atris 3.34.0 → 3.35.0

package/commands/task.js

@@ -7,10 +7,18 @@ const fs = require('fs');
 const http = require('http');
 const path = require('path');
 const os = require('os');
-const { taskProofState, buildVerifiedProof } = require('../lib/task-proof');
-const { evaluateAutoAccept, parseVerifyCommand, runVerifyCommand, DENIED_TAGS } = require('../lib/auto-accept-certified');
+const { taskProofState } = require('../lib/task-proof');
+const {
+  evaluateAutoAccept,
+  isAgentCertified,
+  isAutoCertifyVerifyCommandAllowed,
+  parseVerifyCommand,
+  runVerifyCommand,
+  DENIED_TAGS,
+} = require('../lib/auto-accept-certified');
 const { extractReceiptEvidence } = require('../lib/receipt-evidence');
 const escapeRegExp = require('../lib/escape-regexp');
+const reviewIntegrity = require('../lib/review-integrity');
 const {
   normalizeOwnerSlug,
   resolveFunctionalOwner: resolveFunctionalTaskOwner,
@@ -111,6 +119,13 @@ function taskUsageText() {
   return `
 atris task - durable local task state (SQLite, gitignored)
 
+  golden path (zero human turns):
+    atris task delegate "fix the login bug" --to <member>
+    atris task claim <id> --as <member>
+    ... build ...
+    atris task ready <id> --verify
+    atris autoland tick   # second check runs, task lands
+
   atris task                              Show the task desk
   atris task new "<title>"                Create a task
   atris task next [--tag <tag>] [--create-next]
@@ -120,6 +135,8 @@ atris task - durable local task state (SQLite, gitignored)
   atris task chat <id> "<message>" [--goal "..."]  Refine a task chat + working goal
   atris task ready <id> --proof "..."      Agent proof ready; native goal can complete
   atris task ready <id> --verify "<cmd>"   Run <cmd>; only ready if it exits 0 (executed proof)
+                                           Writes atris/runs/ receipt (pass or fail), folds path into proof
+  atris task receipt <id> --verify "<cmd>" Run <cmd> and write an atris/runs/ receipt without going to ready
   atris task plan-preview "<purpose>" [--tag <tag>] [--owner <member>] [--task <id>]
                                            Show the plain Plan before work starts
   atris task ready <id> --proof "..." [--changed "..." --checked "..." --saved "..." --try "..."]
@@ -133,20 +150,23 @@ atris task - durable local task state (SQLite, gitignored)
                                            Human accepts proof, marks done; --public also publishes AgentXP
   atris task certify-verified [--dry-run] [--limit <n>] [--as <actor>]
                                            Re-run the runnable check named in each Review proof as a second actor; passing rows certify (denied lanes and check-less rows wait for a human)
-  atris task auto-accept-certified --dry-run [--strict-verify] [--limit <n>]
+  atris task auto-accept-certified --dry-run [--strict-verify] [--all] [--limit <n>]
                                            Preview certified Review rows; live accept needs --confirm-human-accept --as <human>
+  atris task sweep --auto-accept [--json]   Auto-accept verified Review rows; protected lanes wait for human
   atris task revise <id> --note "..."      Send reviewed work back to Do
 
   atris task add "<title>" [--tag <tag>] [--goal-id <id>]  Create a task
-  atris task delegate "<title>" [--to <member>] [--executed-by <engine>] [--goal-id <id>]  Create assigned work
+  atris task delegate "<title>" [--to <member>] [--executed-by <engine>] [--goal-id <id>] [--tag <tag>]  Create assigned work
   atris task plan <id> --goal "..." --exit "..." --proof-needed "..."
                                            Record a task-owned Plan stage
   atris task do <id> --as <owner> --first-move "..."
                                            Start task-owned Do work from the plan
   atris task backlog <id> [--reason "..."] Move a planned open task back to Backlog
   atris task clear-plan --yes              Move all planned open tasks back to Backlog
-  atris task day [--json]                  Show today's owner-grouped task list
-  atris task list [--all] [--status <s>]   List tasks (default: this workspace)
+  atris task day [--all] [--everywhere] [--json]  show today's owner-grouped task list
+                                           --all stays in this workspace; --everywhere spans workspaces
+  atris task list [--all] [--everywhere] [--status <s>]
+                                           list tasks in this workspace; --everywhere spans workspaces
   atris task claim <id> [--as <owner>]     Atomic claim
   atris task release <id> [--as <owner>]   Release your own mistaken claim back to open
   atris task capabilities [--json]         Read-only task CLI/API capability contract
@@ -163,6 +183,9 @@ atris task - durable local task state (SQLite, gitignored)
                                            Advance the scoped current task one safe step
                                            review-state lanes: needs-agent, continue-work, human-accept-waiting, certified
   atris task note <id> "<message>"         Append dialogue/context to a task
+  atris task tag <id> --add <tag> [--remove <tag>]
+                                           Update tags on an existing task (e.g. --add needs-human to hold it
+                                           from sweep + fleet staffing); logs a task_tags_updated event
   atris task show <id> [--json]            Show a task card + dialogue
   atris task inspect <id> --fields review,status,title [--json]
                                            Field-selectable task state (review metadata, status, title, owner, tag)
@@ -170,6 +193,11 @@ atris task - durable local task state (SQLite, gitignored)
   atris task step <id> [--json]            Refine chat, then advance one safe Plan/Do/Review step
   atris task done <id> --proof "..."       Mark complete with proof
   atris task done <id> --failed [--proof "..."]  Mark failed, optionally reviewed
+  atris task archive <id> --reason "..." [--from-failed]
+                                           Sweep off-roadmap/duplicate work as archived (not failed);
+                                           --from-failed opts in to relabel a fail-closed row (never done)
+  atris task relabel-archived [--dry-run|--apply]
+                                           One-time OBL-1622 migration: relabel June-10 backlog-reset rows failed -> archived
   atris task finish <id> --proof "..."     Legacy alias for done with proof
   atris task review <id> --reward <n> [--verify "<cmd>"]
                                            Write review event + RSI episode
@@ -183,10 +211,13 @@ atris task - durable local task state (SQLite, gitignored)
   atris task sync --dry-run                Plan cloud/Swarlo task sync writes
   atris task import <file>                 One-shot import from TODO.md
   atris task lineage <id> [--json]          Show endgame -> tasks -> commits chain
-  atris task events [id] [--limit <n>]     Print recent task events
-  atris task events --all                  Print the full append-only ledger
-  atris task export [--out <file>]         Write web/desktop JSON projection
-  atris task render [--out <file>]         Regenerate compact TODO.md view from state
+  atris task events [id] [--limit <n>]     print recent task events
+  atris task events --all                  print the full current-workspace ledger
+  atris task events --everywhere           print the full ledger across workspaces
+  atris task export [--all] [--everywhere] [--out <file>]
+                                           write web/desktop JSON projection
+  atris task render [--all] [--everywhere] [--out <file>]
+                                           regenerate compact TODO.md view from state
   atris task where                          Print db path + workspace scope
   atris task help                           This help
 
