atris 3.16.0 → 3.17.0

package/commands/autopilot.js

@@ -12,6 +12,11 @@ const { execSync, execFileSync, spawnSync } = require('child_process');
 const readline = require('readline');
 const { getLogPath, ensureLogDirectory, createLogFile } = require('../lib/journal');
 const { parseTodo } = require('../lib/todo');
+const {
+  buildRunnerCommand,
+  buildRunnerAvailabilityCommand,
+  resolveClaudeRunnerBin,
+} = require('../lib/runner-command');
 const { findStalePages, findStaleTasks, healBrokenMapRefs } = require('./clean');
 const {
   buildScorecardData,
@@ -194,7 +199,7 @@ async function suggestNextTask(cwd, skipped = new Set(), { auto = false } = {})
   const { logFile } = getLogPath();
   if (fs.existsSync(logFile)) {
     const content = fs.readFileSync(logFile, 'utf8');
-    const inboxMatch = content.match(/## Inbox\n([\s\S]*?)(?=\n##|$)/);
+    const inboxMatch = content.match(/## Inbox\r?\n([\s\S]*?)(?=\r?\n##|$)/);
     if (inboxMatch && inboxMatch[1].trim()) {
       const items = inboxMatch[1].trim().split('\n').filter(l => {
         const t = l.trim();
@@ -393,7 +398,53 @@ function askHuman(taskTitle) {
 }
 
 /**
- * Run a phase via claude -p subprocess.
+ * Type-check a child_process error as a real wall-clock timeout. Node's
+ * execSync attaches `code: 'ETIMEDOUT'` (plus `signal`) on timeout — it does
+ * NOT set `killed`, so a `killed`-only guard is dead code on the exact error
+ * it was written for (lesson: etimedout-error-shape, 2026-06-10). A bare
+ * `signal` without ETIMEDOUT is NOT a timeout: it's an OOM SIGKILL or an
+ * external SIGTERM, and calling it a timeout misdiagnoses the cause.
+ */
+function isPhaseTimeoutError(err) {
+  return Boolean(err && err.code === 'ETIMEDOUT');
+}
+
+/**
+ * Any abnormal child death — timeout or signal kill. The group sweep in
+ * execPhaseCommandSync uses this wider net (orphans need sweeping either
+ * way); the thrown message uses the narrow predicate to name the cause.
+ */
+function isPhaseKillError(err) {
+  return Boolean(err && (err.killed || err.code === 'ETIMEDOUT' || err.signal));
+}
+
+/**
+ * execSync with the phase-timeout orphan fix. Node's sync-exec timeout signals
+ * only the direct child pid — the `/bin/sh -c` wrapper — so the `claude` it
+ * spawned kept committing 160–296s past the 600s wall (lesson:
+ * etimedout-error-shape, 2026-06-10). `detached: true` makes the wrapper a
+ * process-group leader; on timeout we sweep the whole group via
+ * `process.kill(-pid, 'SIGKILL')`. ESRCH on the sweep means the group already
+ * died — fine. The original error is rethrown untouched so every call site
+ * keeps its existing catch contract (err.stdout passthrough included).
+ */
+function execPhaseCommandSync(cmd, opts = {}) {
+  try {
+    return execSync(cmd, { ...opts, detached: true });
+  } catch (err) {
+    if (isPhaseKillError(err) && err.pid) {
+      try {
+        process.kill(-err.pid, 'SIGKILL');
+      } catch (sweepErr) {
+        if (sweepErr.code !== 'ESRCH') throw sweepErr;
+      }
+    }
+    throw err;
+  }
+}
+
+/**
+ * Run a phase via the configured runner subprocess.
  */
 function executePhaseDetailed(phase, context, options = {}) {
   const { verbose = false, timeout = PHASE_TIMEOUT } = options;
@@ -403,10 +454,11 @@ function executePhaseDetailed(phase, context, options = {}) {
   fs.writeFileSync(tmpFile, prompt);
 
