devrites 7.3.4 → 7.3.6

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.3.6](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.5...v7.3.6) (2026-11-06)
+
+### Fixed
+
+* **devrites:** enforce native prebuild preparation admission ([#209](https://github.com/ViktorsBaikers/DevRites/issues/209)) ([2aba0a0](https://github.com/ViktorsBaikers/DevRites/commit/2aba0a0e0828f25c90e3021ca2c29ddebb291bf9))
+
+## [7.3.5](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.4...v7.3.5) (2026-11-05)
+
+### Fixed
+
+* **devrites:** enforce global autocomplete scheduling ([#208](https://github.com/ViktorsBaikers/DevRites/issues/208)) ([2e4fdb5](https://github.com/ViktorsBaikers/DevRites/commit/2e4fdb5178f2aa507ba565a70b3c2c86810cc5f7))
+
 ## [7.3.4](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.3...v7.3.4) (2026-11-03)
 
 ### Fixed
@@ -47,6 +59,28 @@ All notable changes to DevRites are documented here. The format follows [Keep a
 
 ### Fixed
 
+- Guard Autocomplete's early phase context and dispatch, not only Build writers,
+  against unstarted successor preparation. Keep normalization research reachable
+  and bound successor preparation before its first wave without recursively
+  requiring the rest of the roadmap.
+- Keep Clarify required when decision coverage is missing or empty despite an
+  empty question queue.
+- Preserve preparation intent and the selected host tree in suggested context
+  reruns; reject repeated parent flags before writes and retain settled history
+  without rebinding active preparation actors.
+
+- Give an explicitly identified Autocomplete controller structural writer-admission
+  checks for actual successor preparation and source-qualified mixed reservations.
+  Surface fresh global scheduling after returns and prioritize unresolved global
+  work over local Build cursors, while preserving narrow disclosed deferrals,
+  standalone AFK, native review/proof, isolation and Ship approval.
+- Accept one explicit decision-bound canonical sequence roadmap without rewriting
+  historical tables; reject ambiguous owners, stale identities and unsafe paths.
+- Keep writer admission bound to immutable pending-lane paths, current controller
+  identity, disjoint active reservations and the effective global cap. Check the
+  complete writer allowlist against live foreign claims, including symlink
+  aliases, even when optional claim flags are absent or name unrelated paths.
+
 - Use `GH_TOKEN`, then `GITHUB_TOKEN`, then optional bounded noninteractive GitHub
   CLI credential lookup for release API requests. Keep credentials off release
   assets and off-origin redirects, fail explicit invalid credentials, and document

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.3.4`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.4): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.3.6`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.6): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/adr/0039-autocomplete-structural-admission.md