@@ -226,6 +257,15 @@ function hasFlag(args, name) {
   return args.indexOf(name) !== -1;
 }
 
+function taskScopeEverywhere(args = [], options = {}) {
+  if (options.everywhere !== undefined) return Boolean(options.everywhere);
+  return hasFlag(args, '--everywhere');
+}
+
+function scopedWorkspaceRoot(taskDb, args = [], options = {}) {
+  return taskScopeEverywhere(args, options) ? null : taskDb.workspaceRoot();
+}
+
 function hasEmptyFlagValue(args, name) {
   const i = args.indexOf(name);
   return i !== -1 && args[i + 1] === '';
@@ -462,10 +502,11 @@ function positional(args) {
   });
 }
 
-function writeDefaultProjection(taskDb, db, { all = false } = {}) {
+function writeDefaultProjection(taskDb, db, options = {}) {
+  const workspaceRoot = scopedWorkspaceRoot(taskDb, [], options);
   const projection = enrichTaskProjection(taskDb.taskProjection(db, {
-    workspaceRoot: all ? null : taskDb.workspaceRoot(),
-    limit: 500,
+    workspaceRoot,
+    limit: options.all ? null : 500,
   }));
   const outPath = path.resolve(path.join('.atris', 'state', 'tasks.projection.json'));
   fs.mkdirSync(path.dirname(outPath), { recursive: true });
@@ -692,6 +733,9 @@ function certifiedReviewNextAction(nextTaskTitle) {
 }
 
 function proofBoundaryBlockedEvaluation(task) {
+  // strictVerify stays off here: this is a render-path probe for the boundary
+  // reason only, and the default-true strict mode would spawn the verify
+  // subprocess for every certified row just to draw the desk.
   const evaluation = evaluateAutoAccept(task, { strictVerify: false, minPasses: 0 });
   return evaluation && evaluation.reason === 'proof_unmerged_or_draft_pr_boundary'
     ? evaluation
@@ -1057,11 +1101,65 @@ function taskReviewSavedText(task, review = {}, ref = taskRef(task)) {
   return `Work record saved as ${ref}.`;
 }
 
+function cleanReviewProofText(value) {
+  const text = String(value || '').trim();
+  return text || null;
+}
+
+function reviewMessageLooksLikeProof(value) {
+  const text = cleanReviewProofText(value);
+  return Boolean(text && /\b(?:proof|verified|verifier|passed|receipt|git diff --check|node --test|npm test|pnpm test|yarn test|pytest|typecheck)\b/i.test(text));
+}
+
+function taskReviewEventProof(task) {
+  const events = Array.isArray(task.events) ? task.events : [];
+  for (const event of events.slice().reverse()) {
+    const payload = event && event.payload && typeof event.payload === 'object' ? event.payload : {};
+    const explicit = cleanReviewProofText(payload.proof || payload.verify);
+    if (explicit) return explicit;
+    const message = cleanReviewProofText(payload.content || payload.chat_packet || payload.stage_packet);
+    if (message && reviewMessageLooksLikeProof(message)) return message;
+  }
+  const messages = Array.isArray(task.messages) ? task.messages : [];
+  for (const message of messages.slice().reverse()) {
+    const content = cleanReviewProofText(message && message.content);
+    if (content && reviewMessageLooksLikeProof(content)) return content;
+  }
+  return null;
+}
+
+function taskReviewProofFallback(task, payload = {}) {
+  if (!task || task.status !== 'review') return null;
+  const metadata = task.metadata || {};
+  return cleanReviewProofText(metadata.latest_agent_proof)
+    || cleanReviewProofText(payload.proof)
+    || cleanReviewProofText(metadata.proof)
+    || cleanReviewProofText(metadata.verify)
+    || cleanReviewProofText(metadata.latest_agent_verify)
+    || cleanReviewProofText(payload.verify)
+    || taskReviewEventProof(task);
+}
+
+function reviewReceiptPath(proofText, root) {
+  const evidence = extractReceiptEvidence(proofText, root);
+  if (!evidence) return null;
+  return evidence.receipts?.[0]?.path || evidence.missing?.[0] || null;
+}
+
+function withReviewReceiptPath(review, root) {
+  if (!review) return null;
+  return {
+    ...review,
+    receipt_path: reviewReceiptPath(review.proof, root),
+  };
+}
+
 function taskReviewSummary(task) {
   const reviewed = (task.events || []).slice().reverse().find(e => e.event_type === 'reviewed' || e.event_type === 'proof_ready' || e.event_type === 'revision_requested');
   const payload = reviewed && reviewed.payload || {};
   const metadata = task.metadata || {};
-  if (!reviewed && !metadata.approval_status && !metadata.agent_review_pass_count && !metadata.human_revision_count && !metadata.agent_certified) return null;
+  const fallbackProof = taskReviewProofFallback(task, payload);
+  if (!reviewed && !metadata.approval_status && !metadata.agent_review_pass_count && !metadata.human_revision_count && !metadata.agent_certified && !fallbackProof) return null;
   if (reviewed && reviewed.event_type === 'revision_requested') {
     const review = {
       summary: reviewSummary(task, payload),
@@ -1101,7 +1199,7 @@ function taskReviewSummary(task) {
   const review = {
     summary: reviewSummary(task, payload),
     reward: reviewed && reviewed.event_type === 'reviewed' && payload.reward !== undefined ? payload.reward : null,
-    proof: readyField('proof', 'latest_agent_proof'),
+    proof: readyField('proof', 'latest_agent_proof') || fallbackProof,
     lesson: readyField('lesson', 'latest_agent_lesson'),
     next_task: readyField('next_task', 'latest_agent_next_task'),
     approval_status: metadata.approval_status || (task.status === 'review' ? 'pending' : null),
@@ -1132,6 +1230,7 @@ function taskReviewInspectMetadata(task) {
     human_revision_count: review.human_revision_count || null,
     human_revision_note: review.human_revision_note || null,
     reward: review.reward ?? null,
+    receipt_path: review.receipt_path || null,
   };
 }
 
@@ -1317,7 +1416,7 @@ function enrichTaskProjection(projection) {
       const parentLinkType = parentFromParentId ? 'parent_task_id' : parentFromGoalId ? 'goal_id' : null;
       const parentId = parent ? parent.id : metadata.parent_task_id || null;
       const childTasks = children.get(task.id) || [];
-      const review = taskReviewSummary(task);
+      const review = withReviewReceiptPath(taskReviewSummary(task), root);
       return {
         ...task,
         objective: taskObjective(task, parent, goalSource.goals, { parentLinkType, baseObjectives }),
@@ -1502,6 +1601,44 @@ function latestTaskEvent(task) {
   return events.length ? events[events.length - 1] : null;
 }
 