   try {
-    const cmd = `claude -p "$(cat '${tmpFile.replace(/'/g, "'\\''")}')" --allowedTools "Bash,Read,Write,Edit,Glob,Grep"`;
+    const cmd = options.cmdOverride
+      || buildRunnerCommand({ promptFile: tmpFile, allowedTools: 'Bash,Read,Write,Edit,Glob,Grep' });
     const env = { ...process.env };
     delete env.CLAUDECODE;
-    const output = execSync(cmd, {
+    const output = execPhaseCommandSync(cmd, {
       cwd: process.cwd(),
       encoding: 'utf8',
       timeout,
@@ -419,7 +471,12 @@ function executePhaseDetailed(phase, context, options = {}) {
     return { prompt, output: output || '' };
   } catch (err) {
     try { fs.unlinkSync(tmpFile); } catch {}
-    if (err.killed) throw new Error(`${phase} timed out after ${timeout / 1000}s`);
+    if (isPhaseTimeoutError(err)) {
+      throw new Error(`${phase} phase timed out after ${timeout / 1000}s (configured runner hit the wall; any work it committed survives — reconcile from pre-tick HEADs)`);
+    }
+    if (isPhaseKillError(err)) {
+      throw new Error(`${phase} phase killed by ${err.signal || 'a signal'} before the ${timeout / 1000}s wall — not a timeout; check memory pressure or an external supervisor`);
+    }
     if (err.stdout) {
       return { prompt, output: err.stdout };
     }
@@ -452,6 +509,16 @@ function getContextFiles(phase, options = {}) {
   return [...new Set(files.filter(Boolean))].map((f) => `- ${f}`).join('\n');
 }
 
+// T35a (endgame loop-self-repair): shared-checkout git-safety contract.
+// Lesson 39: a concurrent tick's `git reset` destroyed a sibling repo's
+// uncommitted work. Sibling-repo edits ride per-tick worktrees (the same
+// ../repo siblings snapshotRepoHeads tracks); destructive git on the shared
+// checkout is forbidden (COORDINATION.md Rule 4). Interpolated into the
+// default and self-heal do prompts — never the benchmark prompt (it never
+// commits).
+const SHARED_CHECKOUT_GIT_CONTRACT = `- Shared-checkout git safety (COORDINATION.md Rule 4): edits to any repo OTHER than this tick's cwd (../atrisos-backend-style sibling repos) go through a per-tick worktree — start with \`atris worktree start --member <member> --task "<task>"\`, land with \`atris worktree ship --message "<msg>" --verify "<cmd>"\`. Never edit a sibling repo's shared checkout directly.
+- On a shared checkout, \`git reset\`, \`git checkout --\`, \`git clean\`, and stashing other agents' work are FORBIDDEN — concurrent ticks' uncommitted work lives there.`;
+
 /**
  * Build the right prompt for each phase, adapting to the kind of work.
  */
@@ -648,6 +715,7 @@ Rules:
 - Execute ONE step at a time. Verify each step before moving on.
 - Check MAP.md for file locations before grepping.
 - Stay in scope. Only fix the bug described in the lesson — no side quests.
+${SHARED_CHECKOUT_GIT_CONTRACT}
 
 Read these files first:
 ${readFiles}
@@ -672,6 +740,7 @@ Rules:
 - Check MAP.md for file locations before grepping.
 - If you hit two errors on the same step, stop and flag for re-scope.
 - Stay in scope. Don't touch files outside the task boundary.
+${SHARED_CHECKOUT_GIT_CONTRACT}
 
 Read these files first:
 ${readFiles}
@@ -742,6 +811,27 @@ If broken beyond quick fix, reply: failed — [reason].`;
   return '';
 }
 
+/**
+ * Build a clean kebab-case lesson slug from free text. Strips non-alphanumerics
+ * (em-dashes were leaking into slugs verbatim) and truncates at a word boundary
+ * instead of mid-word (e.g. the old `.slice(0, 40)` produced
+ * `verify-fail-per-member-model-selection-—-the-member-`).
+ */
+function lessonSlug(text, maxLen = 40) {
+  const base = String(text || 'unknown')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+  if (!base) return 'unknown';
+  if (base.length <= maxLen) return base;
+  const cut = base.slice(0, maxLen);
+  const lastDash = cut.lastIndexOf('-');
+  // base[maxLen] continues a word — back up to the last full word.
+  const atBoundary = base[maxLen] === '-';
+  const trimmed = atBoundary ? cut : (lastDash > 0 ? cut.slice(0, lastDash) : cut);
+  return trimmed.replace(/-+$/g, '') || 'unknown';
+}
+
 /**
  * Write a lesson to atris/lessons.md
  * Appends a line in format: - **[YYYY-MM-DD] slug** — pass/fail — explanation
@@ -884,6 +974,38 @@ function shouldAdoptPlannedVerify(kind) {
   return ['staleness', 'docs', 'review', 'inbox', 'cleanup', 'feature', 'lessons', 'imagined'].includes(kind);
 }
 
