devrites 7.3.4 → 7.3.5

package/pack/generated/codex/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -51,6 +51,7 @@ time. No `state.md` run-mode field can drift out of sync.
 Presence = AFK active. The file body is optional YAML:
 
 ```yaml
+mode: autocomplete # optional controller identity; absent = standalone AFK
 max_slices: 10 # whole-workspace writer budget; seeds state.md remaining count
 max_agents: 32                       # native agent dispatches in one host activation
 max_minutes: 120                     # min; $rite-autocomplete: not a ceiling
@@ -61,10 +62,13 @@ notify: 'curl -fsS -m 10 -d "$DEVRITES_QID: $DEVRITES_QUESTION" ntfy.sh/my-topic
 allow_gates: [advisory, validating]  # gate severities AFK auto-handles (auto-picks the recommended option)
 continue_sequence: true              # after Seal GO, open the next recorded continuation
 max_workspaces: 5                    # workspaces one armed sequence may open
-max_parallel: 10 # unattended default cap; `--parallel N` on this invocation wins and may rewrite only this field
+max_parallel: 10 # global writer cap; explicit --parallel N wins
 ```
 
-The file is **read-only config**: never rewritten in place, except `$rite-autocomplete --parallel N` writes or replaces only `max_parallel: N`.
+AFK is read-only after entry. Explicit `$rite-autocomplete` upserts only
+`mode: autocomplete` and, with `--parallel N`, `max_parallel: N`; preserve other
+fields. Missing mode keeps standalone behavior; invalid/duplicate mode fails
+closed. Mode identifies scheduling, never grants phase, safety or Git authority.
 
 Outside active `$rite-autocomplete`, the following slice-budget rules apply:
 `max_slices` seeds root-owned `state.md` cursor `afk_slices_remaining`
@@ -103,10 +107,9 @@ malformed values fail closed; `0` opens nothing.
 candidate manifest to cover the whole recorded chain — run
 `devrites-engine state merge-manifest <slug>` before Prove.
 
-- Only continuations recorded in the parent's `decisions.md` sequence
-  ([slicing.md § Continuation workspaces](../../../rite-plan/reference/slicing.md#continuation-workspaces))
-  qualify; no next entry or exhausted `max_workspaces` stops with that reason. The review-queue bound applies only outside active
-  `$rite-autocomplete`.
+- Only checked recorded continuations qualify, under the
+  [sequence grammar](../workspace-artifact-schema.md#what-each-file-owns).
+  No next entry or opening budget stops new openings, not existing child work.
 - Milestones are **not** shipped: they stay sealed and unarchived in `.devrites/work/`
   with `Next step: $rite-ship` preserved. Local `WIP(<slug>):` checkpoints still
   land ([checkpoint.md](../../../rite-build/reference/checkpoint.md)), so the tree
@@ -118,15 +121,13 @@ candidate manifest to cover the whole recorded chain — run
   `$rite-autocomplete` recovers agent-owned Seal `NO-GO` per
   [stop-conditions.md](../../../rite-autocomplete/reference/stop-conditions.md), not a handoff.
 
-`max_parallel` is the unattended default writer cap when this invocation omits
-`--parallel N`; explicit N wins and Autocomplete writes/replaces only that field.
-Build's explicit flag wins without rewriting the sentinel. Never write
-`max_slices` from `--max-slices`. Autocomplete uses one cap across all authorized
-sources, including explicit 1, under the shared root-only
-[`workspace controller`](../parallel-workspaces.md); standalone Build stays local.
-Unattended runs recompute after each landing and planning/review return, not only
-after a batch completes. **Failing case:** `$rite-autocomplete --parallel 5`
-honors leftover `max_parallel: 1`, or grants five writers per workspace.
+`--parallel N` wins over AFK `max_parallel`, else retained lease capacity on
+resume, else 10. Build's flag never rewrites AFK; explicit controller entry may
+update only mode/capacity. One cap covers all admitted sources, even explicit 1;
+standalone Build stays local. Follow the [global pass](../parallel-workspaces.md#continuous-global-frontier)
+for immediate-successor preparation, narrow `frontier-blocked` deferrals,
+qualified foreign `serial:` handoff and automatic dispatch-return scheduling.
+These are scheduling disclosures, never readiness, isolation, proof or Ship waivers.
 
 ## Unattended resource envelope
 
@@ -157,8 +158,8 @@ applicable remaining limit. Agent/time/token/cost counters are per native activa
 for a new activation. Slice/recovery state and review queue remain durable/recomputed across wakes.
 Persist stops/checkpoints before notification.
 