@@ -0,0 +1,87 @@
+# ADR-0039: Structural admission for the native Autocomplete controller
+
+- **Status:** Accepted
+- **Date:** 2026-11-05
+
+## Context
+
+Consumer traces showed a native Autocomplete controller repeatedly completing one
+workspace while leaving recorded continuation preparation unstarted. A global
+frontier report alone did not prevent subsequent local writer admission. The
+controller also recognized a historical workspace rename without resolving the
+conflict between the old roadmap table and current sequence identities.
+
+ADR-0022 and ADR-0024 leave semantic scheduling and model dispatch with native
+hosts. Replacing them with an engine agent bridge, persistent queue, scheduling
+receipts, or heuristic interpretation of reviewer prose would create a second
+orchestration authority. Existing dispatch and lease primitives already retain
+observable preparation accounts, source-qualified reservations and write claims.
+
+## Decision
+
+Narrow ADR-0022's native-scheduling boundary and ADR-0024's policy boundary only
+for structural Autocomplete writer admission:
+
+- Explicit native Autocomplete invocation records `mode: autocomplete` in AFK.
+  This identifies the controller; it grants no readiness, independence or Ship
+  permission. Standalone AFK without this mode retains its existing contract.
+- Before admitting a new Build-wright wave at capacity greater than one, the
+  engine checks immediate successor preparation and the eligible mixed cohort.
+  Preparation is
+  represented by an actual pending native preparation account, current native
+  readiness, or a concrete retained hold. Creating a placeholder or printing a
+  frontier does not satisfy this boundary.
+- A source may disclose a target-specific preparation constraint through
+  `frontier-blocked: <workspace> — <reason>` in its existing evidence ledger.
+  `sequence` names only unresolved historical sequence normalization. These rows
+  defer scheduling obligations; they never waive malformed authority, source
+  readiness, trust boundaries, writer claims, path/capacity limits or proof.
+- An already-ready foreign slice requires an existing mixed lease reservation
+  or an exact source-qualified `serial:` rationale for ordered handoff. A local
+  serial reason or preparation deferral does not discharge foreign admission.
+- A fresh global observation follows a committed dispatch return after mutation
+  and locks settle, even if later claim release fails; its nonzero failure and
+  claim exclusion remain. Rejected/unpersisted returns do not refresh. Global
+  obligations take continuation priority without rewriting local phase cursors
+  or recursively routing local-only work.
+- One explicit canonical `roadmap.md`, bound to the actual sequence root and a
+  unique owner-local decision, may replace historical tables for scheduling.
+  History stays unchanged; duplicate authorities, malformed inputs, conflicting
+  current identities and invalid references fail closed. Native owners decide
+  whether the decision and scope are substantively approved.
+- Initial admission freezes each pending writer lane's normalized allowlist in
+  existing dispatch metadata. Mutable tasks, reused batch labels or replacement
+  lease rows cannot move a retained actor's authority. Exact claim identity and
+  session remain required; claim release or expiry does not prove actor exit.
+  Returned/integrated siblings may free slots for rolling refill.
+
+The engine does not invoke a model, create a native workspace, infer semantic
+independence, judge a rationale's truth, bind a handle to an execution checkout,
+or authorize publishing. Native hosts still execute preparation, dispatch exact
+profiles, reconcile results and obey human and protected-validation gates.
+
+## Alternatives considered
+
+| Option | Why rejected |
+| --- | --- |
+| More reminders and frontier reports only | The observed controller already had that guidance and still skipped preparation. |
+| Automatically accept the newest table or rename prose | Recency and prose do not establish canonical identity or supersession. |
+| Rewrite archived maps to match the current run | Destroys the historical decision rather than recording current authority. |
+| Require every future workspace READY before any writer | Serializes preparation and creates cycles when future plans depend on current repair. |
+| Engine-owned model scheduling, receipts or persistent queue | Duplicates host authority and exceeds the deterministic local boundary. |
+
+## Consequences
+
+Skipping required preparation now refuses an observable writer-admission step
+rather than remaining a narrative warning. Independent work can continue with a
+disclosed specific constraint, without disguising deferred work as completed.
+Canonical normalization has one machine-readable owner and does not require
+altering old evidence or guessing workspace names.
+
+This cannot prove that an arbitrary host obeys every instruction or that a native
+account represents real semantic progress. Runtime claims therefore distinguish
+structural admission, recorded native launches, and actual host behavior.
+
+Guard tests: `engine/internal/lib/frontier_controller_test.go`,
+`engine/internal/lib/frontier_roadmap_test.go`, and
+`engine/tests/autocomplete_global_test.go`.

