devrites 7.3.4 → 7.3.6

package/pack/generated/dsh/skills/devrites-lib/SKILL.md

@@ -39,6 +39,8 @@ lifecycle state from chat or optional `README.md`.
   completion states. The host renders the response normally.
 - [`reference/parallel-workspaces.md`](reference/parallel-workspaces.md): explicit
   phase targets, one isolated global controller, and source-owned proof.
+- [Autocomplete loop](../rite-autocomplete/reference/loop.md#early-preparation-admission):
+  controller-only early preparation, bounded successor routing and normalization research.
 - [`reference/visual-playbooks/index.md`](reference/visual-playbooks/index.md): progressive
   visual HTML playbook router (load matching ids only; dual-read outline).
 

package/pack/generated/dsh/skills/devrites-lib/reference/parallel-workspaces.md

@@ -12,65 +12,45 @@ candidate bindings and proof belong to that source. A missing source artifact
 routes its prerequisite; it never falls back to another workspace's artifacts.
 An explicit valid workspace does not require ACTIVE to name it or to exist.
 
-Carry that source through Spec → Clarify → Temper → Define/Plan → Vet and later
-Build/Converge/Prove/Polish/Review/Seal/Ship entrypoints. Use existing slug arguments
-where supported, including `context <source>` and `handoff <source> --resume`.
-For qid-only `state resolve` (including `--drop`/`--batch`), keep its existing argv
-and bind the call with `DEVRITES_ROOT=<absolute-control>/.devrites` and
-`DEVRITES_WORKSPACE=<absolute-control>/.devrites/work/<source>`. The override is a
-workspace path, not a slug. Apply this environment only to that invocation;
-neither a fabricated resolver slug argument nor process-global environment
-mutation is routing. Use the same source binding for nested recommended answers.
-
-Preparing or running an admitted future source preserves the ordered owner's
-ACTIVE and retained writer/controller. Ordinary standalone Spec still sets ACTIVE;
-explicit `--lookahead` still stops at planning/Vet and never becomes a Build root.
+Carry SOURCE through every phase, nested resolution and cold handoff. Use existing
+slug arguments (`context <source>`, `handoff <source> --resume`). Qid-only
+`state resolve` retains its argv: bind only that invocation's `DEVRITES_ROOT` and
+`DEVRITES_WORKSPACE` as above, never a fabricated resolver slug or process-global
+change. Early future work preserves ACTIVE and the retained controller.
+Standalone Spec still sets ACTIVE; `--lookahead` remains planning/Vet-only.
 Target binding changes neither phase approval nor Ship authority.
 