-New sentinels omit `expires_at` and notification/token/cost caps. Post-Vet pending
-count may lower standalone slices. Never add missing defaults to existing files.
+Fresh AFK omits expiry and notification/token/cost caps. Standalone post-Vet
+counts may lower slices; preserve existing fields except controller entry above.
 
 Delete the file to restore HITL on the next invocation.
 

package/pack/generated/codex/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -1,10 +1,9 @@
 # Workspace artifact schema
 
 Feature truth: `.devrites/work/<slug>/`, discovered by `state.md`; remnants/archives
-are inactive. Spec writes optional `README.md`. Use canonical filenames; both released
-cursor forms remain readable, but a cursor with no `schema` row needs
-`devrites-engine migrate <slug>` before the engine accepts it. `$rite-upgrade` audits
-without path/alias/format migration.
+inactive. Spec's `README.md` is optional. Use canonical filenames. Both released
+cursors read; no `schema` requires `devrites-engine migrate <slug>`.
+`$rite-upgrade`: audit only, no path/alias/format migration.
 
 ## Contents
 
@@ -59,6 +58,7 @@ accept safe legacy basenames. Ordinary phases never rename them.
 | `visual/<name>.outline.md` | required machine dual-read companion for the sibling HTML; outline wins on conflict; never a candidate path | 200 lines (advisory; not gate-checked) |
 | `visual/README.md` | optional index of visuals in the workspace | 80 lines (advisory; not gate-checked) |
 | `decisions.md` | ADR-style `DEC-###` log: status, context, options, decision, consequences, related IDs; optional `Files:`/`Tags:` fields make entries queryable by path or theme; Build's `## Carry-forward constraints` lines (rule, source slice, evidence, `Files:`) | 200 lines |
+| `roadmap.md` | optional sequence authority (below); headerless maps stay legacy | — |
 | `assumptions.md` | assumptions with confidence, owner, validation status | 160 lines |
 | `questions.md` | current `q-YYYY-MM-DD-NNN` (or released `Q-###`) open/resolved questions, gate, answer, impact | 180 lines |
 | `plan.md` | technical approach, slice strategy, canonical shared-contract proof, validation strategy, rollback | 220 lines |
@@ -85,6 +85,17 @@ accept safe legacy basenames. Ordinary phases never rename them.
 For visual pairs load only matching [playbooks](visual-playbooks/index.md); use
 the [required outline headings](visual-playbooks/outline-template.md).
 
+Canonical `roadmap.md`: either header claims explicit authority; require both
+`Sequence root: <actual-anchor-slug>` and `Decision: DEC-NNN`, identifying one
+`## DEC-NNN` in owner-local `decisions.md`. One related live/archive owner, one
+`Position`/`Workspace` table: contiguous from 1, unique valid slugs matching all
+related positions/exact successors; no unenrolled nodes. Valid authority supersedes
+history for scheduling; preserve historical bytes. Headerless maps remain legacy.
+Partial/malformed headers, multiple owners, invalid root/decision/table, symlink
+or unreadable maps fail closed, no fallback. Native normalization records approved
+actual identities, preserves history. Engine identity checks grant no semantic
+approval, independence, Build or Ship readiness.
+
 ## Candidate manifest and bindings
 
 `touched-files.md` contains exactly one `## Touched files` heading and exactly
@@ -141,40 +152,32 @@ The worktree digest is deterministic but is not an atomic filesystem snapshot
 against a malicious concurrent same-size rewrite. Ship's exact Git-index scope,
 byte, binding, and secret checks own the final freeze immediately before commit.
 