+function verifiedProofCommand(proof) {
+  const match = String(proof || '').match(/\[verified\]\s+`([^`]+)`\s+passed\s+\(exit 0\)/i);
+  return match ? String(match[1] || '').trim() : '';
+}
+
+function autoCertifyCommandCandidatesForTask(task) {
+  const metadata = task && task.metadata || {};
+  const review = task && task.review || {};
+  const proof = String(review.proof || metadata.latest_agent_proof || '');
+  const candidates = [
+    metadata.verify,
+    metadata.latest_agent_verify,
+    verifiedProofCommand(review.proof),
+    verifiedProofCommand(metadata.latest_agent_proof),
+    ...taskReviewEvidenceCommands(proof),
+  ].map(value => String(value || '').trim()).filter(Boolean);
+  const seen = new Set();
+  return candidates.filter((candidate) => {
+    const key = candidate.toLowerCase();
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
+function reviewBlockerForTask(task) {
+  const ref = taskRef(task);
+  const candidates = autoCertifyCommandCandidatesForTask(task);
+  const safe = candidates.find(command => isAutoCertifyVerifyCommandAllowed(command));
+  const unsafe = candidates.find(command => !isAutoCertifyVerifyCommandAllowed(command));
+  const reason = !safe && unsafe ? 'verify_command_not_allowed' : 'needs_second_actor_review';
+  return {
+    reason,
+    verify_command: (!safe && unsafe) ? unsafe : (safe || candidates[0] || null),
+    next_command: `atris task review-chat ${ref} --as codex-review`,
+  };
+}
+
 function reviewHandoffForTask(task, { suppressExistingFollowUp = false, hasExistingReviewFollowUp = null } = {}) {
   const review = task && task.review || {};
   if (task && task.status !== 'review') return null;
@@ -1522,6 +1659,11 @@ function reviewHandoffForTask(task, { suppressExistingFollowUp = false, hasExist
     handoff.reason = proofBoundary.reason;
     handoff.next_action_detail = proofBoundary.next_action || null;
     handoff.revise_command = `atris task revise ${taskRef(task)} --note "<replace stale PR proof with merged proof or move back to Do>"`;
+  } else if (!agentCertified) {
+    const blocker = reviewBlockerForTask(task);
+    handoff.reason = blocker.reason;
+    handoff.next_action_detail = blocker.verify_command || null;
+    handoff.review_chat_command = blocker.next_command;
   } else if (agentCertified && nextTask && !hasExistingFollowUp) {
     handoff.next_task = nextTask;
     handoff.continue_work_command = continueWorkCommandForTask(task);
@@ -1980,6 +2122,7 @@ function compactTaskForStatus(task) {
     if (task.review.proof) review.proof = clipStatusText(task.review.proof, 180);
     if (task.review.lesson) review.lesson = clipStatusText(task.review.lesson, 180);
     if (task.review.next_task) review.next_task = clipStatusText(task.review.next_task, 140);
+    if (Object.prototype.hasOwnProperty.call(task.review, 'receipt_path')) review.receipt_path = task.review.receipt_path || null;
     if (task.review.approval_status) review.approval_status = task.review.approval_status;
     if (task.review.agent_review_pass_count) review.agent_review_pass_count = task.review.agent_review_pass_count;
     if (task.review.agent_certified) review.agent_certified = task.review.agent_certified;
@@ -3055,6 +3198,7 @@ function taskCapabilitiesCheckReport(taskDb, db, args = [], options = {}) {
   const owner = options.owner || flag(args, '--as') || flag(args, '--owner') || DEFAULT_OWNER;
   const reviewer = reviewActor(options.reviewer || flag(args, '--reviewer') || flag(args, '--as-reviewer') || 'codex-review');
   const all = options.all !== undefined ? Boolean(options.all) : hasFlag(args, '--all');
+  const everywhere = taskScopeEverywhere(args, options);
   const limit = options.limit !== undefined ? options.limit : taskQueueLimit(args);
   const scope = normalizeTaskQueueScope(options.scope || taskQueueScopeFromArgs(args));
   const standalone = taskCapabilitiesContract();
@@ -3062,6 +3206,7 @@ function taskCapabilitiesCheckReport(taskDb, db, args = [], options = {}) {
     owner,
     reviewer,
     all,
+    everywhere,
     limit,
     scope,
   });
@@ -3326,7 +3471,11 @@ function selectTaskForCurrent(projection, { owner = DEFAULT_OWNER, scope = {}, h
   if (reviewNeedsAgent) return { task: reviewNeedsAgent, reason: 'review_needs_agent_verification' };
   const reviewProofBoundaryBlocked = columns.review.find(task => reviewHandoffForTask(task, { suppressExistingFollowUp: true, hasExistingReviewFollowUp })?.next_action === PROOF_BOUNDARY_BLOCKED_ACTION);
   if (reviewProofBoundaryBlocked) return { task: reviewProofBoundaryBlocked, reason: 'review_proof_boundary_blocked' };
-  const planQueue = normalizedScope.goal_id ? sortTasksOldestFirst(columns.plan) : columns.plan;
+  // Scoped selection (goal_id, tag, status, or review_state) implies a sequenced
+  // work stream (e.g. golden-path "pass 1a" before "pass 2"): earlier-created
+  // tasks must win over newer ones, not the newest-first default used for the
+  // unscoped desk view.
+  const planQueue = !taskQueueScopeIsEmpty(normalizedScope) ? sortTasksOldestFirst(columns.plan) : columns.plan;
   const planReady = planQueue[0];
   if (planReady) return { task: planReady, reason: 'plan_ready' };
   const backlogIdea = columns.backlog[0];
@@ -3392,18 +3541,20 @@ function buildTaskCurrent(taskDb, db, args = [], options = {}) {
   const owner = options.owner || flag(args, '--as') || flag(args, '--owner') || DEFAULT_OWNER;
   const reviewer = reviewActor(options.reviewer || flag(args, '--reviewer') || flag(args, '--as-reviewer') || 'codex-review');
   const all = options.all !== undefined ? Boolean(options.all) : hasFlag(args, '--all');
+  const everywhere = taskScopeEverywhere(args, options);
+  const workspaceRoot = scopedWorkspaceRoot(taskDb, args, { everywhere });
   const limit = options.limit !== undefined ? options.limit : taskQueueLimit(args);
   const scope = normalizeTaskQueueScope(options.scope || taskQueueScopeFromArgs(args));
-  const { projection, outPath } = writeDefaultProjection(taskDb, db, { all });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db, { all, everywhere });
   const hasExistingReviewFollowUp = buildReviewFollowUpChildPredicate(
     taskDb,
     db,
-    all ? null : taskDb.workspaceRoot(),
+    workspaceRoot,
   );
   const hasPendingReviewChat = buildPendingReviewChatPredicate(
     taskDb,
     db,
-    all ? null : taskDb.workspaceRoot(),
+    workspaceRoot,
   );
   return {
     projection,
@@ -3676,12 +3827,14 @@ function taskReviewLaneDrainReport(taskDb, db, args = [], options = {}) {
   const owner = options.owner || flag(args, '--as') || flag(args, '--owner') || DEFAULT_OWNER;
   const reviewer = reviewActor(options.reviewer || flag(args, '--reviewer') || flag(args, '--as-reviewer') || 'codex-review');
   const all = options.all !== undefined ? Boolean(options.all) : hasFlag(args, '--all');
+  const everywhere = taskScopeEverywhere(args, options);
   const limit = options.limit !== undefined ? options.limit : taskQueueLimit(args);
   const scope = normalizeTaskQueueScope(options.scope || taskQueueScopeFromArgs(args));
   const capabilitiesCheck = taskCapabilitiesCheckReport(taskDb, db, [], {
     owner,
     reviewer,
     all,
+    everywhere,
     limit,
     scope,
   });
@@ -3689,6 +3842,7 @@ function taskReviewLaneDrainReport(taskDb, db, args = [], options = {}) {
     owner,
     reviewer,
     all,
+    everywhere,
     limit,
     scope,
     excludeTaskIds: options.excludeTaskIds,
@@ -3749,6 +3903,7 @@ function taskReviewLaneActOptionsFromArgs(args = []) {
     owner: flag(args, '--as') || flag(args, '--owner') || DEFAULT_OWNER,
     reviewer: reviewActor(flag(args, '--reviewer') || flag(args, '--as-reviewer') || 'codex-review'),
     all: hasFlag(args, '--all'),
+    everywhere: hasFlag(args, '--everywhere'),
     limit: taskQueueLimit(args),
     scope: taskQueueScopeFromArgs(args),
     dryRun: hasFlag(args, '--dry-run'),
@@ -3766,6 +3921,7 @@ function taskReviewLaneActOptionsFromBody(body = {}, searchParams = new URLSearc
     owner: String(queryOwner || body.owner || body.as || body.actor || DEFAULT_OWNER),
     reviewer: reviewActor(queryReviewer || body.reviewer || body.review_actor || body.reviewActor || 'codex-review'),
     all: searchParams.get('all') === '1' || searchParams.get('all') === 'true' || Boolean(body.all),
+    everywhere: searchParams.get('everywhere') === '1' || searchParams.get('everywhere') === 'true' || Boolean(body.everywhere),
     limit: Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 8,
     scope: mergeTaskQueueScopes(queryScope, bodyScope),
     dryRun: searchParams.get('dry_run') === '1'
@@ -3831,6 +3987,7 @@ function taskReviewLaneAct(taskDb, db, options = {}) {
     owner,
     reviewer,
     all: Boolean(options.all),
+    everywhere: Boolean(options.everywhere),
     limit: options.limit !== undefined ? options.limit : 8,
     scope,
     excludeTaskIds: options.excludeTaskIds,
@@ -4069,6 +4226,7 @@ function taskReviewLaneLoop(taskDb, db, options = {}) {
 	      owner,
 	      reviewer,
 	      all: Boolean(options.all),
+	      everywhere: Boolean(options.everywhere),
 	      limit: options.limit !== undefined ? options.limit : 8,
 	      scope,
 	      excludeTaskIds,
@@ -4121,6 +4279,7 @@ function taskReviewLaneLoop(taskDb, db, options = {}) {
 	      owner,
 	      reviewer,
 	      all: Boolean(options.all),
+	      everywhere: Boolean(options.everywhere),
 	      limit: options.limit !== undefined ? options.limit : 8,
 	      scope,
 	      excludeTaskIds,
@@ -4308,6 +4467,7 @@ function taskReviewLaneRun(taskDb, db, options = {}) {
 	      owner,
 	      reviewer,
 	      all: Boolean(options.all),
+	      everywhere: Boolean(options.everywhere),
 	      limit: options.limit !== undefined ? options.limit : 8,
 	      scope,
 	      excludeTaskIds,
@@ -4488,6 +4648,19 @@ function reviewQueueItem(task, root = process.cwd(), evidence = undefined) {
   return item;
 }
 