+// Task-plane status vocabulary lint. `atris task list/queue/current --status <s>`
+// only matches raw stored statuses (commands/task.js); `ready` is a TRANSITION
+// (`atris task ready` moves a task to review), so `--status ready` always
+// returns "(no tasks)" — a verify built on it is an unreachable gate; the
+// matching listable form is --status review (lessons.md
+// verify-status-vocabulary, 3rd occurrence 2026-06-10).
+const LISTABLE_TASK_STATUSES = ['open', 'claimed', 'review', 'done', 'failed'];
+const STATUS_CORRECTIONS = { ready: 'review' };
+
+function lintVerifyTaskStatusVocabulary(text) {
+  // Scan every `atris task list|queue|current` segment (compound verifies
+  // chain with && / || / ;), then pull its --status value if present.
+  const segmentRe = /\batris\s+task\s+(?:list|queue|current)\b([^|&;]*)/g;
+  let segment;
+  while ((segment = segmentRe.exec(text)) !== null) {
+    const statusMatch = /--status[=\s]+["']?([A-Za-z0-9_-]+)["']?/.exec(segment[1]);
+    if (!statusMatch) continue;
+    const status = statusMatch[1];
+    if (LISTABLE_TASK_STATUSES.includes(status)) continue;
+    const vocabulary = LISTABLE_TASK_STATUSES.join('|');
+    const corrected = STATUS_CORRECTIONS[status];
+    const suggestion = corrected
+      ? `use --status ${corrected} instead (atris task ${status} is a transition that lands tasks in ${corrected}, so --status ${status} never matches)`
+      : `use one of --status ${vocabulary}`;
+    return {
+      ok: false,
+      reason: `Verify uses unlistable task status "--status ${status}" — the listable vocabulary is ${vocabulary}; ${suggestion}`,
+    };
+  }
+  return null;
+}
+
 function validateVerifyCommandShape(cmd) {
   const text = String(cmd || '').trim();
   if (!text) return { ok: true };
@@ -893,6 +1015,8 @@ function validateVerifyCommandShape(cmd) {
   if (/\b(returns?|shows?|equals?|should|must)\b/i.test(text)) {
     return { ok: false, reason: 'Verify contains prose expectations instead of shell operators/assertions' };
   }
+  const statusLint = lintVerifyTaskStatusVocabulary(text);
+  if (statusLint) return statusLint;
   return { ok: true };
 }
 
@@ -1073,17 +1197,17 @@ function parseProposedBlock(lines) {
 }
 
 /**
- * Default executor for plan-review: spawn a fresh claude -p call.
+ * Default executor for plan-review: spawn a fresh configured runner call.
  * Kept thin so tests can inject a stub via options.planReviewExec.
  */
 function defaultPlanReviewExecutor(prompt, { cwd, timeout = 180000 } = {}) {
   const tmpFile = path.join(cwd, '.autopilot-plan-review.tmp');
   fs.writeFileSync(tmpFile, prompt);
   try {
-    const cmd = `claude -p "$(cat '${tmpFile.replace(/'/g, "'\\''")}')" --allowedTools "Bash,Read,Grep,Glob"`;
+    const cmd = buildRunnerCommand({ promptFile: tmpFile, allowedTools: 'Bash,Read,Grep,Glob' });
     const env = { ...process.env };
     delete env.CLAUDECODE;
-    const output = execSync(cmd, {
+    const output = execPhaseCommandSync(cmd, {
       cwd,
       encoding: 'utf8',
       timeout,
@@ -1112,7 +1236,18 @@ function defaultCodexExecutor(prompt, { cwd, timeout = 180000 } = {}) {
     timeout,
     stdio: 'pipe',
     maxBuffer: 10 * 1024 * 1024,
+    detached: true,
   });
+  // No sh wrapper here, but codex spawns its own children — sweep the group
+  // on timeout so they cannot outlive the wall (same orphan class as the
+  // claude sites; ESRCH means the tree is already dead).
+  if (proc.pid && ((proc.error && proc.error.code === 'ETIMEDOUT') || proc.signal)) {
+    try {
+      process.kill(-proc.pid, 'SIGKILL');
+    } catch (sweepErr) {
+      if (sweepErr.code !== 'ESRCH') throw sweepErr;
+    }
+  }
   if (proc.status !== 0 && !proc.stdout) {
     throw new Error(`codex exited with status ${proc.status}: ${proc.stderr || 'no output'}`);
   }
@@ -1258,6 +1393,216 @@ function appendPlanRejection(cwd, context, review) {
   }
 }
 