 ## Authority and admission
 
-Resolve one controlling root and ordered lifecycle owner. `.devrites/ACTIVE` stays
-on that owner until normal sequence handoff; scheduling a future slice does not
-advance ACTIVE or create a second Build root. One repository-global lease owns
-control-tip mutations. Resume its controller, source identities and retained
-handles before admitting more work; status queried via ACTIVE/source reports the
-actual retained controller even after ordered handoff. Another retained
-controller is not bypassable; no extra cursor pointer is needed.
-
-The existing `--parallel N` is one global active-writer cap, not a target guarantee:
-explicit invocation value, else AFK `max_parallel`, else retained lease capacity
-on resume, else 10. Explicit 1 means one writer, not one writer per workspace.
-Review queues obey host capacity and existing reviewer caps separately; neither
-capacity nor a Reslice cap waiver waives required named-role fanout or proof gates.
-
-Use the engine frontier below for recorded source-related sequence membership.
-Honor `continue_sequence: false`, opening budget and human bounded requests.
-Charge each opening once; reuse prepared children and their cursor.
-Unrelated directories or user-mentioned slugs are not automatic enrollment.
-Respect workspace claims: a live lookahead owner retains its artifacts until
-release/terminal reconciliation. Root alone writes workspace artifacts; leaves
-never write `.devrites/**`.
-
-For each future slice, native Plan/Vet must have CURRENT approved readiness,
-a complete bound contract and explicit `Workspace dependencies` under
-[canonical slice grammar](workspace-artifact-schema.md#canonical-slice-grammar).
-Plan/Vet checks assumptions, consumed interfaces, shared runtime resources and
-independent slice proof. `none` is a native declaration, never an inference from
-path disjointness, local `Dependencies: none`, planning digests or a green branch.
-Only durably BUILT/integrated producer checkpoints satisfy qualified dependencies;
-validate each producer reference and graph, including safely archived predecessors.
-Cycles, unknown/malformed references and shared unisolated runtime withhold unsafe
-candidates. A waiting producer withholds only its consumers, not unrelated work.
-
-Missing declarations in legacy future plans need narrow Plan repair + affected
-Vet before early admission; existing local/standalone plans remain valid. Absent,
-incomplete, stale or human-blocked future work is a planning/repair/blocked
-opportunity, not a fatal pool failure. Retain every readiness reason: fixing stale
-bindings does not waive a coexisting human/access/safety gate. Re-Vet affected
-predecessor assumptions, then record current bindings; never auto-refresh a digest.
-Read archived predecessors in place through the engine's referenced read-only
-readiness lookup. Never copy an archive into live `work/` merely to read/hash it:
-that can resurrect stale controller leases and claims.
+Keep ACTIVE on the ordered owner until normal handoff. One repository-global
+lease owns control-tip mutations; recover its controller, source identities and
+handles before more admission, including after handoff. No second Build root.
+`--parallel N` caps active writers globally: explicit N, else AFK `max_parallel`,
+else retained capacity on resume, else 10. One means one writer total. Review
+queues retain host/reviewer caps; capacity or Reslice never waives fanout or proof.
+
+Only checked source-related sequence membership qualifies; user-mentioned or
+unrelated directories are not enrollment. Current canonical `roadmap.md` follows
+[the grammar](workspace-artifact-schema.md#what-each-file-owns): one related live/
+archived owner, actual chain root, same-owner unique decision and contiguous
+position table. It supersedes historical tables for scheduling without rewriting
+them. Invalid canonical authority fails closed; absence retains conservative
+legacy resolution. Honor opt-out, opening budgets and human bounds; charge each
+opening once. Lookahead claims retain artifacts through terminal reconciliation.
+Root alone writes workspace artifacts; leaves never write `.devrites/**`.
+
+Native Plan/Vet must bind CURRENT readiness, contract, producer assumptions and
+explicit future `Workspace dependencies` per [slice grammar](workspace-artifact-schema.md#canonical-slice-grammar).
+`none` is a native declaration, not an inference from paths, local dependencies,
+digests or green branches. Only durable BUILT/integrated checkpoints satisfy
+validated producer references/graphs, including safely archived predecessors.
+Unknown references, cycles and shared unisolated runtime withhold unsafe slices;
+waiting producers withhold consumers, not independent work. Legacy future plans
+need narrow Plan repair/affected Vet; standalone/local plans retain their rules.
+Per-slice withheld diagnostics do not block other returned eligible IDs;
+workspace-wide readiness failures still withhold the source.
+Preserve coexisting stale-readiness and human/access/safety reasons. Re-Vet changed
+assumptions; never auto-refresh digests or copy archives into live `work/`.
 
 ## Recover avoidable serialization
 
@@ -108,66 +88,79 @@ reslicing unchanged work.
 