-Only a structural `Budget override: <=N lines; <reason>` line (not a fenced example)
-permits excess, up to N lines and N×400 bytes with N at most 2× the line budget; a
-reason-only override counts as none. Each line budget also bounds bytes at 400 bytes
-per budgeted line (`state.md` 120 lines → 48 KiB); long lines do not evade it. `orient`
-reports `artifact_budgets` (lines/bytes/over/override) and `bulk_files` (non-canonical
-files over 64 KiB) so a phase can decide what to read before loading; phase writers
-check these limits before returning, with no repository-local script assumption.
-
-`check readiness`, `check seal` and `state append` enforce the material band: any present
-budgeted artifact (required or not, `drift.md` included) at or above 1.5× its line or
-byte budget with no covering override blocks with the exact measurement and three legal
-remedies (relocate history losslessly via `$rite-plan revise`, split via `$rite-plan
-course-correct`, or record the bounded override). Past 2× only relocation or split remain.
-Overshoot below that band stays advisory and is reported by `orient`. Proof ledgers
-(`evidence.md`, `browser-evidence.md`, `touched-files.md`) are always advisory: they
-scale with proof volume, and `touched-files.md` keeps its own manifest limits.
-Because they are never gate-blocked they are also the only artifacts that can grow
-unboundedly — so phases read them by index, not whole-file: the standalone binding
-line, a `EVID-###`/section-header index (`grep -n`), then bodies only for entries
-naming this candidate's AC/slice IDs. An entry naming no in-scope ID is anomaly
-evidence to inspect, not skip. A whole-file read is allowed only when `orient`
-reports the artifact within budget; completeness for seal is engine-checked
-(literal `AC-###` presence), the reader judges quality.
-
-Two reasons are not durable fixes: slice or acceptance-criteria count (an over-budget
-`tasks.md`/`plan.md`/`traceability.md` from decomposition size is a
-[feature-sequence split](../../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget)),
-and history in `state.md` (checkpoint narrative moves verbatim to
-`history/<file>-<YYYYMMDD>.md`, append-only, never a phase read-next, with a one-line
-pointer left behind). A legacy reason-only `Budget override:` line no longer clears a
-gate; `$rite-upgrade` routes it to relocation or the split, and new writers never create one for those two reasons.
-Apply [[`context-hygiene.md`](standards/context-hygiene.md) dispatch packets](standards/context-hygiene.md#dispatch-packets)
-for byte-size checks and lossless retrieval; budget overrides neither rewrite protected
-history nor require loading it all.
+Only structural `Budget override: <=N lines; <reason>` outside fences permits N
+lines/N×400 bytes, N ≤ 2× budget. Reason-only overrides count as none. Budgets:
+400 bytes/line (`state.md`: 120 lines/48 KiB); long lines cannot evade them.
+`orient`: `artifact_budgets` (lines/bytes/over/override), `bulk_files` (non-canonical
+files >64 KiB). Writers check limits before returning; no local script assumed.
+
+`check readiness`/`check seal`/`state append` block present budgeted artifacts
+(optional/`drift.md` included) at ≥1.5× lines or bytes without covering override.
+Report exact measurement and remedies: lossless relocation (`$rite-plan revise`),
+split (`$rite-plan course-correct`), bounded override. Past 2×: relocation/split
+only; below 1.5×: advisory in `orient`.
+Proof ledgers (`evidence.md`, `browser-evidence.md`, `touched-files.md`) alone may
+grow unbounded, always advisory; manifest limits still apply. Read standalone
+binding, `EVID-###`/section index (`grep -n`), then candidate AC/slice bodies.
+Inspect no-in-scope-ID entries as anomalies. Whole-file reads require `orient`
+within budget; Seal checks literal `AC-###` completeness, reader judges quality.
+
+Slice/AC count and cursor history never justify durable overrides. Decomposition
+overflow (`tasks.md`/`plan.md`/`traceability.md`) requires a
+[feature-sequence split](../../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget).
+Move `state.md` narrative verbatim to append-only `history/<file>-<YYYYMMDD>.md`;
+leave a one-line pointer; history never enters phase read-next. Legacy reason-only
+overrides cannot clear gates: `$rite-upgrade` routes relocation/split; new writers
+never override these reasons. Use
+[dispatch packets](standards/context-hygiene.md#dispatch-packets)
+for byte checks/lossless retrieval. Overrides neither rewrite nor require loading protected history.
 
 ## Anchored notes
 

package/pack/generated/codex/skills/rite-autocomplete/SKILL.md

@@ -86,48 +86,43 @@ With `--lookahead` (trigger `lookahead`), follow
 [`lookahead.md`](reference/lookahead.md) instead of the steps below: plan the
 next sequence continuation through Vet in a second session, then stop.
 