+// ── Timeout reconciliation (T33, endgame loop-self-repair) ─────────────────
+// A do-phase wall-clock timeout kills the reporter, not the work: 12 of 13
+// ETIMEDOUT halts in the 2026-06-10 RSI audit had real commits landed with no
+// receipt, no checked bullet, and a human halt (lessons: executor-timeout-wall,
+// tick-must-mark-own-bullet). These helpers let the tick reconcile from
+// pre-tick HEADs instead of halting when work provably landed.
+
+function todayJournalPath(cwd) {
+  const now = new Date();
+  const yyyy = now.getFullYear();
+  const mm = String(now.getMonth() + 1).padStart(2, '0');
+  const dd = String(now.getDate()).padStart(2, '0');
+  return {
+    logFile: path.join(cwd, 'atris', 'logs', String(yyyy), `${yyyy}-${mm}-${dd}.md`),
+    dateFormatted: `${yyyy}-${mm}-${dd}`,
+  };
+}
+
+/**
+ * Normalize text for fuzzy task-title matching: lowercase, strip code spans,
+ * tags, and markdown punctuation down to single-spaced words.
+ */
+function normalizeForMatch(text) {
+  return String(text || '')
+    .toLowerCase()
+    .replace(/`[^`]*`/g, ' ')
+    .replace(/\[[\w-]+\]/g, ' ')
+    .replace(/[^a-z0-9]+/g, ' ')
+    .trim()
+    .replace(/\s+/g, ' ');
+}
+
+/**
+ * A word-boundary-truncated normalized prefix of the task title, used to find
+ * the task's TODO bullet and journal receipts without exact-string fragility.
+ */
+function taskMatchNeedle(taskTitle, maxLen = 60) {
+  const norm = normalizeForMatch(taskTitle);
+  if (!norm) return '';
+  if (norm.length <= maxLen) return norm;
+  return norm.slice(0, maxLen).replace(/\s+\S*$/, '');
+}
+
+function gitHeadAt(dir) {
+  try {
+    return execSync('git rev-parse HEAD', { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Snapshot HEAD of the workspace repo plus any sibling repos named in the
+ * task text — both explicit `../atris-cli`-style refs (the journal convention)
+ * and bare sibling-directory names like `atris-cli` that resolve to a git
+ * repo next to cwd. Returns [{ label, dir, head }].
+ */
+function snapshotRepoHeads(cwd, taskText = '') {
+  const root = path.resolve(cwd);
+  const repos = new Map([[root, '.']]);
+  const text = String(taskText || '');
+  for (const ref of text.match(/\.\.\/[A-Za-z0-9._-]+/g) || []) {
+    const dir = path.resolve(cwd, ref);
+    if (dir !== root && fs.existsSync(path.join(dir, '.git'))) repos.set(dir, ref);
+  }
+  for (const tok of text.match(/[A-Za-z][A-Za-z0-9._-]{2,}/g) || []) {
+    const dir = path.resolve(cwd, '..', tok);
+    if (dir !== root && !repos.has(dir) && fs.existsSync(path.join(dir, '.git'))) {
+      repos.set(dir, `../${tok}`);
+    }
+  }
+  return [...repos].map(([dir, label]) => ({ label, dir, head: gitHeadAt(dir) }));
+}
+
+/**
+ * Re-read HEADs for a prior snapshot; return the repos whose HEAD advanced
+ * as [{ label, dir, before, after }].
+ */
+function diffAdvancedRepoHeads(snapshot) {
+  const advanced = [];
+  for (const repo of snapshot || []) {
+    if (!repo || !repo.head) continue;
+    const after = gitHeadAt(repo.dir);
+    if (after && after !== repo.head) {
+      advanced.push({ label: repo.label, dir: repo.dir, before: repo.head, after });
+    }
+  }
+  return advanced;
+}
+
+/**
+ * The T31-typed do-phase timeout message thrown by executePhaseDetailed.
+ * Plan/review timeouts stay human halts — only the do phase commits work
+ * worth reconciling.
+ */
+function isDoPhaseTimeoutMessage(message) {
+  return /\bdo phase timed out after\b/.test(String(message || ''));
+}
+
+/**
+ * Mark the task's TODO bullet `[x]`. Matches the first un-checked,
+ * un-struck bullet whose normalized text contains the normalized title
+ * prefix; `- **T33:** …` becomes `- [x] **T33:** …`, `- [ ]` becomes `- [x]`.
+ * Returns true if a bullet was marked.
+ */
+function markTodoBulletDone(cwd, taskTitle) {
+  const needle = taskMatchNeedle(taskTitle);
+  if (!needle) return false;
+  for (const name of ['TODO.md', 'todo.md']) {
+    const todoPath = path.join(cwd, 'atris', name);
+    if (!fs.existsSync(todoPath)) continue;
+    const lines = fs.readFileSync(todoPath, 'utf8').split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      const bullet = lines[i].match(/^(\s*)- (?:\[( |x)\]\s+)?(.*)$/);
+      if (!bullet) continue;
+      if (bullet[2] === 'x') continue;
+      if (bullet[3].startsWith('~~')) continue;
+      if (!normalizeForMatch(lines[i]).includes(needle)) continue;
+      lines[i] = `${bullet[1]}- [x] ${bullet[3]}`;
+      fs.writeFileSync(todoPath, lines.join('\n'));
+      return true;
+    }
+    return false;
+  }
+  return false;
+}
+
+/**
+ * Append a block under today's journal `## Notes`, creating the journal file
+ * if the tick dies before any other writer got to it. Never throws.
+ */
+function appendUnderNotes(cwd, block) {
+  try {
+    const { logFile, dateFormatted } = todayJournalPath(cwd);
+    if (!fs.existsSync(logFile)) {
+      const dir = path.dirname(logFile);
+      if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+      createLogFile(logFile, dateFormatted);
+    }
+    let content = fs.readFileSync(logFile, 'utf8');
+    const notesIdx = content.indexOf('## Notes');
+    if (notesIdx === -1) {
+      content = content.replace(/\s*$/, '') + `\n\n## Notes\n${block}\n`;
+    } else {
+      const eol = content.indexOf('\n', notesIdx);
+      content = content.slice(0, eol + 1) + block + content.slice(eol + 1);
+    }
+    fs.writeFileSync(logFile, content);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function appendTimeoutReconciliation(cwd, { task, advanced }) {
+  const now = new Date().toISOString().slice(0, 16).replace('T', ' ');
+  const repoLines = (advanced || [])
+    .map((r) => `- ${r.label}: ${String(r.before).slice(0, 7)} → ${String(r.after).slice(0, 7)}`)
+    .join('\n');
+  const block =
+    `\n### Timeout reconciliation — ${now} — work-landed-receipt-died\n\n` +
+    `**Task:** ${task}\n` +
+    `**What happened:** the do-phase wall killed the reporter, but commits landed:\n` +
+    `${repoLines}\n` +
+    `Receipt auto-written and the TODO bullet marked; no human halt required.\n`;
+  return appendUnderNotes(cwd, block);
+}
+
+function appendCheckAndAdvance(cwd, task, receiptLine) {
+  const now = new Date().toISOString().slice(0, 16).replace('T', ' ');
+  const block =
+    `\n### Check-and-advance — ${now} — advanced-already-done\n\n` +
+    `**Task:** ${task}\n` +
+    `**What happened:** verify passed before work started AND today's journal already carries a completion receipt — the work shipped on a prior tick whose reporter died before bookkeeping. Bullet marked, picker advanced.\n` +
+    `**Receipt:** ${receiptLine}\n`;
+  return appendUnderNotes(cwd, block);
+}
+
+/**
+ * Scan today's journal for a completion receipt naming the task: a `C#`
+ * completed line, a timeout-reconciliation entry, or a `**Task:**` line.
+ * Returns the matching line, or null.
+ */
+function findCompletionReceipt(cwd, taskTitle) {
+  const { logFile } = todayJournalPath(cwd);
+  if (!fs.existsSync(logFile)) return null;
+  const needle = taskMatchNeedle(taskTitle);
+  if (!needle) return null;
+  for (const line of fs.readFileSync(logFile, 'utf8').split('\n')) {
+    const receiptShaped =
+      /\*\*C\d+:\*\*/.test(line) || /\*\*Task:\*\*/.test(line) || /reconciliation/i.test(line);
+    if (receiptShaped && normalizeForMatch(line).includes(needle)) return line.trim();
+  }
+  return null;
+}
+
+/**
+ * After a do-phase timeout: diff the pre-tick HEAD snapshot. If commits
+ * landed, write the journal reconciliation receipt, mark the TODO bullet, and
+ * report outcome `work-landed-receipt-died`. If nothing landed, the caller
+ * halts exactly as before.
+ */
+function reconcileTimedOutTick(cwd, snapshot, taskTitle) {
+  const advanced = diffAdvancedRepoHeads(snapshot);
+  if (advanced.length === 0) return { reconciled: false, advanced: [] };
+  appendTimeoutReconciliation(cwd, { task: taskTitle, advanced });
+  const bulletMarked = markTodoBulletDone(cwd, taskTitle);
+  return { reconciled: true, outcome: 'work-landed-receipt-died', advanced, bulletMarked };
+}
+
 function runTaskOnce(context, options = {}) {
   const { verbose = false, cwd = process.cwd() } = options;
 