 ## Continuous global frontier
 
-Autocomplete executes this bounded pass at every phase entry (including cold
-Prove/Vet/Review), before phase-local recovery, on each landing/planning/review
-return, and immediately before a native wait or final reply. A nested phase
-returns scheduling to Autocomplete; its source-local phase/recovery return cursor
-and pending native reviewer handles remain intact. This is not a second phase
-controller or a persistent frontier artifact.
-
-1. Run `devrites-engine frontier <source>` before local recovery or selection.
-   This read-only report names the related pool, preparation/repair actions and
-   blockers; it neither authorizes work nor changes the source's local cursor.
-   For `frontier-prepare` and `frontier-workspace` prepare/repair actions, execute
-   authorized native Spec → Clarify → Temper → Define/Plan → affected Vet now,
-   not after owner Seal. Check source gates, claims and planning/Build restrictions.
-   For `frontier-review-sequence`, read the named approved roadmap/artifacts:
-   native authority normalization must record the exact continuation through its
-   owning decision/phase before rerunning frontier. Ambiguous legacy prose,
-   positive remaining budget and path disjointness never imply permission.
-   Retain unresolved authority blockers; continue independent authorized work.
-   Owner-local red/human/access gates withhold that owner and actual consumers;
-   whole-run safety/access/claim constraints still bind. Record actions/blockers
-   in existing source artifacts under normal write authority.
-   Yield children at pending reviewer/phase boundaries; reconcile available
-   parent returns before another pass. Reporting actions or reading phase skills
-   is not executing preparation/Vet. Wait only after authorized actions across
-   the pool have run or reached concrete pending handles/blockers.
-2. Reconcile explicit/AFK capacity changes with
-   `parallel add --root <repo> --slug <controller> --cap N --json -`, stdin `[]`.
-   This changes capacity only. Below active count, pause admissions, drain and
-   retry; never cancel workers to meet a lower cap. Recover a pending recorded
-   landing before admission; unrelated HEAD/ref movement remains blocked.
-   Rerun frontier after preparation/repair or capacity changes. Execute returned
-   `frontier-select-command` with only authorized live `--workspaces`: this exact
-   candidate list includes the `--slug` controller only when eligible. This is
-   internal, not a new user flag. `frontier: none` retains source-local routing.
-   Source-local `parallel select --from-plan` notices neither select globally nor
-   expand picks. Route notices to their source; running slots/paths seed mixed
-   selection globally. Zero picks with live writers means continue planning/review
-   or wait, not Prove for unfinished sources.
-3. Preflight selected slices against their SOURCE workspace with Build's normal
-   slice/readiness/precondition, exact-path and runtime-isolation gates. Early
-   foreign Build always uses isolated workers. For cap>1 on a capable host,
-   isolate even the first lone local writer, so later sources can refill. Persist
-   `--cap N` on create/add. With a retained lease, add even one pick; a complete
-   retained lease can reopen only at unchanged control tip. After cleanup,
-   create a new batch from current control. Never start another controller.
-   Unsupported isolation uses truthful serial owner dispatch and ordinary ordered
-   handoff, never early same-tree foreign Build or concurrent same-worktree writers.
-4. Launch every selected native writer before waiting on any; keep scheduling
-   planning and independent review while they run, including while the owner
-   awaits Prove/Vet/Review accounts. Apply the protected window below before any
-   landing: defer control mutations while frozen validation is pending. Outside
-   that window, land each individually green sibling through Build review/proof
-   and `parallel integrate --slice <key>`; refill immediately from the whole pool.
-   A red or `integrate-failed` sibling retains its slot/paths for repair; it does
-   not halt independent safe landings/refill. A pending landing intent still
-   requires exact recovery above. Only durable integration satisfies producer edges.
-   After worker-bound review/proof and source bookkeeping finish, prune only
-   verified clean integrated checkouts with `parallel prune --root <repo>
-   --slug <controller>`. Retain transfer refs/lease identities; dirty or ignored
-   data stays with its reported recovery path and does not justify forced deletion.
+Run this pass at phase entry, before local recovery/waits/reply, and after landing
+or planning changes. A persisted `dispatch return` emits fresh scheduling after
+locks release, even when later claim release fails: retain the nonzero failure
+and claim exclusion. Exact successful claim reconciliation also refreshes;
+rejected/unpersisted returns do not. Ordinary status stays read-only. Keep local
+return cursors and native handles: one controller, not another phase or queue.
+
+1. Read `devrites-engine frontier <source>`, then its selected `frontier-authority`
+   paths before preparation. Follow the actual owner/decision, including archives;
+   local phase context is not a reason to create a second owner. Execute native actions.
+   Normalize unresolved legacy sequence authority through its owning decision/
+   phase. Positive budget, ambiguous prose or path disjointness grants nothing.
+   A current invalid canonical map is an error, never a fallback to history.
+   At controller cap>1, resolve sequence authority and start actual immediate-
+   successor preparation before ordinary local Temper/Define/Plan/Vet context or
+   dispatch open, and retain the full Build gate before claims/rounds/history.
+   Follow [early preparation](../../rite-autocomplete/reference/loop.md#early-preparation-admission)
+   for native launch/start, internal markers and bounded preparatory-only routing.
+   Missing targets need native Spec → Clarify → Temper → Define/Plan → affected
+   Vet; existing targets need current completed/readiness state, registered pending
+   native preparation, or an existing human/dependency hold. Completed live/
+   archived successors need no reopening; valid finite tails discharge the
+   obligation. Placeholders, reports and unopened waves prove nothing.
+   Opt-out, zero opening budget or source human/question holds prevent new
+   openings, not existing child preparation or independent work.
+   If preparation cannot start, retain `frontier-blocked: <successor> — <constraint>`
+   in source `evidence.md`. `frontier-blocked: sequence — <constraint>` may defer
+   unresolved historical normalization for valid independent local work. Each row
+   names one concrete native-reviewed constraint; keep it visible and revisit on
+   change. It discharges only that scheduling obligation, not readiness, malformed
+   canonical/AFK data, paths, claims, isolation, proof or human gates. It cannot
+   waive already-ready foreign picks or certify preparation/normalization.
+2. Reconcile explicit/AFK capacity via `parallel add --root <repo> --slug
+   <controller> --cap N --json -`, stdin `[]`. Below occupied count, freeze every
+   new launch, even reserved waves; reconcile/drain and retry without cancelling.
+   Recover recorded landing intent; unrelated HEAD/ref movement
+   stays blocked. Rerun frontier after changes and execute its exact authorized
+   `frontier-select-command`. Local select notices do not broaden picks. Existing
+   global slots and paths seed selection; reserve the mixed cohort in create/add
+   before separate source-local wave opens. Reservations assemble width, never
+   prove actor checkout/start. Ready foreign picks cannot disappear behind local
+   `serial:` records. A foreign deferral is exactly
+   `serial: child/SLICE-001 — <reason>` in source evidence; bare `SLICE-001` is local.
+   Substantive-reason rules apply; native workflow judges the constraint.
+   Re-evaluate owning serial rows when constraints change; engine checks exact
+   scope, not the truth of a host/resource claim.
+   Discharged deferrals are not repeatedly actionable. Foreign work/preparation
+   and authority normalization precede local Build; local-only reconciliation,
+   repair and picks retain their owning phase, not recursive Autocomplete.
+   Zero picks with live writers means planning/wait, not premature Prove.
+3. Apply SOURCE Build readiness/preconditions, exact paths and runtime isolation.
+   Early foreign Build always uses isolated workers. On a capable host at cap>1,
+   isolate even the first local writer for later refill; persist `--cap N`.
+   Add one pick to a retained lease; reopen a complete lease only at unchanged
+   control tip, or create from current control after cleanup. Unsupported
+   isolation uses qualified serial deferral, truthful local-owner dispatch and
+   ordinary ordered handoff, never early same-tree foreign/concurrent writers.
+   New dispatch accounts retain opaque `controller_batch` and immutable per-slice
+   normalized `admitted_paths`. Retain only each pending writer's lane; returned/
+   integrated siblings may release slots for rolling refill. Missing snapshots or
+   changed lease paths require actor reconciliation, never backfill from new tasks.
+   Exact claim identity/session still matters; release/expiry does not stop an actor.
+   Same-session claims allocate space, not extra write authority. None of these
+   records proves actual cwd/profile: verify through the native host.
+4. Start every selected native writer before waiting; continue independent native
+   planning/review while they run. Protected validation defers unsafe landings,
+   not independent preparation. Outside that window, land individually green
+   siblings through Build review/proof and `parallel integrate --slice <key>`;
+   refill globally. Red/integrate-failed siblings keep slots/paths for repair.
+   Durable integration alone satisfies producer edges. After worker-bound
+   accounts and source bookkeeping settle, `parallel prune --root <repo> --slug
+   <controller>` removes only verified clean integrated checkouts, retaining
+   transfer refs/lease identities. Dirty/ignored data keeps its recovery path.
 
