workspace claims: a live lookahead owner retains its artifacts until
-release/terminal reconciliation. Root alone writes workspace artifacts; leaves
-never write `.devrites/**`.
-
-For each future slice, native Plan/Vet must have CURRENT approved readiness,
-a complete bound contract and explicit `Workspace dependencies` under
-[canonical slice grammar](workspace-artifact-schema.md#canonical-slice-grammar).
-Plan/Vet checks assumptions, consumed interfaces, shared runtime resources and
-independent slice proof. `none` is a native declaration, never an inference from
-path disjointness, local `Dependencies: none`, planning digests or a green branch.
-Only durably BUILT/integrated producer checkpoints satisfy qualified dependencies;
-validate each producer reference and graph, including safely archived predecessors.
-Cycles, unknown/malformed references and shared unisolated runtime withhold unsafe
-candidates. A waiting producer withholds only its consumers, not unrelated work.
-
-Missing declarations in legacy future plans need narrow Plan repair + affected
-Vet before early admission; existing local/standalone plans remain valid. Absent,
-incomplete, stale or human-blocked future work is a planning/repair/blocked
-opportunity, not a fatal pool failure. Retain every readiness reason: fixing stale
-bindings does not waive a coexisting human/access/safety gate. Re-Vet affected
-predecessor assumptions, then record current bindings; never auto-refresh a digest.
-Read archived predecessors in place through the engine's referenced read-only
-readiness lookup. Never copy an archive into live `work/` merely to read/hash it:
-that can resurrect stale controller leases and claims.
+Keep ACTIVE on the ordered owner until normal handoff. One repository-global
+lease owns control-tip mutations; recover its controller, source identities and
+handles before more admission, including after handoff. No second Build root.
+`--parallel N` caps active writers globally: explicit N, else AFK `max_parallel`,
+else retained capacity on resume, else 10. One means one writer total. Review
+queues retain host/reviewer caps; capacity or Reslice never waives fanout or proof.
+
+Only checked source-related sequence membership qualifies; user-mentioned or
+unrelated directories are not enrollment. Current canonical `roadmap.md` follows
+[the grammar](workspace-artifact-schema.md#what-each-file-owns): one related live/
+archived owner, actual chain root, same-owner unique decision and contiguous
+position table. It supersedes historical tables for scheduling without rewriting
+them. Invalid canonical authority fails closed; absence retains conservative
+legacy resolution. Honor opt-out, opening budgets and human bounds; charge each
+opening once. Lookahead claims retain artifacts through terminal reconciliation.
+Root alone writes workspace artifacts; leaves never write `.devrites/**`.
+
+Native Plan/Vet must bind CURRENT readiness, contract, producer assumptions and
+explicit future `Workspace dependencies` per [slice grammar](workspace-artifact-schema.md#canonical-slice-grammar).
+`none` is a native declaration, not an inference from paths, local dependencies,
+digests or green branches. Only durable BUILT/integrated checkpoints satisfy
+validated producer references/graphs, including safely archived predecessors.
+Unknown references, cycles and shared unisolated runtime withhold unsafe slices;
+waiting producers withhold consumers, not independent work. Legacy future plans
+need narrow Plan repair/affected Vet; standalone/local plans retain their rules.
+Per-slice withheld diagnostics do not block other returned eligible IDs;
+workspace-wide readiness failures still withhold the source.
+Preserve coexisting stale-readiness and human/access/safety reasons. Re-Vet changed
+assumptions; never auto-refresh digests or copy archives into live `work/`.
 
 ## Recover avoidable serialization
 
@@ -108,66 +88,77 @@ reslicing unchanged work.
 