@@ -1318,6 +1663,25 @@ function runTaskOnce(context, options = {}) {
   if (!skipFalsifiability && verifyResult.explicit && context.kind === 'endgame' && verifyCmd) {
     try {
       execSync(verifyCmd, { cwd, stdio: 'pipe', timeout: 300000 });
+      // T33b (lesson: tick-must-mark-own-bullet): a pre-work verify pass WITH
+      // a completion receipt already in today's journal means the work shipped
+      // but the reporter died before bookkeeping. Check the bullet and advance
+      // instead of wedging the picker on verify-not-falsifiable.
+      const receipt = findCompletionReceipt(cwd, context.task);
+      if (receipt) {
+        const bulletMarked = markTodoBulletDone(cwd, context.task);
+        appendCheckAndAdvance(cwd, context.task, receipt);
+        return {
+          outcome: 'advanced-already-done',
+          reason: 'advanced-already-done',
+          receipt,
+          bulletMarked,
+          phaseResults: {},
+          elapsedSeconds: 0,
+          verifyRan: true,
+          verifyPass: true,
+        };
+      }
       writeLesson(cwd, 'verify-not-falsifiable', 'fail',
         `Verify \`${verifyCmd}\` passed before work started on "${context.task}". Either the rubric is trivial or the task is already done. Tick halted.`);
       return {
@@ -1436,7 +1800,7 @@ function runTaskOnce(context, options = {}) {
         elapsedSeconds: verifyTime,
       };
       try {
-        const slug = (context.task || 'unknown').replace(/\s+/g, '-').toLowerCase().slice(0, 40);
+        const slug = lessonSlug(context.task);
         writeLesson(cwd, `verify-fail-${slug}`, 'fail', `Verify command \`${verifyCmd}\` failed: ${e.message.split('\n')[0]}`);
       } catch { /* lesson write must not crash the tick */ }
     }
@@ -2482,7 +2846,7 @@ function getLessonVerdict(lessonLine) {
 /**
  * Propose 3 candidate next horizons for the autopilot loop. Combines
  * `getIdleTickCount` + `getRecentSignals` into a prompt asking the LLM
- * to imagine what to work on next, spawns `claude -p`, and parses the
+ * to imagine what to work on next, uses the shared runner command, and parses the
  * JSON response into `[{ title, confidence, rationale }]`.
  *
  * Filters out candidates derived from resolved lessons (bug pattern no
@@ -2537,10 +2901,10 @@ Reply with the JSON array and nothing else.`;
 