 ## Identity, dispatch and proof
 

package/pack/generated/dsh/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -51,6 +51,7 @@ time. No `state.md` run-mode field can drift out of sync.
 Presence = AFK active. The file body is optional YAML:
 
 ```yaml
+mode: autocomplete # optional controller identity; absent = standalone AFK
 max_slices: 10 # whole-workspace writer budget; seeds state.md remaining count
 max_agents: 32                       # native agent dispatches in one host activation
 max_minutes: 120                     # min; /rite-autocomplete: not a ceiling
@@ -61,10 +62,13 @@ notify: 'curl -fsS -m 10 -d "$DEVRITES_QID: $DEVRITES_QUESTION" ntfy.sh/my-topic
 allow_gates: [advisory, validating]  # gate severities AFK auto-handles (auto-picks the recommended option)
 continue_sequence: true              # after Seal GO, open the next recorded continuation
 max_workspaces: 5                    # workspaces one armed sequence may open
-max_parallel: 10 # unattended default cap; `--parallel N` on this invocation wins and may rewrite only this field
+max_parallel: 10 # global writer cap; explicit --parallel N wins
 ```
 
-The file is **read-only config**: never rewritten in place, except `/rite-autocomplete --parallel N` writes or replaces only `max_parallel: N`.
+AFK is read-only after entry. Explicit `/rite-autocomplete` upserts only
+`mode: autocomplete` and, with `--parallel N`, `max_parallel: N`; preserve other
+fields. Missing mode keeps standalone behavior; invalid/duplicate mode fails
+closed. Mode identifies scheduling, never grants phase, safety or Git authority.
 