package/docs/adr/0040-early-preparation-admission.md

@@ -0,0 +1,76 @@
+# ADR-0040: Early preparation admission without recursive roadmap blocking
+
+- **Status:** Accepted
+- **Date:** 2026-11-06
+
+## Context
+
+ADR-0039 guarded Build-wright admission. A subsequent consumer trace entered
+Temper and launched native review without starting its recorded successor;
+it consumed a context bundle before any dispatch account. Writer-only checks
+therefore left the earlier preparation path unguarded.
+
+Requiring every source to prepare its successor immediately would also recurse
+through the entire roadmap: preparing B for A would demand C before A's own
+work. Sequence normalization needs a read-only bootstrap that cannot itself
+be blocked by the authority it investigates.
+
+## Decision
+
+Extend ADR-0039's deterministic admission boundary to ordinary local
+Temper/Define/Plan/Vet context generation and dispatch opening in Autocomplete
+at effective capacity greater than one. Both use one validation owner, before
+workflow writes. Context does not require an open account: reviewer context
+and packet construction precede wave opening. Build keeps its full admission.
+
+- Internal `--prepare-for <parent-source>` identifies existing immediate-successor
+  preparation. Canonical identity, parent binding, adjacent positions and both
+  chains must agree. Only supported preparation phases/roles qualify; root
+  context may omit a role. Dispatch records optional `preparation_for`; context
+  records no account. Neither permits product writes or Build.
+- Internal `--sequence-research` permits only exact-source, read-only
+  `evidence-scout` investigation in preparation phases before the authority gate.
+  It is mutually exclusive with `--prepare-for`. Dispatch records optional
+  `sequence_research`. The exception grants no scope, approval, phase advancement,
+  successor creation, writer admission, readiness or upstream preparation credit.
+- Derive preparatory-only B from its validated immediate nonterminal parent A,
+  absence of ordinary forward/Build-wright admission and absence of normal handoff to B.
+  This applies before the first marked wave. Observe B's continuation without
+  making C an actionable prerequisite for A. Ordinary B admission still checks
+  C before publication; that admission, terminal A or normal ordered handoff
+  releases the routing boundary. ACTIVE selection represents native handoff,
+  not proof of implementation or approval.
+  Read-only Build accounts do not release it. Explicit descendant `next` and
+  `check continuation` honor inherited waiting instead of mandating a local cursor;
+  other actionable global work and independently admitted proof remain visible.
+- Preserve completed account history and existing pending/abandoned actor and
+  unfinished writer integration protection. Settled purpose bindings remain
+  historical after authorized replanning, not current-parent authority or new
+  preparation credit; unsettled mismatches still fail closed.
+- A resolved finite tail needs no successor. New-opening opt-out or budget
+  exhaustion does not erase an already-created child. Existing narrow deferrals,
+  human gates, claims, capacity, isolation and protected proof remain authoritative.
+
+No new user Autocomplete flag, model client, launch bridge, receipt or queue.
+Standalone/cap1 and initial Spec/Clarify/bootstrap behavior remain unchanged.
+Actual native launches still require registered host handles; declared purpose
+metadata does not prove profile, checkout or semantic progress.
+
+## Alternatives considered
+
+| Option | Why rejected |
+| --- | --- |
+| Keep the gate only on Build waves | Earlier context and native planning can bypass it. |