-1. **Orient and parse.** Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding); when a workspace exists,
-   require its `state.md` and read its cursor; a fresh idea starts empty at step 2.
-   After normalizing arguments below, run `devrites-engine frontier <source>`
-   before phase-local cold recovery; execute its actions under the shared
-   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
-   Before honoring `blocked` with terminal `next_action`,
-   reconcile retained consumptive evidence and fingerprint attempts from
-   `drift.md`/`evidence.md`; a retained fingerprint below its cap resumes offline
-   recovery, and this new invocation reopens each parked fingerprint.
+1. **Orient and parse.** Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding).
+   Read its existing cursor; a fresh idea starts empty at step 2. Normalize this
+   invocation to idea, `ship_preflight: yes|no`, `max_slices: unlimited`,
+   `parallel: N|default`, `profile: standard|full`, `cross_model: yes|no`.
+   Apply the loop's [AFK contract](reference/loop.md#arm-afk-once) to an existing
+   sentinel: upsert `mode: autocomplete`, plus capacity only for explicit
+   `--parallel N`. Mode identifies this controller, never grants authority.
+   Run `devrites-engine frontier <source>` before local recovery; execute the
+   [global pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
+   Reconcile blocked/terminal cursors against retained action evidence and exact
+   fingerprint attempts; resume offline recovery below its cap. This explicit
+   invocation reopens parked fingerprints. Reconstruct missing return cursors
+   only from the current phase and approved `test-plan.md`/evidence action.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"lifecycle cursor encounters admitted set or resumable journal","action":"invoke classifier; execute returned route internally","return":"saved phase/action; zero intermediate reply"} -->
-   Reconstruct a missing return cursor only from
-   the current phase and exact approved action in `test-plan.md`/evidence, never
-   from chat. After compaction or a resumed session, always run `devrites-engine
-   handoff <source> --resume` first for that selected source and open only the
-   `read_next` artifacts it names, per [`context-hygiene.md`](../devrites-lib/reference/standards/context-hygiene.md) § Compaction fallback.
-   Normalize current arguments to idea, `ship_preflight: yes|no`,
-   `max_slices: unlimited`, `parallel: N|default`, `profile: standard|full`,
-   and `cross_model: yes|no`.
-   **Completion:** arguments and source authority are unambiguous; local cursor and pending handles remain intact.
+   After compaction/resume, run `devrites-engine handoff <source> --resume`
+   and open its `read_next` artifacts per [context hygiene](../devrites-lib/reference/standards/context-hygiene.md).
+   **Completion:** arguments/source are unambiguous; local cursor and handles survive.
 2. **Specify and clarify.** Run `devrites-interview`, `$rite-spec`, and
    `$rite-clarify` as one window. `open` material coverage never arms
    AFK. **Completion:** `Decision coverage: CLEAR` is durable.
-3. **Arm AFK once.** Apply the loop's
-   [one-write AFK contract](reference/loop.md#arm-afk-once): preserve valid
-   existing bytes or create the sentinel once (`allow_gates: [advisory, validating]`); never
-   rewrite it after Vet except to write or replace only `max_parallel: N` when
-   this invocation contains `--parallel N`. Preserve an existing sentinel
-   byte-for-byte otherwise. **Failing case:** leftover `max_parallel: 1` keeps
-   the run serial after `--parallel 5`.
-   **Completion:** a valid read-only AFK sentinel exists.
-4. **Drive phases.** Follow [the loop](reference/loop.md): `$rite-spec` →
-   `$rite-clarify` → `$rite-temper` → `$rite-define` → `$rite-vet` →
-   `$rite-build` batch loop → `$rite-prove` → `$rite-polish` →
-   `$rite-review` → `$rite-seal`. Read and execute each skill; durable files, not
-   chat, carry state. Apply the mutable post-vet budget before first Build.
-   Run `devrites-engine frontier <source>` at phase entry, before recovery,
-   on returns and before native waits; execute the shared
-   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier),
-   not merely its report. Autocomplete retains repository scheduling and local
-   cursors. Apply its protected validation window and pass resolved `--parallel N`
-   to Build under the same global cap and admission/isolation gates.
-   **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
+3. **Arm AFK once.** Apply the [one-write AFK contract](reference/loop.md#arm-afk-once):
+   create only after clarity; explicit controller entry upserts
+   `mode: autocomplete` and, only with `--parallel N`, `max_parallel: N`.
+   Preserve all other fields; reject malformed/duplicate mode rather than
+   silently becoming standalone AFK. **Completion:** valid controller identity
+   and capacity are durable; no gate or Git authority changed.
+   **Failing case:** leftover `max_parallel: 1` after explicit `--parallel 5`.
+4. **Drive phases.** Execute [the loop](reference/loop.md): Spec → Clarify →
+   Temper → Define → Vet → Build → Prove → Polish → Review → Seal. Durable files
+   carry state. Apply the mutable post-vet budget before Build. Consume fresh scheduling
+   emitted by recorded `dispatch return`; rerun frontier after further changes
+   and before waits. Start actual immediate-successor preparation before local
+   writer admission, or disclose the narrow deferral in the shared global pass.
+   A placeholder or report is not preparation; the entire sequence need not be
+   prepared at once. Preserve local cursors and protected validation windows;
+   pass Build the resolved global cap and retain every admission/isolation gate.
+   **Completion:** Seal GO or a durable valid stop precedes later phases.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:
    route agent-owned red results through bounded recovery.