 Outside active `/rite-autocomplete`, the following slice-budget rules apply:
 `max_slices` seeds root-owned `state.md` cursor `afk_slices_remaining`
@@ -103,10 +107,9 @@ malformed values fail closed; `0` opens nothing.
 candidate manifest to cover the whole recorded chain — run
 `devrites-engine state merge-manifest <slug>` before Prove.
 
-- Only continuations recorded in the parent's `decisions.md` sequence
-  ([slicing.md § Continuation workspaces](../../../rite-plan/reference/slicing.md#continuation-workspaces))
-  qualify; no next entry or exhausted `max_workspaces` stops with that reason. The review-queue bound applies only outside active
-  `/rite-autocomplete`.
+- Only checked recorded continuations qualify, under the
+  [sequence grammar](../workspace-artifact-schema.md#what-each-file-owns).
+  No next entry or opening budget stops new openings, not existing child work.
 - Milestones are **not** shipped: they stay sealed and unarchived in `.devrites/work/`
   with `Next step: /rite-ship` preserved. Local `WIP(<slug>):` checkpoints still
   land ([checkpoint.md](../../../rite-build/reference/checkpoint.md)), so the tree
@@ -118,15 +121,13 @@ candidate manifest to cover the whole recorded chain — run
   `/rite-autocomplete` recovers agent-owned Seal `NO-GO` per
   [stop-conditions.md](../../../rite-autocomplete/reference/stop-conditions.md), not a handoff.
 
-`max_parallel` is the unattended default writer cap when this invocation omits
-`--parallel N`; explicit N wins and Autocomplete writes/replaces only that field.
-Build's explicit flag wins without rewriting the sentinel. Never write
-`max_slices` from `--max-slices`. Autocomplete uses one cap across all authorized
-sources, including explicit 1, under the shared root-only
-[`workspace controller`](../parallel-workspaces.md); standalone Build stays local.
-Unattended runs recompute after each landing and planning/review return, not only
-after a batch completes. **Failing case:** `/rite-autocomplete --parallel 5`
-honors leftover `max_parallel: 1`, or grants five writers per workspace.
+`--parallel N` wins over AFK `max_parallel`, else retained lease capacity on
+resume, else 10. Build's flag never rewrites AFK; explicit controller entry may
+update only mode/capacity. One cap covers all admitted sources, even explicit 1;
+standalone Build stays local. Follow the [global pass](../parallel-workspaces.md#continuous-global-frontier)
+for immediate-successor preparation, narrow `frontier-blocked` deferrals,
+qualified foreign `serial:` handoff and automatic dispatch-return scheduling.
+These are scheduling disclosures, never readiness, isolation, proof or Ship waivers.
 
 ## Unattended resource envelope
 
@@ -157,8 +158,8 @@ applicable remaining limit. Agent/time/token/cost counters are per native activa
 for a new activation. Slice/recovery state and review queue remain durable/recomputed across wakes.
 Persist stops/checkpoints before notification.
 
-New sentinels omit `expires_at` and notification/token/cost caps. Post-Vet pending
-count may lower standalone slices. Never add missing defaults to existing files.
+Fresh AFK omits expiry and notification/token/cost caps. Standalone post-Vet
+counts may lower slices; preserve existing fields except controller entry above.
 
 Delete the file to restore HITL on the next invocation.
 

package/pack/generated/dsh/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -1,10 +1,9 @@
 # Workspace artifact schema
 
 Feature truth: `.devrites/work/<slug>/`, discovered by `state.md`; remnants/archives
-are inactive. Spec writes optional `README.md`. Use canonical filenames; both released
-cursor forms remain readable, but a cursor with no `schema` row needs
-`devrites-engine migrate <slug>` before the engine accepts it. `/rite-upgrade` audits
-without path/alias/format migration.
+inactive. Spec's `README.md` is optional. Use canonical filenames. Both released
+cursors read; no `schema` requires `devrites-engine migrate <slug>`.
+`/rite-upgrade`: audit only, no path/alias/format migration.
 