+function blockedReviewQueueItem(task, root = process.cwd()) {
+  const item = reviewQueueItem(task, root);
+  const blocker = reviewBlockerForTask(task);
+  item.queue_role = 'blocked';
+  item.reason = blocker.reason;
+  item.blocked_reason = blocker.reason;
+  item.next_command = blocker.next_command;
+  item.verify_command = blocker.verify_command;
+  item.accept_command = null;
+  item.land_command = null;
+  return item;
+}
+
 function reviewQueueHygiene(tasks) {
   const genericContinuations = (tasks || []).map(task => {
     const issues = genericContinuationIssues(task);
@@ -4526,7 +4699,10 @@ function taskReviewQueue(projection, args = []) {
   const ordered = [...certified].sort((a, b) =>
     evidenceRiskRank(evidenceByTaskId.get(b.id)) - evidenceRiskRank(evidenceByTaskId.get(a.id))
     || Number(b.updated_at || 0) - Number(a.updated_at || 0));
-  const items = ordered.slice(0, limit).map((task) => reviewQueueItem(task, root, evidenceByTaskId.get(task.id)));
+  const certifiedItems = ordered.slice(0, limit).map((task) => reviewQueueItem(task, root, evidenceByTaskId.get(task.id)));
+  const blockedLimit = reviewQueueLimit(args, blocking.length);
+  const blockedItems = blocking.slice(0, blockedLimit).map((task) => blockedReviewQueueItem(task, root));
+  const items = [...certifiedItems, ...blockedItems];
   return {
     schema: 'atris.task_review_queue.v1',
     generated_at: projection.generated_at,
@@ -4537,7 +4713,8 @@ function taskReviewQueue(projection, args = []) {
       evidence_passing: certified.filter((task) => evidenceByTaskId.get(task.id)?.all_passing).length,
       blocking: blocking.length,
       proof_boundary_blocked: proofBoundaryBlocked.length,
-      shown: items.length,
+      shown: certifiedItems.length,
+      blocking_shown: blockedItems.length,
     },
     hygiene: reviewQueueHygiene(reviewTasks),
     items,
@@ -4635,11 +4812,13 @@ function cmdReviews(args) {
   }
   console.log('READY FOR APPROVAL');
   console.log(`${queue.counts.certified} ready for approval / ${queue.counts.blocking} need one more check / ${queue.counts.review} total waiting`);
-  if (!queue.items.length) {
+  const approvalItems = queue.items.filter(item => item.queue_role !== 'blocked');
+  const blockedItems = queue.items.filter(item => item.queue_role === 'blocked');
+  if (!approvalItems.length && !blockedItems.length) {
     console.log('Nothing is ready for approval.');
     return;
   }
-  queue.items.forEach((item, index) => {
+  approvalItems.forEach((item, index) => {
     const tag = item.tag ? ` [${item.tag}]` : '';
     const passes = item.review_pass_count ? ` (${item.review_pass_count} reviews)` : '';
     const badge = item.evidence?.all_passing ? ' [evidence:passing]' : '';
@@ -4669,6 +4848,10 @@ function cmdReviews(args) {
     else if (item.blocked_accept_reason) console.log(`   approve: blocked (${item.blocked_accept_reason})`);
     console.log(`   rework: ${item.revise_command}`);
   });
+  for (const item of blockedItems) {
+    console.log('');
+    console.log(`blocked: ${item.display_id || taskRef(item.id)}: ${item.reason}; next: ${item.next_command}`);
+  }
   if (queue.counts.shown < queue.counts.certified) {
     console.log('');
     console.log(`Showing ${queue.counts.shown}/${queue.counts.certified}; rerun with --all for every row or --verbose for proof details.`);
@@ -4867,19 +5050,21 @@ function formatTaskLine(task) {
 