 ## Continuous global frontier
 
-Autocomplete executes this bounded pass at every phase entry (including cold
-Prove/Vet/Review), before phase-local recovery, on each landing/planning/review
-return, and immediately before a native wait or final reply. A nested phase
-returns scheduling to Autocomplete; its source-local phase/recovery return cursor
-and pending native reviewer handles remain intact. This is not a second phase
-controller or a persistent frontier artifact.
-
-1. Run `devrites-engine frontier <source>` before local recovery or selection.
-   This read-only report names the related pool, preparation/repair actions and
-   blockers; it neither authorizes work nor changes the source's local cursor.
-   For `frontier-prepare` and `frontier-workspace` prepare/repair actions, execute
-   authorized native Spec → Clarify → Temper → Define/Plan → affected Vet now,
-   not after owner Seal. Check source gates, claims and planning/Build restrictions.
-   For `frontier-review-sequence`, read the named approved roadmap/artifacts:
-   native authority normalization must record the exact continuation through its
-   owning decision/phase before rerunning frontier. Ambiguous legacy prose,
-   positive remaining budget and path disjointness never imply permission.
-   Retain unresolved authority blockers; continue independent authorized work.
-   Owner-local red/human/access gates withhold that owner and actual consumers;
-   whole-run safety/access/claim constraints still bind. Record actions/blockers
-   in existing source artifacts under normal write authority.
-   Yield children at pending reviewer/phase boundaries; reconcile available
-   parent returns before another pass. Reporting actions or reading phase skills
-   is not executing preparation/Vet. Wait only after authorized actions across
-   the pool have run or reached concrete pending handles/blockers.
-2. Reconcile explicit/AFK capacity changes with
-   `parallel add --root <repo> --slug <controller> --cap N --json -`, stdin `[]`.
-   This changes capacity only. Below active count, pause admissions, drain and
-   retry; never cancel workers to meet a lower cap. Recover a pending recorded
-   landing before admission; unrelated HEAD/ref movement remains blocked.
-   Rerun frontier after preparation/repair or capacity changes. Execute returned
-   `frontier-select-command` with only authorized live `--workspaces`: this exact
-   candidate list includes the `--slug` controller only when eligible. This is
-   internal, not a new user flag. `frontier: none` retains source-local routing.
-   Source-local `parallel select --from-plan` notices neither select globally nor
-   expand picks. Route notices to their source; running slots/paths seed mixed
-   selection globally. Zero picks with live writers means continue planning/review
-   or wait, not Prove for unfinished sources.
-3. Preflight selected slices against their SOURCE workspace with Build's normal
-   slice/readiness/precondition, exact-path and runtime-isolation gates. Early
-   foreign Build always uses isolated workers. For cap>1 on a capable host,
-   isolate even the first lone local writer, so later sources can refill. Persist
-   `--cap N` on create/add. With a retained lease, add even one pick; a complete
-   retained lease can reopen only at unchanged control tip. After cleanup,
-   create a new batch from current control. Never start another controller.
-   Unsupported isolation uses truthful serial owner dispatch and ordinary ordered
-   handoff, never early same-tree foreign Build or concurrent same-worktree writers.
-4. Launch every selected native writer before waiting on any; keep scheduling
-   planning and independent review while they run, including while the owner
-   awaits Prove/Vet/Review accounts. Apply the protected window below before any
-   landing: defer control mutations while frozen validation is pending. Outside
-   that window, land each individually green sibling through Build review/proof
-   and `parallel integrate --slice <key>`; refill immediately from the whole pool.
-   A red or `integrate-failed` sibling retains its slot/paths for repair; it does
-   not halt independent safe landings/refill. A pending landing intent still
-   requires exact recovery above. Only durable integration satisfies producer edges.
-   After worker-bound review/proof and source bookkeeping finish, prune only
-   verified clean integrated checkouts with `parallel prune --root <repo>
-   --slug <controller>`. Retain transfer refs/lease identities; dirty or ignored
-   data stays with its reported recovery path and does not justify forced deletion.
+Run this pass at phase entry, before local recovery/waits/reply, and after landing
+or planning changes. A persisted `dispatch return` emits fresh scheduling after
+locks release, even when later claim release fails: retain the nonzero failure
+and claim exclusion. Exact successful claim reconciliation also refreshes;
+rejected/unpersisted returns do not. Ordinary status stays read-only. Keep local
+return cursors and native handles: one controller, not another phase or queue.
+