package/pack/generated/codex/skills/rite-autocomplete/reference/loop.md

@@ -12,6 +12,7 @@ Autocomplete chains existing `/rite-*` workflows without routine-phase pauses. A
 ## Arm AFK once
 
 ```yaml
+mode: autocomplete
 allow_gates: [advisory, validating]
 # max_slices / max_agents / max_minutes / max_review_queue omitted: unlimited
 # continue_sequence: false         # opt out; default chains after Seal GO
@@ -22,18 +23,15 @@ allow_gates: [advisory, validating]
 # notify: "<cmd>"
 ```
 
-Read existing sentinel first. Preserve valid bytes, except
-when this invocation contains `--parallel N`: then write or replace only
-`max_parallel: N` and leave every other key unchanged. Stop if the sentinel is
-malformed. Do not stop because it names `max_slices` / `max_agents` /
-`max_minutes` / `max_review_queue` or only `[advisory]`. If absent, write it
-once after clarity, and include `max_parallel: N` when that flag is present.
-Without the flag, seed a newly created sentinel from retained global lease capacity
-when present; otherwise use fresh-run default 10. Never replace a valid existing
-sentinel's capacity from lease/default. Never write `max_slices` from `--max-slices`.
-It is otherwise read-only: never rewrite it after Vet or reset it on resume. Leftover `expires_at` is ignored
-and never rewritten. **Failing case:** leftover `max_parallel: 1` keeps the run
-serial after `--parallel 5`.
+Read existing AFK first. On each explicit Autocomplete invocation, upsert only
+`mode: autocomplete` and, if supplied, `max_parallel: N`; preserve other fields.
+Missing mode retains standalone AFK behavior until that explicit entry. Invalid
+or duplicate mode fails closed; mode grants neither phase nor action authority.
+If absent, create AFK after clarity with the mode above; capacity is explicit N,
+else retained global lease capacity, else 10. Preserve existing capacity without
+the flag. Nested phases/wakes leave AFK unchanged: no `max_slices` flag seeding,
+expiry rewrite or reset. Legacy slice/agent/time/review limits do not stop this
+controller. **Failing case:** `--parallel 5` retains `max_parallel: 1`.
 
 ### Derive the mutable post-vet budget
 
@@ -43,15 +41,15 @@ remaining. AFK configuration itself stays unchanged.
 
 ### Admit each unattended cycle
 
-Before each phase, review fan-out, recovery, or writer dispatch: cheapest
-readiness check first; reject overlap. Do not stop on `max_agents`,
-`max_minutes`, or `max_review_queue`. Count every leaf result. New activations reset activation-local counters, retaining durable slice/recovery state.
-
-[Build return](../../rite-build/reference/output.md#caller-owned-continuation).
-Pass `--parallel N`; ignore leftover cap/headroom, remaining-0,
-and `--max-slices` stops. Agent-invented dispatch, wait, tool-call, or turn budgets are not stop conditions.
-An explicit human request to pause or run only a bounded subset still wins.
-Path collisions serialize work; they do not end the run.
+Before each phase, fan-out, recovery or writer: run cheap readiness and reject
+overlap. Before Build admission, execute the shared immediate-successor
+preparation/deferral and global cohort rules; local readiness alone is insufficient.
+Count every leaf result. Explicit activations reset activation-local counters,
+not durable slice/recovery state. Pass resolved `--parallel N` to
+[Build](../../rite-build/reference/output.md#caller-owned-continuation).
+Ignored legacy budgets and local serial constraints are not whole-run stops.
+Invented ceilings on dispatches, waits, tool calls or turns cannot stop execution;
+human instructions to pause or limit scope still bind.
 Resolve ranked validating/blocking picks via `devrites-engine state resolve`;
 never hand `$rite-resolve` to the user. Escalating, irreversible-risk, access, blocking
 without recommendations, and Seal judgment (`slice: seal`) still pause.
@@ -74,12 +72,12 @@ Workspace files, not chat, carry state. Read/execute each phase skill:
 | 10 | `$rite-seal` | GO/NO-GO; no Git |
 | 11 | `$rite-ship` | only after GO; `--ship` never authorizes Git; stop at literal-GO/native approval |
 
-At phase entry, before cold/local recovery, on landing/reviewer/planning returns
-and before native waits, run `devrites-engine frontier <source>` and execute the
-shared [global frontier pass](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
-Its report requires authorized preparation/Vet and mixed selection, not a pause.
-Preserve local cursors, pending handles and protected validation windows;
-scheduling precedes owner Seal without changing ordered handoff below.
+At phase entry, before local recovery or waits, execute the
+[global pass](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
+Consume the fresh frontier emitted after a recorded `dispatch return`; after
+landing, planning/artifact changes or capacity updates, rerun frontier. Execute
+authorized preparation/selection, preserving pending handles, local cursors and
+protected validation windows. Reporting or creating a placeholder is not progress.
 