   let output = '';
   try {
-    const cmd = `claude -p "$(cat '${tmpFile.replace(/'/g, "'\\''")}')"`;
+    const cmd = buildRunnerCommand({ promptFile: tmpFile });
     const env = { ...process.env };
     delete env.CLAUDECODE;
-    output = execSync(cmd, {
+    output = execPhaseCommandSync(cmd, {
       cwd,
       encoding: 'utf8',
       timeout: PHASE_TIMEOUT,
@@ -2548,6 +2912,14 @@ Reply with the JSON array and nothing else.`;
       maxBuffer: 10 * 1024 * 1024,
       env
     }).toString();
+  } catch (err) {
+    if (isPhaseTimeoutError(err)) {
+      throw new Error(`horizon-proposal phase timed out after ${PHASE_TIMEOUT / 1000}s`);
+    }
+    if (isPhaseKillError(err)) {
+      throw new Error(`horizon-proposal phase killed by ${err.signal || 'a signal'} before the ${PHASE_TIMEOUT / 1000}s wall — not a timeout`);
+    }
+    throw err;
   } finally {
     try { fs.unlinkSync(tmpFile); } catch {}
   }
@@ -2555,7 +2927,7 @@ Reply with the JSON array and nothing else.`;
   const start = output.indexOf('[');
   const end = output.lastIndexOf(']');
   if (start === -1 || end === -1 || end <= start) {
-    throw new Error('proposeCandidateHorizons: claude -p returned no JSON array');
+    throw new Error('proposeCandidateHorizons: configured runner returned no JSON array');
   }
   const jsonText = output.slice(start, end + 1);
 