 function cmdStatus(args) {
   const all = hasFlag(args, '--all');
+  const everywhere = taskScopeEverywhere(args);
   const history = hasFlag(args, '--history');
   const taskDb = getTaskDb();
   const db = taskDb.open();
-  const compact = writeDefaultProjection(taskDb, db, { all });
+  const workspaceRoot = scopedWorkspaceRoot(taskDb, args, { everywhere });
+  const compact = writeDefaultProjection(taskDb, db, { all, everywhere });
   const projection = history
     ? enrichTaskProjection(taskDb.taskProjection(db, {
-      workspaceRoot: all ? null : taskDb.workspaceRoot(),
-      limit: 500,
+      workspaceRoot,
+      limit: all ? null : 500,
       includeHistory: true,
     }))
     : compact.projection;
   const outPath = compact.outPath;
-  const hasExistingReviewFollowUp = buildReviewFollowUpChildPredicate(taskDb, db, all ? null : taskDb.workspaceRoot());
+  const hasExistingReviewFollowUp = buildReviewFollowUpChildPredicate(taskDb, db, workspaceRoot);
   const status = taskStatusSummary(projection, { history, hasExistingReviewFollowUp });
   if (wantsJson(args)) {
     printJson({
@@ -4936,13 +5121,13 @@ function requireTaskId(taskDb, db, ref, label) {
   }
 }
 
-function workspaceRefRows(taskDb, db, all = false) {
-  return taskDb.listTasks(db, { workspaceRoot: all ? null : taskDb.workspaceRoot() });
+function workspaceRefRows(taskDb, db, options = {}) {
+  return taskDb.listTasks(db, { workspaceRoot: scopedWorkspaceRoot(taskDb, [], options) });
 }
 
 function renderTaskDesk(rows, refRows = rows) {
   const displayRows = getTaskDb().withTaskDisplayRefs(rows, refRows);
-  const active = displayRows.filter(r => r.status !== 'done');
+  const active = displayRows.filter(r => r.status !== 'done' && r.status !== 'archived');
   const done = displayRows.filter(r => r.status === 'done');
   if (rows.length === 0) {
     console.log('No tasks yet.');
@@ -5158,9 +5343,10 @@ function taskDayGroups(tasks, { now = Date.now() } = {}) {
 
 function cmdDay(args) {
   const all = hasFlag(args, '--all');
+  const everywhere = taskScopeEverywhere(args);
   const taskDb = getTaskDb();
   const db = taskDb.open();
-  const { projection, outPath } = writeDefaultProjection(taskDb, db, { all });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db, { all, everywhere });
   const { groups, staleFailed } = taskDayGroups(projection.tasks || []);
   const counts = {
     active: groups.reduce((sum, group) => sum + group.tasks.length, 0),
@@ -5212,13 +5398,15 @@ function cmdDay(args) {
 
 function cmdHome(args) {
   const all = hasFlag(args, '--all');
+  const everywhere = taskScopeEverywhere(args);
   const taskDb = getTaskDb();
   const db = taskDb.open();
+  const workspaceRoot = scopedWorkspaceRoot(taskDb, args, { everywhere });
   const rows = taskDb.listTasks(db, {
-    workspaceRoot: all ? null : taskDb.workspaceRoot(),
-    limit: 200,
+    workspaceRoot,
+    limit: all ? null : 200,
   });
-  const { projection, outPath } = writeDefaultProjection(taskDb, db, { all });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db, { all, everywhere });
   if (wantsJson(args)) {
     printJson({
       ok: true,
@@ -5235,18 +5423,20 @@ function cmdHome(args) {
 
 function cmdList(args) {
   const all = hasFlag(args, '--all');
+  const everywhere = taskScopeEverywhere(args);
   const status = flag(args, '--status');
   const scope = taskQueueScopeFromArgs(args);
   const scoped = !taskQueueScopeIsEmpty(scope);
   const taskDb = getTaskDb();
   const db = taskDb.open();
+  const workspaceRoot = scopedWorkspaceRoot(taskDb, args, { everywhere });
   const rawRows = taskDb.listTasks(db, {
-    workspaceRoot: all ? null : taskDb.workspaceRoot(),
+    workspaceRoot,
     status: typeof status === 'string' ? status : null,
-    limit: scoped ? null : 200,
+    limit: scoped || all ? null : 200,
   });
   const rows = filterTasksByScope(rawRows, scope);
-  const displayRows = taskDb.withTaskDisplayRefs(rows, workspaceRefRows(taskDb, db, all));
+  const displayRows = taskDb.withTaskDisplayRefs(rows, workspaceRefRows(taskDb, db, { everywhere }));
   if (wantsJson(args)) {
     printJson({ ok: true, action: 'list', scope: normalizeTaskQueueScope(scope), tasks: displayRows });
     return;
@@ -5263,12 +5453,49 @@ function cmdList(args) {
   }
 }
 
+// judge != worker support: reserved system names (autoland-verifier and co)
+// can never be assumed via --as, and unknown names warn by default or fail
+// under ATRIS_ACTOR_VALIDATION=enforce. Only explicit --as values are
+// checked; the DEFAULT_OWNER fallback stays silent.
+function guardExplicitActor(command, value) {
+  if (typeof value !== 'string' || !value.trim()) return;
+  const check = reviewIntegrity.validateActor(value, { root: process.cwd() });
+  if (!check.ok) {
+    if (check.reason === 'reserved_actor') {
+      console.error(`${command}: reserved_actor: '${value}' is a system actor and cannot be used with --as`);
+    } else {
+      console.error(`${command}: actor_not_on_roster: '${value}' is not a workspace member or engine (actor validation is enforced)`);
+    }
+    process.exit(1);
+  }
+  if (check.reason === 'actor_not_on_roster' && check.mode === 'warn') {
+    console.error(`Warning: '${value}' is not a workspace member or engine; reviews under unknown names weaken the audit trail.`);
+  }
+}
+
+// A claim against an already-done task burns a whole dispatch when a
+// rendered view (atris/TODO.md) is stale: the agent claims, builds, then
+// discovers the work was already done. Point straight at a real open task
+// instead of just reporting the failure, straight from the live projection
+// (never the rendered file), preferring the same tag when one is open.
+function suggestNextClaimableTask(projection, { excludeId = null, tag = '' } = {}) {
+  const open = (projection && projection.tasks || []).filter((t) => t && t.status === 'open' && t.id !== excludeId);
+  if (!open.length) return null;
+  const normalizedTag = String(tag || '').trim().toLowerCase();
+  if (normalizedTag) {
+    const sameTag = open.find((t) => String(t.tag || '').trim().toLowerCase() === normalizedTag);
+    if (sameTag) return sameTag;
+  }
+  return open[0];
+}
+
 function cmdClaim(args) {
   const pos = positional(args);
   const id = pos[0];
   if (!id) {
     failTask('atris task claim', 'missing_id', 'id required');
   }
+  guardExplicitActor('atris task claim', flag(args, '--as'));
   const owner = flag(args, '--as') || DEFAULT_OWNER;
   const taskDb = getTaskDb();
   const db = taskDb.open();
@@ -5292,6 +5519,12 @@ function cmdClaim(args) {
     const recoveryCommand = result.reason === 'already_claimed' && result.claimed_by
       ? `atris task release ${id} --as ${result.claimed_by}`
       : null;
+    let nextClaimable = null;
+    if (result.reason === 'already_done') {
+      const doneRow = taskDb.getTask(db, taskId);
+      const { projection } = writeDefaultProjection(taskDb, db);
+      nextClaimable = suggestNextClaimableTask(projection, { excludeId: taskId, tag: doneRow && doneRow.tag });
+    }
     if (wantsJson(args)) {
       printJson({
         ok: false,
@@ -5299,12 +5532,16 @@ function cmdClaim(args) {
         reason: result.reason,
         claimed_by: result.claimed_by || null,
         recovery_command: recoveryCommand,
+        next_claimable: nextClaimable ? { id: nextClaimable.id, ref: taskRef(nextClaimable), tag: nextClaimable.tag || null, title: nextClaimable.title } : null,
         detail: `claim failed: ${result.reason}${result.claimed_by ? ` (held by ${result.claimed_by})` : ''}`,
       });
       process.exit(1);
     }
     console.error(`claim failed: ${result.reason}${result.claimed_by ? ` (held by ${result.claimed_by})` : ''}`);
     if (recoveryCommand) console.error(`Recovery: ${recoveryCommand}`);
+    if (nextClaimable) {
+      console.error(`next claimable: ${taskRef(nextClaimable)} ${String(nextClaimable.title || '').slice(0, 80)} (atris task claim ${taskRef(nextClaimable)} --as ${owner})`);
+    }
     process.exit(1);
   }
 }
@@ -5724,6 +5961,79 @@ function cmdNote(args) {
   console.log(`noted ${taskRef(compactTaskFromProjection(projection, taskId))} v${result.event.version}`);
 }
 