 ## Contents
 
@@ -59,6 +58,7 @@ accept safe legacy basenames. Ordinary phases never rename them.
 | `visual/<name>.outline.md` | required machine dual-read companion for the sibling HTML; outline wins on conflict; never a candidate path | 200 lines (advisory; not gate-checked) |
 | `visual/README.md` | optional index of visuals in the workspace | 80 lines (advisory; not gate-checked) |
 | `decisions.md` | ADR-style `DEC-###` log: status, context, options, decision, consequences, related IDs; optional `Files:`/`Tags:` fields make entries queryable by path or theme; Build's `## Carry-forward constraints` lines (rule, source slice, evidence, `Files:`) | 200 lines |
+| `roadmap.md` | optional sequence authority (below); headerless maps stay legacy | — |
 | `assumptions.md` | assumptions with confidence, owner, validation status | 160 lines |
 | `questions.md` | current `q-YYYY-MM-DD-NNN` (or released `Q-###`) open/resolved questions, gate, answer, impact | 180 lines |
 | `plan.md` | technical approach, slice strategy, canonical shared-contract proof, validation strategy, rollback | 220 lines |
@@ -85,6 +85,17 @@ accept safe legacy basenames. Ordinary phases never rename them.
 For visual pairs load only matching [playbooks](visual-playbooks/index.md); use
 the [required outline headings](visual-playbooks/outline-template.md).
 
+Canonical `roadmap.md`: either header claims explicit authority; require both
+`Sequence root: <actual-anchor-slug>` and `Decision: DEC-NNN`, identifying one
+`## DEC-NNN` in owner-local `decisions.md`. One related live/archive owner, one
+`Position`/`Workspace` table: contiguous from 1, unique valid slugs matching all
+related positions/exact successors; no unenrolled nodes. Valid authority supersedes
+history for scheduling; preserve historical bytes. Headerless maps remain legacy.
+Partial/malformed headers, multiple owners, invalid root/decision/table, symlink
+or unreadable maps fail closed, no fallback. Native normalization records approved
+actual identities, preserves history. Engine identity checks grant no semantic
+approval, independence, Build or Ship readiness.
+
 ## Candidate manifest and bindings
 
 `touched-files.md` contains exactly one `## Touched files` heading and exactly
@@ -141,40 +152,32 @@ The worktree digest is deterministic but is not an atomic filesystem snapshot
 against a malicious concurrent same-size rewrite. Ship's exact Git-index scope,
 byte, binding, and secret checks own the final freeze immediately before commit.
 