 Check [stop-conditions.md](stop-conditions.md) before advancing. Discard stale
 pass evidence after source edits. Re-read the selected source before each phase per [phase target binding](../../devrites-lib/reference/parallel-workspaces.md#phase-target-binding). On a cold resume or
@@ -92,19 +90,14 @@ floor; `--update` never excuses an unreconciled regression.
 
 ## Sequence continuation
 
-Unless `continue_sequence: false`, while sequence budget remains
-([sentinel](../../devrites-lib/reference/standards/afk-hitl.md#sequence-continuation-continue_sequence-max_workspaces)),
-step 10 does not end the run: leave the sealed workspace unshipped with its
-`Next step: $rite-ship`, then invoke the next recorded continuation
-(`$rite-spec <parent>-<n> "<objective>"` from the parent's `decisions.md` sequence)
-and re-enter step 1. Spend one workspace per opened continuation.
-
-For an already prepared child, do not re-specify. Follow
-[`parallel-workspaces.md`](../../devrites-lib/reference/parallel-workspaces.md)
-while the owner is still running: honor claims, repair/re-Vet stale readiness,
-and admit only explicitly independent/dependency-satisfied isolated work.
-ACTIVE changes to the child only at normal ordered handoff after the owner Seal;
-resume its durable cursor without a second controller or another opening charge.
+With a recorded successor, opening budget and no opt-out, Seal GO stays internal:
+leave the owner sealed/unshipped with `$rite-ship`, then resume the prepared child
+or invoke its authorized native Spec. Sequence authority follows the
+[shared grammar](../../devrites-lib/reference/workspace-artifact-schema.md#what-each-file-owns),
+not invented slugs. Charge an opening once; preparation may pipeline before Seal,
+one immediate successor per admitted source, not the whole roadmap at once.
+Reuse the child's durable cursor and controller. ACTIVE changes only at normal
+ordered handoff; early planning or isolated independent Build does not advance it.
 
 Before invoking a continuation, require durable `state.md`
 `sequence_workspaces_remaining > 0`; if absent, first write
@@ -158,18 +151,19 @@ and park it after three escalations while independent work continues.
 
 ## Continuous caller obligation
 
-Green slice/phase checkpoints consume their recorded `next_action` internally;
-only the caller replies finally at completion or a genuine stop.
-Before a reply, `devrites-engine check continuation` must print `continuation: clear`; `required` means invoke `invoke:` now.
-No user-facing reply is permitted while durable state contains agent-owned
-`NEEDS_REPLAN`, an intermediate Plan/Vet action, a distinct retained
-Critical/Important fingerprint below its cap or with an escalation left, runnable
-work independent of a parked fingerprint, or an open blocking question that
-already names a ranked recommended option. Invoke the next internal repair or
-`devrites-engine state resolve` immediately, unless that writer already hit the
-[resolver-failure stop](stop-conditions.md#other-stop-classes). **Failing case:**
-`state resolve` exits 1 on every call and the loop re-invokes it without end. A narrow reviewer closing one finding and exposing another
-Critical/Important invariant is progress, not exhaustion.
+After a green slice or phase, execute its recorded `next_action` internally;
+reply only at completion or a genuine stop.
+
+Before replying, run `devrites-engine check continuation`: `required` means
+consume `invoke:` now; only `clear` permits a final reply. Under controller mode,
+actionable normalization, successor preparation or foreign work precedes local
+Build. Local-only reconciliation, repair, picks or discharged scheduling deferrals
+retain the owning phase edge, not recursive `$rite-autocomplete`.
+Agent-owned NEEDS_REPLAN, budgeted Critical/Important recovery, independent work
+or a recommended blocking answer stays internal. Invoke repair or `state resolve`
+unless the [resolver-failure stop](stop-conditions.md#other-stop-classes) applies.
+A distinct invariant is progress, not exhaustion; repeated failed resolver calls
+without correction are not progress.
 
 The number of completed repair/Vet cycles, context pressure, compaction, session
 duration, and nested completion never turn checkpoints into handoffs. Persist and

package/pack/generated/codex/skills/rite-autocomplete/reference/stop-conditions.md

@@ -28,24 +28,27 @@ Fully escalated fingerprints park unless remaining owner is human.
 