+// Collect EVERY value for a repeatable flag (flag() only returns the first),
+// so `--add a --add b` and `--add a,b` both work.
+function collectFlagValues(args, name) {
+  const values = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === name && i + 1 < args.length && !String(args[i + 1]).startsWith('--')) {
+      values.push(args[i + 1]);
+    }
+  }
+  return values
+    .flatMap((value) => String(value).split(','))
+    .map((value) => value.trim())
+    .filter(Boolean);
+}
+
+function cmdTag(args) {
+  const pos = positional(args);
+  const id = pos[0];
+  if (!id) failTask('atris task tag', 'missing_id', 'task id required');
+  const add = collectFlagValues(args, '--add');
+  const remove = collectFlagValues(args, '--remove');
+  if (!add.length && !remove.length) {
+    failTask('atris task tag', 'missing_tags', 'at least one --add <tag> or --remove <tag> required');
+  }
+  const actor = flag(args, '--as') || DEFAULT_OWNER;
+  const taskDb = getTaskDb();
+  const db = taskDb.open();
+  const taskId = requireTaskId(taskDb, db, id, 'atris task tag');
+  const result = taskDb.tagTask(db, { id: taskId, actor: String(actor), add, remove });
+  if (!result.tagged) {
+    if (result.reason === 'no_changes') {
+      const { projection, outPath } = writeDefaultProjection(taskDb, db);
+      const task = compactTaskFromProjection(projection, taskId);
+      if (wantsJson(args)) {
+        printJson({
+          ok: true,
+          action: 'unchanged',
+          task_id: taskId,
+          added: [],
+          removed: [],
+          tags: result.tags || [],
+          projection_path: outPath,
+          task,
+        });
+        return;
+      }
+      console.log(`no change ${taskRef(task)} tags [${(result.tags || []).join(', ')}]`);
+      return;
+    }
+    failTask('atris task tag', result.reason || 'tag_failed', `tag failed: ${result.reason || 'unknown'}`, 1);
+  }
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  const task = compactTaskFromProjection(projection, taskId);
+  if (wantsJson(args)) {
+    printJson({
+      ok: true,
+      action: 'tagged',
+      task_id: taskId,
+      added: result.added,
+      removed: result.removed,
+      tags: result.tags,
+      version: result.event.version,
+      projection_path: outPath,
+      task,
+    });
+    return;
+  }
+  const parts = [];
+  if (result.added.length) parts.push(`+${result.added.join(' +')}`);
+  if (result.removed.length) parts.push(`-${result.removed.join(' -')}`);
+  console.log(`tagged ${taskRef(task)} ${parts.join(' ')} -> [${result.tags.join(', ')}] v${result.event.version}`);
+}
+
 function cmdChat(args) {
   const pos = positional(args);
   const id = pos[0];
@@ -7839,6 +8149,117 @@ function cmdFinish(args) {
   console.log(`finished ${taskRef(compactTaskFromProjection(projection, taskId))}`);
 }
 