-Only a structural `Budget override: <=N lines; <reason>` line (not a fenced example)
-permits excess, up to N lines and N×400 bytes with N at most 2× the line budget; a
-reason-only override counts as none. Each line budget also bounds bytes at 400 bytes
-per budgeted line (`state.md` 120 lines → 48 KiB); long lines do not evade it. `orient`
-reports `artifact_budgets` (lines/bytes/over/override) and `bulk_files` (non-canonical
-files over 64 KiB) so a phase can decide what to read before loading; phase writers
-check these limits before returning, with no repository-local script assumption.
-
-`check readiness`, `check seal` and `state append` enforce the material band: any present
-budgeted artifact (required or not, `drift.md` included) at or above 1.5× its line or
-byte budget with no covering override blocks with the exact measurement and three legal
-remedies (relocate history losslessly via `/rite-plan revise`, split via `/rite-plan
-course-correct`, or record the bounded override). Past 2× only relocation or split remain.
-Overshoot below that band stays advisory and is reported by `orient`. Proof ledgers
-(`evidence.md`, `browser-evidence.md`, `touched-files.md`) are always advisory: they
-scale with proof volume, and `touched-files.md` keeps its own manifest limits.
-Because they are never gate-blocked they are also the only artifacts that can grow
-unboundedly — so phases read them by index, not whole-file: the standalone binding
-line, a `EVID-###`/section-header index (`grep -n`), then bodies only for entries
-naming this candidate's AC/slice IDs. An entry naming no in-scope ID is anomaly
-evidence to inspect, not skip. A whole-file read is allowed only when `orient`
-reports the artifact within budget; completeness for seal is engine-checked
-(literal `AC-###` presence), the reader judges quality.
-
-Two reasons are not durable fixes: slice or acceptance-criteria count (an over-budget
-`tasks.md`/`plan.md`/`traceability.md` from decomposition size is a
-[feature-sequence split](../../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget)),
-and history in `state.md` (checkpoint narrative moves verbatim to
-`history/<file>-<YYYYMMDD>.md`, append-only, never a phase read-next, with a one-line
-pointer left behind). A legacy reason-only `Budget override:` line no longer clears a
-gate; `/rite-upgrade` routes it to relocation or the split, and new writers never create one for those two reasons.
-Apply [[`context-hygiene.md`](standards/context-hygiene.md) dispatch packets](standards/context-hygiene.md#dispatch-packets)
-for byte-size checks and lossless retrieval; budget overrides neither rewrite protected
-history nor require loading it all.
+Only structural `Budget override: <=N lines; <reason>` outside fences permits N
+lines/N×400 bytes, N ≤ 2× budget. Reason-only overrides count as none. Budgets:
+400 bytes/line (`state.md`: 120 lines/48 KiB); long lines cannot evade them.
+`orient`: `artifact_budgets` (lines/bytes/over/override), `bulk_files` (non-canonical
+files >64 KiB). Writers check limits before returning; no local script assumed.
+
+`check readiness`/`check seal`/`state append` block present budgeted artifacts
+(optional/`drift.md` included) at ≥1.5× lines or bytes without covering override.
+Report exact measurement and remedies: lossless relocation (`/rite-plan revise`),
+split (`/rite-plan course-correct`), bounded override. Past 2×: relocation/split
+only; below 1.5×: advisory in `orient`.
+Proof ledgers (`evidence.md`, `browser-evidence.md`, `touched-files.md`) alone may
+grow unbounded, always advisory; manifest limits still apply. Read standalone
+binding, `EVID-###`/section index (`grep -n`), then candidate AC/slice bodies.
+Inspect no-in-scope-ID entries as anomalies. Whole-file reads require `orient`
+within budget; Seal checks literal `AC-###` completeness, reader judges quality.
+
+Slice/AC count and cursor history never justify durable overrides. Decomposition
+overflow (`tasks.md`/`plan.md`/`traceability.md`) requires a
+[feature-sequence split](../../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget).
+Move `state.md` narrative verbatim to append-only `history/<file>-<YYYYMMDD>.md`;
+leave a one-line pointer; history never enters phase read-next. Legacy reason-only
+overrides cannot clear gates: `/rite-upgrade` routes relocation/split; new writers
+never override these reasons. Use
+[dispatch packets](standards/context-hygiene.md#dispatch-packets)
+for byte checks/lossless retrieval. Overrides neither rewrite nor require loading protected history.
 
 ## Anchored notes
 

package/pack/generated/dsh/skills/rite-autocomplete/SKILL.md

@@ -86,48 +86,45 @@ With `--lookahead` (trigger `lookahead`), follow
 [`lookahead.md`](reference/lookahead.md) instead of the steps below: plan the
 next sequence continuation through Vet in a second session, then stop.
 