+| Require an open account before producing context | Reviewer opening requires a packet built from that context. |
+| Require B's successor before admitting B's preparation for A | Recurses through the roadmap instead of pipelining one successor. |
+| Use a preparation marker as the only routing boundary | The creation/context interval precedes the first marked wave. |
+| Treat normalization research as ordinary planning admission | Conflicting authority blocks its own investigation. |
+
+## Consequences
+
+The engine rejects the observed early CLI path, not merely its eventual writer.
+Native hosts retain semantic scope, ordered handoff, exact profile/model/cwd,
+result reconciliation and publication authority. Arbitrary host compliance is
+not an engine guarantee.
+
+Guard regressions: `engine/internal/lib/frontier_preparation_test.go`.

package/docs/adr/README.md

@@ -84,3 +84,5 @@ architecture; per-feature `decisions.md` files stay scoped to that feature.
 | [0036](0036-archive-recall-is-a-read-time-query.md) | Archive recall is a read-time query | Accepted; consistent with 0014/0022 (no engine index or store) | `engine/internal/lib/recall_test.go` |
 | [0037](0037-autocomplete-lands-local-checkpoints.md) | Autocomplete lands local checkpoints and self-resolves own scratch | Accepted; supersedes the ADR-0022 local-commit approval clause | `tests/authority-drift-test.sh` |
 | [0038](0038-engine-flags-unattributed-root-edits.md) | The engine flags unattributed root edits | Accepted; narrows the ADR-0018 no-replacement-enforcement clause for root-edit attribution | `engine/internal/lib/treebaseline_test.go` |
+| [0039](0039-autocomplete-structural-admission.md) | Structural admission for native Autocomplete | Accepted; narrowly amends 0022/0024 for observable writer admission, retains native dispatch and semantic authority | `engine/internal/lib/frontier_controller_test.go`, `engine/internal/lib/frontier_roadmap_test.go`, `engine/tests/autocomplete_global_test.go` |
+| [0040](0040-early-preparation-admission.md) | Early preparation admission without recursive roadmap blocking | Accepted; extends 0039 to context and pre-Build native dispatch, preserves native execution and semantic authority | `engine/internal/lib/frontier_preparation_test.go` |

package/docs/cli.md

@@ -213,7 +213,9 @@ self-contained updater.
   and exits `3` naming the holder when a live claim by another session covers a
   path; `release --session <id> --id <claim>` frees it; `list [--all]` shows
   live (or all) claims; `check [--session <id>] <path>...` is the read-only
-  preflight. Each claim records its host and the claiming session's long-lived
+  preflight. Conflict checks cover logical paths and physical symlink aliases;
+  unresolved physical paths fail closed. Same-session allocation stays exempt.
+  Each claim records its host and the claiming session's long-lived
   processes; when all of them have exited on this host, `list` shows the claim
   `dead` and it no longer conflicts. Other hosts or an unavailable `ps` never
   prove exit. Claims coordinate concurrent same-tree sessions; they never
@@ -285,6 +287,10 @@ The report emits:
 - `frontier-prepare:` for a recorded next Spec cursor or an unambiguous next entry
   in an exact position/workspace table, or `frontier-review-sequence:` artifact
   paths when remaining work or conflicting sequence maps require native review.
+- `frontier-authority: <artifact-path>,...` identifies actual files supplying a
+  valid nonempty scheduling map. For explicit canonical authority it names the
+  owning `roadmap.md` and same-owner `decisions.md`; legacy maps list their actual
+  artifacts without claiming canonical status.
 