+// Distinct from `done --failed`: a bulk sweep of duplicates/off-roadmap work
+// closes the task without ever claiming it did or didn't succeed. Writing
+// 'failed' here would corrupt the reward signal readers rely on (see
+// atris/reports/failed-tasks-analysis-2026-07-03.md, cluster 2, OBL-1622).
+function cmdArchive(args) {
+  const pos = positional(args);
+  const id = pos[0];
+  if (!id) {
+    failTask('atris task archive', 'missing_id', 'id required');
+  }
+  const reason = textFlag(args, ['--reason']);
+  if (!reason) {
+    failTask('atris task archive', 'missing_reason', 'atris task archive requires --reason "<why this is being swept, not failed>"');
+  }
+  const taskDb = getTaskDb();
+  const db = taskDb.open();
+  const taskId = requireTaskId(taskDb, db, id, 'atris task archive');
+  const actor = String(flag(args, '--as') || DEFAULT_OWNER);
+  // Explicit opt-in for sanctioned failed→archived cleanup (e.g. duplicate
+  // loop-tick orphans fail-closed before 'archived' existed). Without the
+  // flag, failed rows stay failed; done rows are never archivable.
+  const fromFailed = hasFlag(args, '--from-failed');
+  const result = taskDb.archiveTask(db, { id: taskId, actor, reason, fromFailed });
+  if (result.archived) {
+    const { projection, outPath } = writeDefaultProjection(taskDb, db);
+    if (wantsJson(args)) {
+      printJson({
+        ok: true,
+        action: 'archived',
+        task_id: taskId,
+        reason,
+        archived_from: result.row && result.row.metadata && result.row.metadata.archived_from || null,
+        projection_path: outPath,
+        task: compactTaskFromProjection(projection, taskId),
+      });
+      return;
+    }
+    const fromNote = result.row && result.row.metadata && result.row.metadata.archived_from
+      ? ` (was ${result.row.metadata.archived_from})`
+      : '';
+    console.log(`archived ${taskRef(compactTaskFromProjection(projection, taskId))}${fromNote}: ${reason}`);
+  } else {
+    const hint = result.reason === 'already_failed'
+      ? ' (use --from-failed to archive a fail-closed duplicate/off-roadmap row)'
+      : '';
+    const detail = `archive failed: ${taskId} ${result.reason}${hint}`;
+    if (wantsJson(args)) {
+      printJson({ ok: false, command: 'atris task archive', reason: result.reason, task_id: taskId, detail });
+      process.exit(1);
+    }
+    console.error(detail);
+    process.exit(1);
+  }
+}
+
+// One-time migration for OBL-1622: the 2026-06-10 "first-principles backlog
+// reset" archived ~125 certified, proof-backed tasks by writing status
+// 'failed' (no distinct archived status existed yet). This relabels exactly
+// the rows that carry that reset's metadata marker, using the same
+// UPDATE+appendTaskEvent write path as every other status transition in
+// lib/task-db.js — never a raw projection-JSON edit.
+function cmdRelabelArchived(args) {
+  const apply = hasFlag(args, '--apply');
+  const taskDb = getTaskDb();
+  const db = taskDb.open();
+  const workspaceRoot = taskDb.workspaceRoot();
+  const actor = String(flag(args, '--as') || DEFAULT_OWNER);
+  const result = taskDb.relabelArchivedTasks(db, { workspaceRoot, apply, actor });
+  if (apply && result.count > 0) {
+    appendRelabelArchivedJournalReceipt(workspaceRoot, { actor, count: result.count, ids: result.ids });
+  }
+  if (wantsJson(args)) {
+    printJson({
+      ok: true,
+      action: apply ? 'relabeled' : 'preview',
+      dry_run: !apply,
+      workspace_root: workspaceRoot,
+      ...result,
+    });
+    return;
+  }
+  if (!apply) {
+    console.log(`relabel-archived (dry-run): ${result.count} failed task(s) match the June 10 backlog-reset marker.`);
+    for (const s of result.sample) console.log(`  - ${s.id} ${s.title}`);
+    if (result.count > result.sample.length) console.log(`  ...and ${result.count - result.sample.length} more`);
+    console.log('Run with --apply --as <you> to relabel these failed -> archived.');
+    return;
+  }
+  console.log(`relabeled ${result.count} task(s) failed -> archived (June 10 backlog reset, OBL-1622).`);
+}
+
+function appendRelabelArchivedJournalReceipt(workspaceRoot, { actor, count, ids }) {
+  if (!workspaceRoot || !fs.existsSync(path.join(workspaceRoot, 'atris'))) return null;
+  const now = new Date();
+  const logName = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}-${String(now.getDate()).padStart(2, '0')}.md`;
+  const stamp = now.toTimeString().slice(0, 5);
+  const projectDir = path.join(workspaceRoot, 'atris', 'logs', logName.slice(0, 4));
+  fs.mkdirSync(projectDir, { recursive: true });
+  const logPath = path.join(projectDir, logName);
+  const idPreview = ids.slice(0, 10).join(', ') + (ids.length > 10 ? `, ...(+${ids.length - 10} more)` : '');
+  fs.appendFileSync(logPath, [
+    `## ${stamp} · Task relabel: failed -> archived (OBL-1622)`,
+    `- count: ${count}`,
+    `- reason: June 10 backlog-reset rows mislabeled failed; relabeled to archived`,
+    `- actor: ${actor}`,
+    `- ids: ${idPreview}`,
+    '',
+  ].join('\n'), 'utf8');
+  return logPath;
+}
+
 function cmdReady(args) {
   const pos = positional(args);
   const id = pos[0];
@@ -7851,18 +8272,26 @@ function cmdReady(args) {
   // turning a claim into executed evidence. --verify can carry an optional --proof note.
   const proofFlag = flag(args, '--proof');
   const verifyFlag = flag(args, '--verify');
+  const usedVerify = typeof verifyFlag === 'string' ? verifyFlag.trim() : '';
   let proof = typeof proofFlag === 'string' ? proofFlag : '';
-  if (typeof verifyFlag === 'string' && verifyFlag.trim()) {
-    const verified = buildVerifiedProof(verifyFlag, proof, undefined, { cwd: process.cwd() });
-    if (!verified.ok) {
-      const detail = verified.exit != null ? ` (exit ${verified.exit})` : (verified.signal ? ` (signal ${verified.signal})` : '');
+  const verifyAutoCertifyAllowed = !usedVerify || isAutoCertifyVerifyCommandAllowed(verifyFlag);
+  if (usedVerify) {
+    // Run the verifier once and write a receipt (pass or fail) so the review
+    // gate in lib/receipt-evidence.js can validate the exact path named in
+    // the proof, not just trust the prose.
+    const { writeTaskReceipt } = require('../lib/task-receipt');
+    const receipt = writeTaskReceipt({ taskId: id, command: verifyFlag, root: process.cwd() });
+    if (!receipt.passed) {
+      const detail = receipt.exit != null ? ` (exit ${receipt.exit})` : (receipt.signal ? ` (signal ${receipt.signal})` : '');
       console.error(`atris task ready: verifier failed${detail}: ${verifyFlag}`);
-      if (verified.output) console.error(verified.output);
-      else if (verified.error) console.error(verified.error);
+      if (receipt.output) console.error(receipt.output);
+      else if (receipt.error) console.error(receipt.error);
+      if (receipt.receiptPath) console.error(`receipt: ${receipt.receiptPath}`);
       process.exit(1);
     }
-    proof = verified.proof;
-    if (!wantsJson(args)) console.log(`✓ verified: \`${verifyFlag}\` exited 0`);
+    const base = proof.trim();
+    proof = `[verified] \`${verifyFlag}\` passed (exit 0)${base ? ` — ${base}` : ''}${receipt.output ? `\n${receipt.output}` : ''}\nReceipt: ${receipt.receiptPath}`;
+    if (!wantsJson(args)) console.log(`✓ verified: \`${verifyFlag}\` exited 0 (receipt ${receipt.receiptPath})`);
   }
   if (!proof) {
     console.error('atris task ready: --proof or --verify required');
@@ -7872,6 +8301,7 @@ function cmdReady(args) {
   const lesson = flag(args, '--lesson') || '';
   const nextTaskInput = normalizeReviewNextTaskInput(typeof flag(args, '--next') === 'string' ? flag(args, '--next') : '');
   const landing = landingFlags(args);
+  guardExplicitActor('atris task ready', flag(args, '--as'));
   const actor = String(flag(args, '--as') || DEFAULT_OWNER);
   const resultFields = {
     changed: textFlag(args, ['--changed', '--result', '--done']),
@@ -7906,6 +8336,11 @@ function cmdReady(args) {
     console.error(`ready failed: ${result.reason}`);
     process.exit(1);
   }
+  // Store the exact verifier command on the task itself (not just baked into
+  // proof prose) so sweep --auto-accept and certify-verified can re-run it
+  // live against the current checkout later, instead of re-deriving it from
+  // text or trusting a receipt file that may no longer exist.
+  if (usedVerify) stampReadyVerifyMetadata(taskDb, db, taskId, usedVerify);
   const landingAdvisory = warnIfLandingNeedsDayOnePm(landing, result.row && result.row.title);
   const { projection, outPath } = writeDefaultProjection(taskDb, db);
   const agentCertified = result.event.payload.agent_certified === true;
@@ -7918,13 +8353,18 @@ function cmdReady(args) {
     nextTask: nextTaskInput.nextTask,
   });
   const reviewChat = taskReviewChatHandoff(verifierTask, { reviewer: 'codex-review' });
+  const autolandOn = require('../lib/autoland').liveAcceptAuthorization(taskDb.workspaceRoot()).ok;
   const handoff = {
     native_goal_status: agentCertified ? 'agent_certified' : 'needs_second_agent_review',
     career_xp_status: 'pending_human_accept',
     next_action: agentCertified ? certifiedReviewNextAction(nextTaskInput.nextTask) : 'agent_review_again',
-    rule: agentCertified
-      ? 'Double-check complete; ready to keep moving. XP is awarded only after the human approves the task.'
-      : 'Proof is ready; one more agent check before human approval. XP waits for the human.',
+    rule: autolandOn
+      ? (agentCertified
+        ? 'double-check complete; autoland will accept this on the next tick.'
+        : 'proof is ready; autoland runs the second check and lands it on the next tick.')
+      : (agentCertified
+        ? 'double-check complete; ready to keep moving. XP is awarded only after the human approves the task.'
+        : 'proof is ready; one more agent check before human approval. XP waits for the human.'),
   };
   if (reviewChat) {
     handoff.review_chat_command = reviewChat.command;
@@ -7958,11 +8398,59 @@ function cmdReady(args) {
   console.log(`ready for approval ${taskRef(compactTaskFromProjection(projection, taskId))} v${result.event.version}`);
   if (resultTrace) console.log('Result trace recorded.');
   console.log(handoff.rule);
+  if (!verifyAutoCertifyAllowed) {
+    const ref = taskRef(compactTaskFromProjection(projection, taskId) || result.row || taskId);
+    console.log(`note: this verify command is outside the auto-certify allowlist, so autoland cannot run the second check itself. use a test command like node --test <file> or git diff --check, or have a second agent run: atris task review-chat ${ref} --as <reviewer>`);
+  }
   for (const hint of policyHints) {
     console.log(`policy (${hint.id}): ${hint.hint}`);
   }
 }
 