 ## Not stops: internal technical routing
 
-AFK + `status=running` + an internal phase `next_action` is not a stop. `devrites-engine check continuation` prints `required` for that cursor and `clear` for `$rite-ship`, `awaiting_human`, a question cursor, or an open blocking or escalating question.
-
-`NEEDS_REPLAN` is not a stop condition under active Autocomplete. It blocks
-forward work, persists the return cursor, and invokes Plan repair plus Recovery
-Vet inline. The same applies to nested `STOP`/`Next step` when its decision is
-agent-owned.
-
-Agent-owned backtracking is not a stop condition while its exact causal
-fingerprint has budget: invoke earlier phase, affected Vet, remediation, proof;
-resume origin. Three no-progress corrections spend only that fingerprint's current
-strategy: escalate inline to the next class (shared root cause, diagnostic
-amplification, boundary redesign) with fresh budget, without permission. After
-three escalations per activation it parks; finish independent work, then stop once.
-Preserve reproduction, attempts, and dead ends; never offer `$rite-plan unblock`
-or another routine phase command. A new user-issued `$rite-autocomplete`
-reopens parked fingerprints with fresh escalation; wakes and compaction do not.
-Closure is progress; a separately evidenced Critical/Important invariant starts
-its own cap and cannot extend the closed one.
+For AFK `status=running`, consume an internal phase edge. In
+`mode: autocomplete`, actionable global normalization, preparation or foreign
+work takes priority over local Build; local-only picks do not recurse through
+Autocomplete. Source human/Ship holds remain binding, while independent
+authorized planning can continue. `clear` is reply permission, not Ship approval.
+
+A preparation refusal routes native work or a narrow disclosed scheduling
+deferral under the [global pass](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
+Deferral removes only its named scheduling obligation from repeated continuation:
+it neither makes a placeholder prepared nor waives readiness, malformed authority,
+claims, isolation, proof or human gates. Qualified foreign serial handoff is a
+separate rule. Revisit deferrals when their constraint changes.
+
+Agent-owned NEEDS_REPLAN or nested STOP persists the return cursor and invokes
+Plan repair, affected Recovery Vet, remediation and proof inline. Three
+no-progress corrections spend that fingerprint's strategy; escalate through
+shared root cause, diagnostic amplification and boundary redesign without asking.
+After three escalations, park it and finish independent work. Preserve attempts;
+resume through `$rite-autocomplete`, not a routine phase command. A new explicit
+invocation reopens parked fingerprints; wakes/compaction do not. Closure is
+progress; a distinct Critical/Important invariant gets its own cap.
 
 Spent consumptive-action authorization is not technical-recovery exhaustion.
 It blocks another execution; retained new Critical/Important evidence still
@@ -74,14 +77,10 @@ Without a safe seam, escalate or park; only a real human/risk/scope gate stops f
 - **Clarify:** material `open`/unowned decision coverage or a
   low-confidence high-consequence assumption. Continue the initial interview;
   never arm AFK early.
-- **Seal:** report remaining NO-GO with every blocker/fix direction; never round
-  up to GO. Resolve recommended-option blocking questions internally; recover
-  agent-owned findings and re-enter Seal. A first NO-GO is not a stop:
-  recover every agent-owned blocker (missing or unbound proof, a reviewer gap root
-  can close, a finding with a fix direction, a missing `review.md` verdict), then
-  re-enter Seal. The unattended `N` to accepting Important risks means repair, not
-  stop. Stop only for blockers that need a human: accepting a risk, changing scope
-  or an acceptance criterion, or access. Record each one as a question.
+- **Seal:** NO-GO never rounds up to GO. Recover agent-owned missing/unbound proof,
+  reviewer gaps and findings, then re-enter Seal; declining Important-risk
+  acceptance means repair. A human-owned risk, scope/acceptance change or access
+  blocker remains a question. A first repairable NO-GO is not a handoff.
 - **Reslice:** execute its marked action before deciding continue/stop.
 - **Slice budget:** do not stop on `--max-slices`. Leftover
   pre-existing remaining value, explicit flag, sentinel cap, or post-vet pending count
@@ -91,8 +90,9 @@ Without a safe seam, escalate or park; only a real human/risk/scope gate stops f
   another session blocks only work on those paths; run independent work, re-check,
   and stop only when nothing independent remains. `released`/`dead` claims are
   reconciled per [§ Cancellation](../../devrites-lib/reference/parallel-dispatch.md#cancellation-and-terminal-reconciliation).
-- **Resource envelope:** overlapping run or missing AFK after arm still stops.
-  Do not stop on `--max-slices`, `max_agents`, `max_minutes`, or `max_review_queue`.
+- **Resource envelope:** overlapping controllers, missing AFK after arm or invalid/
+  duplicate mode fail closed. Ignored slice/agent/time/review ceilings do not stop
+  Autocomplete; mode itself grants no authority.
 - **Confidence:** intent still cannot become testable acceptance after interview.
 - **Repeated failure:** not a stop. Escalate; fully escalated fingerprints park.
   Stop only when no independent work remains.