 Relations come from exact recorded `sequence_parent` edges, not name prefixes.
 Conflicting identities, cycles, malformed related state, or invalid declared
@@ -295,14 +301,106 @@ Conflicting or amended sequence maps suppress missing-workspace preparation even
 with a recorded Spec cursor until native authority normalization resolves them;
 valid existing live descendants remain visible and eligible for guarded selection.
 
+An optional `roadmap.md` becomes current scheduling authority when it contains
+either `Sequence root:` or `Decision:`. Both headers are then required:
+
+```markdown
+Sequence root: actual-anchor-slug
+Decision: DEC-017
+
+| Position | Workspace |
+| --- | --- |
+| 1 | actual-anchor-slug |
+| 2 | actual-renamed-child |
+```
+
+Exactly one related live or archived workspace may own this explicit map.
+`Decision: DEC-NNN` must identify exactly one `## DEC-NNN` heading in that
+owner's `decisions.md`; the root must match the actual chain anchor. Exactly
+one table must have contiguous positions from 1 and unique valid workspace
+slugs, matching every related recorded position and exact successor. Folder
+numbering, prose amendments, and unenrolled workspaces confer no authority.
+A valid explicit map supersedes historical tables in `decisions.md`, `spec.md`,
+and headerless `roadmap.md` for scheduling only; preserve those historical bytes.
+Without either header, `roadmap.md` retains conservative legacy parsing.
+Partial/malformed headers, multiple owners, invalid root/decision/table, or a
+symlink/unreadable explicit map fail closed without legacy fallback. Use native
+authority normalization to record the approved actual identities while retaining
+history. Structural validation establishes identity, not semantic approval,
+independence, Build readiness, or Ship permission.
+
 Under AFK, `next`, `handoff`, and `check continuation` expose the same frontier.
 A source-local `parallel select --from-plan` without `--workspaces` also prints
 the report to stderr, preserving its machine-readable selection on stdout and
 source-local picks: reporting another workspace never silently admits it.
-Native Autocomplete must inspect the returned preparation and review
-actions, read the approved roadmap and recorded restrictions, then invoke the
-owning Spec/Plan/Vet steps or explicit mixed selection. Path disjointness alone
-does not establish semantic independence or lift a planning-only restriction.
+Native Autocomplete must inspect returned preparation/review actions and read
+the exact `frontier-authority:` paths plus recorded restrictions before invoking
+Spec/Plan/Vet or mixed selection. This read is required even when the owner is an
+archived ancestor or another related workspace outside the local read-next bundle.
+Path disjointness alone establishes neither semantic independence nor permission
+to lift a planning-only restriction.
+
+### Autocomplete controller admission
+
+The existing `/rite-autocomplete` invocation writes or upserts `mode: autocomplete`
+in `.devrites/AFK`; no extra flag is needed. It preserves other sentinel fields
+unless an explicit `--parallel N` changes capacity. Mode identifies the native
+controller, not authorization. Standalone AFK without mode retains its behavior;
+duplicate or invalid mode requires normalization rather than silently disabling
+the controller gate.
+
+With controller mode and global capacity above one, a new Build wright
+`dispatch open` checks structural global scheduling before writing claims, history,
+or a round. It checks one immediate recorded successor per admitted source, not
+the whole future sequence:
+
+- Missing permitted successor: start its native Spec/Plan/Vet preparation and
+  retain actual launched planning/review handles before admitting the writer.
+- Existing successor: require pending preparation handles, a current native
+  Build-ready binding, or its concrete human/dependency hold. A placeholder
+  state/spec or a prose claim that preparation happened is insufficient.
+- Opted-out or exhausted future opening and source human/question holds do not
+  invent new preparation obligations. Unresolved sequence authority requires
+  native normalization.
+
+For a concrete preparation constraint, retain
+`frontier-blocked: <successor-slug> — <specific constraint>` in the source's
+`evidence.md`. For unresolved historical normalization on otherwise-valid local
+work use `frontier-blocked: sequence — <specific constraint>`. These deferrals
+remain visible for native review; they grant no approval, readiness, or claim
+that normalization succeeded. Neither waives malformed canonical authority,
+invalid AFK/path/readiness/security checks, or already-ready foreign Build.
+A generic local `serial: SLICE-002 — <reason>` does not waive cross-workspace
+preparation. A discharged deferral does not repeatedly trigger controller work.
+
+Ready independent foreign sources must participate in explicit repository-wide
+mixed selection and lease capacity/path reservations. Reserve the cohort with
+`parallel create/add`; source waves may then open separately. A concrete
+`serial: other-workspace/SLICE-001 — <constraint>` can retain an ordered handoff
+for that exact foreign pick; an unqualified local serial reason cannot silently
+omit it. This does not waive successor preparation or readiness, dependencies,
+runtime/path isolation, actor claims, or reviewer/proof windows.
+Dispatch `controller_batch` is an opaque cohort-instance admission identity,
+recording initial whole-wave, source-qualified live-lease admission, never proof
+of actor checkout, cwd, or runtime profile. Immutable `admitted_paths` snapshots
+retain each pending writer lane's normalized allowlist. Missing snapshots or
+changed reservations require actor reconciliation; mutable tasks cannot backfill
+authority. Returned/integrated siblings may release slots for rolling refill.
+Exact claim identity/session remains required; release or expiry does not stop
+an actor. Retained unbound or other-cohort writers hold new actors; later lease
+IDs cannot retrofit them. Native exact cwd/profile checks remain required.
+Unsupported isolation permits truthful local-owner serial work and normal
+ordered handoff, never an early same-tree foreign writer.
+
+Controller continuation prioritizes actionable global normalization, preparation,
+and foreign work over a direct local Build invocation while preserving the local
+phase cursor. Local-only ready work does not recursively invoke Autocomplete.
+After a committed dispatch return, a fresh global scheduling result resurfaces
+the next obligation—even if later claim release fails; its nonzero failure and
+claim exclusion remain. Rejected or unpersisted returns do not refresh.
+Ordinary status reads remain read-only. Protected reviewer/proof windows defer
+unsafe landing, not independent planning. No such transition invokes Ship or
+launches a model through the engine.
 