-1. **Orient and parse.** Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding); when a workspace exists,
-   require its `state.md` and read its cursor; a fresh idea starts empty at step 2.
-   After normalizing arguments below, run `devrites-engine frontier <source>`
-   before phase-local cold recovery; execute its actions under the shared
-   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
-   Before honoring `blocked` with terminal `next_action`,
-   reconcile retained consumptive evidence and fingerprint attempts from
-   `drift.md`/`evidence.md`; a retained fingerprint below its cap resumes offline
-   recovery, and this new invocation reopens each parked fingerprint.
+1. **Orient and parse.** Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding).
+   Read its existing cursor; a fresh idea starts empty at step 2. Normalize this
+   invocation to idea, `ship_preflight: yes|no`, `max_slices: unlimited`,
+   `parallel: N|default`, `profile: standard|full`, `cross_model: yes|no`.
+   Apply the loop's [AFK contract](reference/loop.md#arm-afk-once) to an existing
+   sentinel: upsert `mode: autocomplete`, plus capacity only for explicit
+   `--parallel N`. Mode identifies this controller, never grants authority.
+   Run `devrites-engine frontier <source>` before local recovery; execute the
+   [global pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
+   Reconcile blocked/terminal cursors against retained action evidence and exact
+   fingerprint attempts; resume offline recovery below its cap. This explicit
+   invocation reopens parked fingerprints. Reconstruct missing return cursors
+   only from the current phase and approved `test-plan.md`/evidence action.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"lifecycle cursor encounters admitted set or resumable journal","action":"invoke classifier; execute returned route internally","return":"saved phase/action; zero intermediate reply"} -->
-   Reconstruct a missing return cursor only from
-   the current phase and exact approved action in `test-plan.md`/evidence, never
-   from chat. After compaction or a resumed session, always run `devrites-engine
-   handoff <source> --resume` first for that selected source and open only the
-   `read_next` artifacts it names, per [`context-hygiene.md`](../devrites-lib/reference/standards/context-hygiene.md) § Compaction fallback.
-   Normalize current arguments to idea, `ship_preflight: yes|no`,
-   `max_slices: unlimited`, `parallel: N|default`, `profile: standard|full`,
-   and `cross_model: yes|no`.
-   **Completion:** arguments and source authority are unambiguous; local cursor and pending handles remain intact.
+   After compaction/resume, run `devrites-engine handoff <source> --resume`
+   and open its `read_next` artifacts per [context hygiene](../devrites-lib/reference/standards/context-hygiene.md).
+   **Completion:** arguments/source are unambiguous; local cursor and handles survive.
 2. **Specify and clarify.** Run `devrites-interview`, `/rite-spec`, and
    `/rite-clarify` as one window. `open` material coverage never arms
    AFK. **Completion:** `Decision coverage: CLEAR` is durable.
-3. **Arm AFK once.** Apply the loop's
-   [one-write AFK contract](reference/loop.md#arm-afk-once): preserve valid
-   existing bytes or create the sentinel once (`allow_gates: [advisory, validating]`); never
-   rewrite it after Vet except to write or replace only `max_parallel: N` when
-   this invocation contains `--parallel N`. Preserve an existing sentinel
-   byte-for-byte otherwise. **Failing case:** leftover `max_parallel: 1` keeps
-   the run serial after `--parallel 5`.
-   **Completion:** a valid read-only AFK sentinel exists.
-4. **Drive phases.** Follow [the loop](reference/loop.md): `/rite-spec` →
-   `/rite-clarify` → `/rite-temper` → `/rite-define` → `/rite-vet` →
-   `/rite-build` batch loop → `/rite-prove` → `/rite-polish` →
-   `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
-   chat, carry state. Apply the mutable post-vet budget before first Build.
-   Run `devrites-engine frontier <source>` at phase entry, before recovery,
-   on returns and before native waits; execute the shared
-   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier),
-   not merely its report. Autocomplete retains repository scheduling and local
-   cursors. Apply its protected validation window and pass resolved `--parallel N`
-   to Build under the same global cap and admission/isolation gates.
-   **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
+3. **Arm AFK once.** Apply the [one-write AFK contract](reference/loop.md#arm-afk-once):
+   create only after clarity; explicit controller entry upserts
+   `mode: autocomplete` and, only with `--parallel N`, `max_parallel: N`.
+   Preserve all other fields; reject malformed/duplicate mode rather than
+   silently becoming standalone AFK. **Completion:** valid controller identity
+   and capacity are durable; no gate or Git authority changed.
+   **Failing case:** leftover `max_parallel: 1` after explicit `--parallel 5`.
+4. **Drive phases.** Execute [the loop](reference/loop.md): Spec → Clarify →
+   Temper → Define → Vet → Build → Prove → Polish → Review → Seal. Durable files
+   carry state. Apply the mutable post-vet budget before Build. Consume fresh scheduling
+   emitted by recorded `dispatch return`; rerun frontier after further changes
+   and before waits. Before ordinary local Temper/Define/Plan/Vet context/dispatch,
+   resolve sequence authority and start actual immediate-successor preparation
+   under [early admission](reference/loop.md#early-preparation-admission),
+   or retain the global pass's concrete deferral; keep the full Build gate.
+   Derive initial preparatory-only routing before any marked wave; do not recurse
+   through the roadmap. Preserve local cursors, protected validation windows and
+   every admission/isolation gate; pass Build the resolved global cap.
+   **Completion:** Seal GO or a durable valid stop precedes later phases.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:
    route agent-owned red results through bounded recovery.