+1. Read `devrites-engine frontier <source>`, then its selected `frontier-authority`
+   paths before preparation. Follow the actual owner/decision, including archives;
+   local phase context is not a reason to create a second owner. Execute native actions.
+   Normalize unresolved legacy sequence authority through its owning decision/
+   phase. Positive budget, ambiguous prose or path disjointness grants nothing.
+   A current invalid canonical map is an error, never a fallback to history.
+   For controller mode at cap>1, before a new Build-wright wave writes claims,
+   rounds or history, start preparation of that source's immediate recorded
+   successor. Missing targets need native Spec → Clarify → Temper → Define/Plan →
+   affected Vet; existing targets need completed native state, actual pending
+   planning/review handles, current Build-ready binding, or a human/dependency hold.
+   Completed live/archived successors need no reopening; retained actors still bind.
+   A placeholder, prose claim, unopened wave or unrelated reviewer is insufficient.
+   Pipeline one successor per admitted source; preparing the whole roadmap first
+   is unnecessary. Opt-out, zero opening budget or source human/question holds
+   prevent new openings, not already-created child planning or independent work.
+   If preparation cannot start, retain `frontier-blocked: <successor> — <constraint>`
+   in source `evidence.md`. `frontier-blocked: sequence — <constraint>` may defer
+   unresolved historical normalization for valid independent local work. Each row
+   names one concrete native-reviewed constraint; keep it visible and revisit on
+   change. It discharges only that scheduling obligation, not readiness, malformed
+   canonical/AFK data, paths, claims, isolation, proof or human gates. It cannot
+   waive already-ready foreign picks or certify preparation/normalization.
+2. Reconcile explicit/AFK capacity via `parallel add --root <repo> --slug
+   <controller> --cap N --json -`, stdin `[]`. Below occupied count, freeze every
+   new launch, even reserved waves; reconcile/drain and retry without cancelling.
+   Recover recorded landing intent; unrelated HEAD/ref movement
+   stays blocked. Rerun frontier after changes and execute its exact authorized
+   `frontier-select-command`. Local select notices do not broaden picks. Existing
+   global slots and paths seed selection; reserve the mixed cohort in create/add
+   before separate source-local wave opens. Reservations assemble width, never
+   prove actor checkout/start. Ready foreign picks cannot disappear behind local
+   `serial:` records. A foreign deferral is exactly
+   `serial: child/SLICE-001 — <reason>` in source evidence; bare `SLICE-001` is local.
+   Substantive-reason rules apply; native workflow judges the constraint.
+   Re-evaluate owning serial rows when constraints change; engine checks exact
+   scope, not the truth of a host/resource claim.
+   Discharged deferrals are not repeatedly actionable. Foreign work/preparation
+   and authority normalization precede local Build; local-only reconciliation,
+   repair and picks retain their owning phase, not recursive Autocomplete.
+   Zero picks with live writers means planning/wait, not premature Prove.
+3. Apply SOURCE Build readiness/preconditions, exact paths and runtime isolation.
+   Early foreign Build always uses isolated workers. On a capable host at cap>1,
+   isolate even the first local writer for later refill; persist `--cap N`.
+   Add one pick to a retained lease; reopen a complete lease only at unchanged
+   control tip, or create from current control after cleanup. Unsupported
+   isolation uses qualified serial deferral, truthful local-owner dispatch and
+   ordinary ordered handoff, never early same-tree foreign/concurrent writers.
+   New dispatch accounts retain opaque `controller_batch` and immutable per-slice
+   normalized `admitted_paths`. Retain only each pending writer's lane; returned/
+   integrated siblings may release slots for rolling refill. Missing snapshots or
+   changed lease paths require actor reconciliation, never backfill from new tasks.
+   Exact claim identity/session still matters; release/expiry does not stop an actor.
+   Same-session claims allocate space, not extra write authority. None of these
+   records proves actual cwd/profile: verify through the native host.
+4. Start every selected native writer before waiting; continue independent native
+   planning/review while they run. Protected validation defers unsafe landings,
+   not independent preparation. Outside that window, land individually green
+   siblings through Build review/proof and `parallel integrate --slice <key>`;
+   refill globally. Red/integrate-failed siblings keep slots/paths for repair.
+   Durable integration alone satisfies producer edges. After worker-bound
+   accounts and source bookkeeping settle, `parallel prune --root <repo> --slug
+   <controller>` removes only verified clean integrated checkouts, retaining
+   transfer refs/lease identities. Dirty/ignored data keeps its recovery path.
 
 ## Identity, dispatch and proof