 The engine does not invoke models, create workspaces, change `ACTIVE`, resolve
 semantic authority, or grant Ship approval. These outputs guide the native host;

package/docs/engine/commands.md

@@ -35,7 +35,7 @@ workflow strategy.
 | `orient <slug>` | Alias for `observe summary`. |
 | `observe slice <slug> <SLICE-ID>` | Print one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. |
 | `next [slug]` | Print the minimal remaining lifecycle path plus advisory skips; in Build also `eligible_now:`, `batch:` and the `select-command:` (`parallel select --root <project> --slug <slug> --cap N --from-plan`, N = AFK max_parallel else 10) that reproduces the batch. Prints `blocked: unattributed root edit: ...` after `open-questions:` and exits `3` while the ADR-0038 tripwire flags a product path; the rest of the output still prints. |
-| `frontier [slug]` | Read-only report across exact recorded sequence relations, including archived intermediaries and live descendants. Emits `frontier: actionable\|waiting\|blocked\|clear` (`none` for a non-sequence source), `frontier-source:`, and `frontier-workspace:` rows with location, `inspect\|prepare\|repair\|wait\|complete` action, and reason. Emits `frontier-select-command:`, `frontier-picks:`, `frontier-selection: blocked`, `frontier-prepare:`, or `frontier-review-sequence:` where applicable. Explicit slug may be archived; absent ACTIVE recovery requires a unique archived terminal tip with a recorded native Spec edge, otherwise refuses ambiguity. Never changes ACTIVE, restores archives, creates workspaces, or launches writers. Native preparation and semantic admission remain required; see [sequence frontier](../cli.md#sequence-frontier). |
+| `frontier [slug]` | Read-only report across exact recorded sequence relations, including archived intermediaries and live descendants. Emits `frontier: actionable\|waiting\|blocked\|clear` (`none` for a non-sequence source), `frontier-source:`, and `frontier-workspace:` rows with location, `inspect\|prepare\|repair\|wait\|complete` action, and reason. Emits `frontier-select-command:`, `frontier-picks:`, `frontier-selection: blocked`, `frontier-prepare:`, or `frontier-review-sequence:` where applicable. Explicit slug may be archived; absent ACTIVE recovery requires a unique archived terminal tip with a recorded native Spec edge, otherwise refuses ambiguity. One explicit `roadmap.md` owner anywhere in the related live/archive chain may supersede historical maps for scheduling: both `Sequence root:` and `Decision:` headers, a unique owner-local decision heading, and one contiguous position/workspace table must match recorded identities and successors. Either header claims this format; invalid authority fails closed without legacy fallback. Headerless maps retain legacy parsing. Native normalization preserves historical bytes; structural identity is not semantic approval. Never changes ACTIVE, restores archives, creates workspaces, or launches writers. Native preparation and semantic admission remain required; see [sequence frontier](../cli.md#sequence-frontier). |
 | `handoff [slug] [--resume]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, in-flight dispatch waves (`inflight_wave:` lines: phase, state, pending roles, slices), missing required files, the canonical read-next order, and the same `continuation:` lines as `check continuation`. Read-only unless `--resume`, which appends one `resume` event (role root) to `metrics.jsonl`; `metrics summary` then reports minutes from each resume to the next dispatch. The `/rite-handoff` spine and the compaction-fallback entry point. |
 | `recall --paths <p1,p2,...> [--limit n]` | Read-time query over `.devrites/archive/`: list archived features whose `touched-files.md` candidate manifest covers a queried project-relative path (exact or directory prefix, case-folded), ranked by overlap count, then newest archive-directory mtime, then slug (default 10 features). Each feature prints up to 8 `archive/<slug>/<file>:<line>` pointers, then `+N more`: `decisions.md` `DEC-###` entries and `## Carry-forward constraints` bullets whose `Files:` overlap (or a constraint naming no files), plus `review.md`/`seal.md`/`drift.md` lines that mention a queried path; fenced examples are ignored. Never writes, caches, or indexes (no metric either); symlinked archive entries are refused. An unreadable archive file prints `unreadable:` and the scan continues. Exit `0` (including `recall: no archive`), `1` invalid archive directory, `2` usage. |
 | `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`), unless `.devrites/AFK` `max_parallel` is 2 or more or a parallel lease is `running` (the bundle stays whole); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
@@ -59,9 +59,96 @@ workflow strategy.
 | `overhaul <records\|admit\|snapshot\|score\|bench\|render> ...` | Deterministic tools behind the standalone `/overhaul` skill: run-record generations and cross-record validation, worker-receipt admission and quote anchoring, index-safe baseline snapshots and per-attempt deltas, exact-rational readiness scoring, benchmark ratio intervals, and escaped offline review/report views. Operates only on explicit run-area and repository paths. See [Overhaul tools](#overhaul-tools). |
 | `version` | Print the engine version. |
 