@@ -2650,8 +3022,8 @@ async function autopilotAtris(description, options = {}) {
     process.exit(1);
   }
 
-  try { execSync('which claude', { stdio: 'pipe' }); } catch {
-    console.error('claude CLI not found. Install Claude Code first.');
+  try { execSync(buildRunnerAvailabilityCommand(), { stdio: 'pipe' }); } catch {
+    console.error(`${resolveClaudeRunnerBin()} CLI not found. Set ATRIS_RUNNER_BIN (or legacy ATRIS_CLAUDE_BIN), or install the configured runner first.`);
     process.exit(1);
   }
 
@@ -2835,6 +3207,17 @@ async function autopilotAtris(description, options = {}) {
     };
     const startingEndgame = readEndgameState(cwd);
 
+    // T33a: snapshot pre-tick HEADs (cwd + sibling repos named in the task)
+    // so a do-phase timeout can be reconciled against what actually landed.
+    let preTickHeads = null;
+    try {
+      const verifyHint = getVerifyCommand(cwd, suggestion.task).cmd || '';
+      preTickHeads = snapshotRepoHeads(
+        cwd,
+        [suggestion.task, ...(suggestion.files || []), verifyHint].join(' ')
+      );
+    } catch { /* snapshot failure must not block the tick */ }
+
     try {
       if (verbose) {
         console.log('');
@@ -2868,6 +3251,26 @@ async function autopilotAtris(description, options = {}) {
         break;
       }
 
+      // T33b: the falsifiability gate found a completion receipt — the work
+      // already shipped, the bullet is checked, move straight to the next pick.
+      if (execution.outcome === 'advanced-already-done') {
+        completed++;
+        tickOutcome = 'built';
+        tickOutcomeText = `"${lastTaskTitle}" was already done — verify passed pre-work and today's journal carries its completion receipt, so I checked the bullet and advanced.`;
+        tickNextStep = 'pick the next endgame task';
+        if (verbose) {
+          console.log('  already done (journal receipt found). bullet checked, advancing.');
+        } else {
+          printPlainBlock([
+            'That task was already done — verify passed before work and a completion receipt exists in today\'s journal.',
+            'I checked the bullet and advanced.',
+            '',
+            'Next I will look for the next task.'
+          ].join('\n'));
+        }
+        continue;
+      }
+
       const planTime = execution.phaseResults.plan.elapsedSeconds;
       if (verbose) console.log(`  planned (${planTime}s)`);
 
@@ -2929,7 +3332,7 @@ async function autopilotAtris(description, options = {}) {
       // Record commit hash + verify command for retroactive regression checks
       try {
         const commitHash = execSync('git rev-parse HEAD', { cwd, encoding: 'utf8' }).trim();
-        const taskSlug = (suggestion.task || 'unknown').replace(/\s+/g, '-').toLowerCase().slice(0, 40);
+        const taskSlug = lessonSlug(suggestion.task);
         recordTickCommit(cwd, commitHash, execution.verifyCmd || '', taskSlug);
 