package/pack/generated/codex/skills/rite-build/reference/parallel-batch.md

@@ -4,11 +4,11 @@
 
 Opt-in only. Default `$rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.md).
 
-Autocomplete runs `devrites-engine frontier <source>` and executes shared
-[`parallel-workspaces.md`](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier):
-it owns preparation, global admission and controller routing. Standalone Build
-stays source-local; frontier notices from `parallel select --from-plan` do not
-expand its picks. Autocomplete consumes `frontier-select-command`, then this lifecycle.
+Autocomplete executes the shared [global pass](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+before local writers: actual immediate-successor preparation or narrow disclosed
+deferral, then global cohort admission. Consume fresh dispatch-return scheduling.
+Standalone Build stays local; select notices never broaden its picks. A placeholder
+is not preparation; one successor pipelines safely without preparing the whole roadmap.
 
 ## Entry
 
@@ -17,13 +17,15 @@ expand its picks. Autocomplete consumes `frontier-select-command`, then this lif
 | omitted / `--parallel 1` | Serial one-slice |
 | `--parallel N` (**2≤N≤10**) | N is a **cap**, not a quota: run the largest eligible set ≤ N |
 | non-integer / `N≤0` / `N>10` | Hard refuse (no silent clamp) |
-| Autocomplete `--parallel N` | N is the cap for this run; leftover sentinel `max_parallel` is ignored, then `$rite-autocomplete` writes or replaces only `max_parallel: N` |
+| Autocomplete `--parallel N` | Global cap for this run; controller entry upserts mode and explicit capacity, preserving other AFK fields |
 | Autocomplete, no flag | Same path, cap from sentinel `max_parallel` else 10; serial only when ineligible |
 
 AFK caps `N`. Charge each green sibling once after its successful landing;
 rejected/unlanded work charges zero, without undoing prior landed accounting.
 `parallel create` refuses another retained repository controller.
-Reconcile retained repair-round artifacts by exact causal fingerprint before honoring a stored blocked status/verdict. Blocked status, round count, or distinct finding alone cannot stop cold resume: establish missing or stale review coverage under step 4; repair unless a stop condition remains evidenced.
+Cold resume reconciles retained repair artifacts by exact fingerprint. A blocked
+label, round count or distinct finding alone does not stop: establish current
+review coverage under step 4 and repair unless a genuine stop remains.
 
 ## Dynamic selection and re-batching
 
@@ -89,14 +91,14 @@ Before `parallel select`, add each slice's hidden write surfaces (list owner:
 snapshot directory, formatter sweep — and compare paths case-folded
 (`src/Api.ts` = `src/api.ts`); `--from-plan` adds the manifest/lockfile for a package.
 Slices colliding on either run serially; the rest
-stay eligible. Record `serial: <ids> — <surface>` in `evidence.md`. Under AFK
-with `max_parallel ≥ 2`, `dispatch open` refuses a build wright wave narrower
-than the from-plan batch until that wave holds the other picks or `serial:`
-names each skipped one. Repairing a slice, or a slice already in the lease,
-does not waive them. A `serial:` reason that only says the skipped slice is
-repairing, already started, or in a wave does not count. HITL is never refused. **Failing
-case:** two slices each add a dependency, run in parallel, and integrate fails or
-lands a broken lockfile.
+stay eligible. Record `serial: <ids> — <surface>` in `evidence.md`. AFK cap≥2
+refuses narrower Build-wright waves until other picks are started/reserved or
+each skipped pick has a substantive serial reason. Repairing/already-started/in-wave
+alone is not a reason. Controller admission also includes ready foreign picks:
+only exact `serial: child/SLICE-001 — <reason>` can defer that foreign lane; bare
+`SLICE-001` is local. Preparation `frontier-blocked:` cannot waive ready Build
+picks or safety gates. Qualified unsupported-isolation deferral preserves truthful
+owner dispatch/ordered handoff, never early same-tree foreign Build. HITL stays unchanged.
 
 ## Control vs workers