+`next` skips zero-question Clarify only when its required artifacts are present
+and nonempty. Missing or empty `decision-coverage.md` still routes to Clarify;
+an empty question queue does not establish decision coverage.
+
 Under AFK, `next`, `handoff`, and `check continuation` include the sequence
 frontier without replacing the source-local cursor. Reporting actionable work
 does not authorize Build or Ship, and cannot guarantee native-host compliance.
+For a valid nonempty map, `frontier-authority: <artifact-path>,...` exposes actual
+authority files. Canonical maps name owner `roadmap.md` and owner-local
+`decisions.md`; valid legacy maps name their artifacts without a canonical claim.
+Native preparation must read those exact paths and restrictions, including
+archived/related owners absent from the local context read-next bundle.
+
+Native `/rite-autocomplete` automatically upserts AFK `mode: autocomplete`
+(no new flag), preserving other fields except an explicit `--parallel N` capacity
+update. Missing mode retains standalone AFK behavior; invalid/duplicate mode
+fails closed. With mode and effective global cap >1, ordinary local
+Temper/Define/Plan/Vet `context` and `dispatch open` check immediate-successor
+preparation before bundle/account/claim/history writes. The context check also
+applies to `--skill rite-<phase>`; it does not require an already-open wave.
+Build-wright admission retains its additional mixed-cohort and writer checks.
+Actual pending native planning/review handles, current readiness/completion, or
+a concrete human/dependency hold satisfy preparation; placeholders do not.
+Valid finite tails have no successor obligation. Opt-out and exhausted opening
+budgets prevent new openings, not planning an existing child. Standalone/cap1
+and initial Spec/Clarify/bootstrap reads retain their existing behavior.
+
+Both commands accept internal preparation intents, not new Autocomplete flags:
+
+| Option | Meaning |
+| --- | --- |
+| `--prepare-for <parent-source>` | Prepare the existing exact immediate successor of that parent. Validates canonical identity, parent binding, adjacent positions and both chains. Only supported preparation phases/roles qualify; controlling-root context may omit a role, dispatch may not. Never Build/writers or product-write authority. |
+| `--sequence-research` | Read-only normalization investigation by `evidence-scout` in Spec/Clarify/Temper/Define/Plan/Vet, bound to the exact existing source. Can inspect conflicting/malformed sequence authority; grants no normalization acceptance, scope, phase advancement, successor creation, writer admission, readiness or upstream preparation credit. |
+
+The options are mutually exclusive; dispatch accepts them on `open` only.
+Repeated `--prepare-for` is a syntax error, even with the same parent.
+Syntax/combination errors exit `2`; refused preparation/authority exits `3`
+before workflow writes. Successful admission uses the existing `0` convention.
+Dispatch retains optional wave fields `preparation_for` (string) and
+`sequence_research` (boolean); context creates no account or receipt. Old
+accounts need neither field. These fields record intent, not host execution.
+Keep context → packet → open → native launch → start order; register actual
+host handles before resuming the parent's ordinary phase.
+Suggested trigger-rerun commands preserve the preparation intent and explicitly
+selected skills root, including shell-safe quoting of that path.
+
+A newly created preparatory child B of nonterminal A does not recursively
+require C before A can proceed, even before B's first marked wave. Completed
+preparation history retains that routing boundary. Ordinary unmarked forward
+or Build-wright admission for B still checks C; such admission, terminal A, or normal
+ordered handoff selecting B restores B's own successor obligation. Pending
+actors, unfinished writer integration and other independent work remain visible.
+Read-only Build accounts do not release the bound. When an inherited descendant
+waits, explicit `next <descendant>` emits no local phase command and
+`check continuation <descendant>` emits `continuation: clear`, unless other
+actionable global work takes priority. Observing a source does not change ACTIVE.
+Purpose history stays immutable and does not make completed actors live again.
+Settled purpose bindings remain historical after an authorized replan; they
+neither bind the current parent nor supply new preparation credit. Unsettled
+mismatched actors still fail closed.
+
+Source `evidence.md` may retain `frontier-blocked: <successor-slug> — <specific constraint>`
+or `frontier-blocked: sequence — <specific constraint>` as a visible scheduling
+deferral, never approval or completed normalization. Generic local `serial:`
+does not waive preparation. Ready foreign picks require mixed selection and
+global lease capacity/path reservations, or an exact qualified
+`serial: other-workspace/SLICE-001 — <constraint>` ordered handoff. Cohort waves
+need not open atomically. Opaque `controller_batch` identifies admission to an
+existing lease cohort instance; reusing a batch label creates no actor entitlement.
+It proves no actor checkout/cwd/runtime isolation and cannot retrofit a retained
+writer. Immutable per-slice `admitted_paths` retain only each pending actor lane;
+missing snapshots or changed reservations require actor reconciliation, not
+backfill from mutable tasks. Returned/integrated siblings may release slots for
+refill. Exact claim identity/session remains required even after release/expiry.
+Readiness, dependencies, actor claims and proof windows still apply.
+Target-specific blocking defers preparation, not ready foreign Build. Sequence
+blocking covers historical normalization only for otherwise-valid local work;
+malformed canonical authority and invalid AFK/path/readiness/security still fail.
+Discharged deferrals do not repeatedly trigger controller work. Native reviews
+constraint substance and verifies exact actor cwd/profile. Retained unbound or
+other-cohort writers hold new actors; unsupported isolation requires local-owner
+serial work and ordered handoff, never early same-tree foreign writing.
+
+Controller continuation prioritizes actionable global work over direct local
+Build without replacing the local cursor or looping on local-only ready work.
+Committed dispatch returns emit fresh scheduling after locks release even if
+later claim release fails; preserve that nonzero failure and claim exclusion.
+Rejected/unpersisted returns do not refresh; status reads stay read-only.
+Protected reviewer/proof windows constrain landing, not independent planning.
+See [controller admission](../cli.md#autocomplete-controller-admission).
 