         // Every 10th tick, run retroactive regression check
@@ -2976,6 +3379,36 @@ async function autopilotAtris(description, options = {}) {
       }
 
     } catch (err) {
+      // T33a: a do-phase timeout with commits landed is a dead reporter, not
+      // dead work — write the reconciliation receipt, mark the bullet, and
+      // record work-landed-receipt-died instead of halting for a human.
+      let reconciliation = null;
+      if (isDoPhaseTimeoutMessage(err.message)) {
+        try {
+          reconciliation = reconcileTimedOutTick(cwd, preTickHeads, lastTaskTitle || suggestion.task);
+        } catch { reconciliation = null; }
+      }
+      if (reconciliation && reconciliation.reconciled) {
+        completed++;
+        const landed = reconciliation.advanced
+          .map((r) => `${r.label} ${String(r.before).slice(0, 7)} → ${String(r.after).slice(0, 7)}`)
+          .join(', ');
+        tickOutcome = 'work-landed-receipt-died';
+        tickOutcomeText = `"${lastTaskTitle}" hit the do-phase wall but commits landed (${landed}). I wrote the reconciliation receipt and marked the bullet — work-landed-receipt-died, no human halt.`;
+        tickNextStep = 'pick the next task';
+        if (verbose) {
+          console.log(`  do phase timed out, but work landed (${landed}). reconciled — no human halt.`);
+        } else {
+          printPlainBlock([
+            'The do phase timed out, but commits landed before the wall.',
+            `Landed: ${landed}.`,
+            'I wrote the reconciliation receipt and marked the task bullet.',
+            '',
+            'Next tick will pick the next task.'
+          ].join('\n'));
+        }
+        break;
+      }
       tickOutcome = 'halted';
       tickOutcomeText = `I hit an error while running "${lastTaskTitle || 'a task'}": ${err.message}`;
       tickNextStep = 'stop until a human looks at the error';
@@ -3135,7 +3568,7 @@ function isStillTrue(fact, cwd) {
 /**
  * Ask a local model whether a task/fact is still relevant.
  * Called when isStillTrue returns 'unverified' — the mechanical check
- * couldn't confirm or deny, so we ask claude -p to inspect the codebase.
+ * couldn't confirm or deny, so we ask the configured runner to inspect the codebase.
  *
  * @param {{ title: string, age: number, source?: string }} fact
  * @param {string} cwd - workspace root
@@ -3158,8 +3591,8 @@ Search the codebase to verify. Reply: YES <reason> or NO <reason>`;
   try {
     const env = { ...process.env };
     delete env.CLAUDECODE;
-    const cmd = `claude -p "$(cat '${tmpFile.replace(/'/g, "'\\''")}')" --allowedTools "Bash,Read,Glob,Grep"`;
-    const output = execSync(cmd, {
+    const cmd = buildRunnerCommand({ promptFile: tmpFile, allowedTools: 'Bash,Read,Glob,Grep' });
+    const output = execPhaseCommandSync(cmd, {
       cwd,
       encoding: 'utf8',
       timeout: 60000,
@@ -3192,6 +3625,13 @@ async function autopilotFromTodo(options = {}) {
 
 module.exports = {
   appendTickSummary,
+  snapshotRepoHeads,
+  diffAdvancedRepoHeads,
+  reconcileTimedOutTick,
+  markTodoBulletDone,
+  findCompletionReceipt,
+  isDoPhaseTimeoutMessage,
+  validateVerifyCommandShape,
   askHuman,
   askModel,
   autopilotAtris,
@@ -3218,6 +3658,7 @@ module.exports = {
   scanAnomalies,
   verifyJudgeIntegrity,
   maybeWriteCompletedEndgameScorecard,
+  readEndgameState,
   renderHumanSuggestion,
   renderHumanTickIntro,
   proposeCandidateHorizons,
@@ -3233,5 +3674,10 @@ module.exports = {
   scoreEndgameCandidates,
   suggestNextTask,
   shouldSkipAutoHumanGate,
-  writeLesson
+  writeLesson,
+  isPhaseTimeoutError,
+  isPhaseKillError,
+  execPhaseCommandSync,
+  executePhaseDetailed,
+  lessonSlug
 };