 For `context --role`, optional `devrites-` prefixes and `.lane` suffixes resolve
 the base specialist's contract, workspace read-set, and role-specific rules.

package/engine/internal/lib/claims.go

@@ -239,21 +239,39 @@ func validSession(s string) bool {
 	return true
 }
 
-// claimConflicts returns live claims by other sessions overlapping any path: a
-// claimed directory covers every path beneath it, and vice versa.
-func claimConflicts(live []*claimRecord, session string, paths []string) []*claimRecord {
+// claimConflicts checks logical and physical overlap for other live sessions:
+// a claimed directory covers every path beneath it, and vice versa.
+func claimConflicts(root string, live []*claimRecord, session string, paths []string) ([]*claimRecord, error) {
 	var out []*claimRecord
+	var physical []string
 	for _, rec := range live {
 		if rec.Session == session {
 			continue
 		}
-		if slices.ContainsFunc(rec.Paths, func(held string) bool {
+		overlaps := slices.ContainsFunc(rec.Paths, func(held string) bool {
 			return slices.ContainsFunc(paths, func(p string) bool { return claimPathsOverlap(held, p) })
-		}) {
+		})
+		if !overlaps {
+			if physical == nil {
+				var err error
+				physical, err = physicalClaimPaths(root, paths)
+				if err != nil {
+					return nil, err
+				}
+			}
+			held, err := physicalClaimPaths(root, rec.Paths)
+			if err != nil {
+				return nil, fmt.Errorf("claim %s: %w", rec.ID, err)
+			}
+			overlaps = slices.ContainsFunc(held, func(h string) bool {
+				return slices.ContainsFunc(physical, func(p string) bool { return claimPathsOverlap(h, p) })
+			})
+		}
+		if overlaps {
 			out = append(out, rec)
 		}
 	}
-	return out
+	return out, nil
 }
 
 // claimPathsOverlap folds case always: on a case-sensitive filesystem a false
@@ -482,6 +500,37 @@ func addClaimTargets(root, session, reason string, ttl int, raw, workspaces []st
 	return id, code
 }
 
+// Caller holds the repository claims lock through new-wave publication.
+func checkWriterClaimsLocked(root, session string, paths []string) error {
+	if len(paths) == 0 {
+		return nil
+	}
+	latest, order, bad, err := readClaims(claimsPath(root))
+	if err != nil {
+		return err
+	}
+	if bad > 0 {
+		return fmt.Errorf("%d unparsed ledger line(s); cannot rule out a writer claim", bad)
+	}
+	probe := newHolderProbe()
+	retained, err := retainedWriterConflicts(root, latest, paths, probe)
+	if err != nil {
+		return err
+	}
+	if len(retained) > 0 {
+		return fmt.Errorf("abandoned writer still holds claim %s on %s; confirm host termination and use dispatch abandon --release before retrying", retained[0].ID, strings.Join(retained[0].Paths, ","))
+	}
+	conflicts, err := claimConflicts(root, probe.withoutGone(liveClaims(latest, order, time.Now().UTC())), session, paths)
+	if err != nil {
+		return err
+	}
+	if len(conflicts) > 0 {
+		rec := conflicts[0]
+		return fmt.Errorf("live writer claim %s on %s held by session %q until %s", rec.ID, strings.Join(rec.Paths, ","), rec.Session, rec.ExpiresAt)
+	}
+	return nil
+}
+
 func claimAddLocked(path, session, reason string, ttl int, paths, admissionPaths []string, stdout, stderr io.Writer) (string, int) {
 	latest, order, bad, err := readClaims(path)
 	if err != nil {
@@ -503,7 +552,11 @@ func claimAddLocked(path, session, reason string, ttl int, paths, admissionPaths
 		printConflicts(stderr, retained)
 		return "", 3
 	}
-	conflicts := claimConflicts(probe.withoutGone(liveClaims(latest, order, now)), session, paths)
+	conflicts, err := claimConflicts(filepath.Dir(path), probe.withoutGone(liveClaims(latest, order, now)), session, admissionPaths)
+	if err != nil {
+		fmt.Fprintf(stderr, "claim: %v\n", err)
+		return "", 3
+	}
 	if len(conflicts) > 0 {
 		printConflicts(stderr, conflicts)
 		return "", 3
@@ -698,7 +751,11 @@ func claimCheckLocked(root, session string, paths []string, stdout, stderr io.Wr
 		printConflicts(stdout, retained)
 		return 3
 	}
-	conflicts := claimConflicts(probe.withoutGone(liveClaims(latest, order, time.Now().UTC())), session, paths)
+	conflicts, err := claimConflicts(root, probe.withoutGone(liveClaims(latest, order, time.Now().UTC())), session, paths)
+	if err != nil {
+		fmt.Fprintf(stderr, "claim: %v\n", err)
+		return 2
+	}
 	if len(conflicts) > 0 {
 		printConflicts(stdout, conflicts)
 		return 3