+// Standalone receipt writer: runs a verifier for a task and writes atris/runs/
+// evidence without moving the task to ready. Useful when you want a receipt
+// on record before or independent of a ready call, or to record a failed
+// verifier run for the audit trail. `atris task ready --verify` calls the
+// same writer inline and folds the resulting path into the proof.
+function cmdTaskReceipt(args) {
+  const pos = positional(args);
+  const id = pos[0];
+  if (!id) {
+    console.error('atris task receipt: id required');
+    process.exit(2);
+  }
+  const verifyFlag = flag(args, '--verify');
+  if (typeof verifyFlag !== 'string' || !verifyFlag.trim()) {
+    console.error('atris task receipt: --verify "<cmd>" required');
+    process.exit(2);
+  }
+  const taskDb = getTaskDb();
+  const db = taskDb.open();
+  const taskId = requireTaskId(taskDb, db, id, 'atris task receipt');
+  const { writeTaskReceipt } = require('../lib/task-receipt');
+  const receipt = writeTaskReceipt({ taskId, command: verifyFlag, root: process.cwd() });
+  if (wantsJson(args)) {
+    printJson({
+      ok: receipt.passed,
+      task_id: taskId,
+      command: verifyFlag,
+      receipt_path: receipt.receiptPath,
+      exit: receipt.exit,
+      passed: receipt.passed,
+    });
+    if (!receipt.passed) process.exit(1);
+    return;
+  }
+  if (receipt.passed) {
+    console.log(`receipt written: ${receipt.receiptPath} (exit 0)`);
+    console.log(`use: atris task ready ${taskId} --proof "Receipt: ${receipt.receiptPath}"`);
+  } else {
+    console.error(`verifier failed (exit ${receipt.exit}); receipt written: ${receipt.receiptPath}`);
+    if (receipt.output) console.error(receipt.output);
+    process.exit(1);
+  }
+}
+
 async function cmdAccept(args) {
   const pos = positional(args);
   const id = pos[0];
@@ -8041,6 +8529,7 @@ async function cmdAccept(args) {
   const xpProjection = refreshCareerXpAfterReview(reviewed);
   const { projection, outPath } = writeDefaultProjection(taskDb, db);
   const workspaceRoot = projection.workspace_root || process.cwd();
+  refreshExistingTodoMarkdown(taskDb, db, workspaceRoot);
   const brainScorecards = refreshBrainScorecardsAfterAccept(workspaceRoot);
   const nextMissionRoute = nextMissionRouteAfterAccept(workspaceRoot);
   // Inform the gate, never block it: show what the receipts named in the proof
@@ -8093,7 +8582,7 @@ function stampAutoAcceptMetadata(taskDb, db, taskId, actor, policy) {
   `).run(JSON.stringify(metadata), Date.now(), taskId);
 }
 
-function acceptReviewTask(taskDb, db, taskId, { actor, proof, reward, lesson = '', nextTask = '' }) {
+function acceptReviewTask(taskDb, db, taskId, { actor, proof, reward, lesson = '', nextTask = '', autoAccepted = false }) {
   const done = taskDb.doneTask(db, {
     id: taskId,
     status: 'done',
@@ -8101,6 +8590,7 @@ function acceptReviewTask(taskDb, db, taskId, { actor, proof, reward, lesson = '
     allowReview: true,
     action: 'accepted',
     proof,
+    autoAccepted,
   });
   if (!done.updated) {
     return { ok: false, reason: 'not_open_claimed_or_review' };
@@ -8113,7 +8603,10 @@ function acceptReviewTask(taskDb, db, taskId, { actor, proof, reward, lesson = '
     nextTask,
     proof,
     careerXpEligible: true,
+    autoAccepted,
   });
+  const acceptedRow = taskDb.getTask(db, taskId);
+  refreshExistingTodoMarkdown(taskDb, db, acceptedRow && acceptedRow.workspace_root);
   return { ok: true, reviewed };
 }
 
@@ -8145,6 +8638,25 @@ function stampCertifyVerifyMetadata(taskDb, db, taskId, actor, verify) {
   metadata.verify = metadata.verify || verify;
   metadata.certified_verified_at = new Date().toISOString();
   metadata.certified_verified_by = actor;
+  metadata.machine_verified = true;
+  db.prepare(`
+    UPDATE tasks
+       SET metadata = ?,
+           updated_at = ?
+     WHERE id = ?
+  `).run(JSON.stringify(metadata), Date.now(), taskId);
+}
+
+// `atris task ready --verify "<cmd>"` already runs the command live and
+// gates on exit 0, but that alone leaves no machine re-runnable trace once
+// the proof text scrolls out of easy reach: storing the exact command on
+// metadata.verify is what lets sweep --auto-accept (and certify-verified)
+// re-run it later against the current checkout instead of re-parsing prose.
+function stampReadyVerifyMetadata(taskDb, db, taskId, verify) {
+  const row = taskDb.getTask(db, taskId);
+  if (!row) return;
+  const metadata = row.metadata && typeof row.metadata === 'object' ? { ...row.metadata } : {};
+  metadata.verify = verify;
   db.prepare(`
     UPDATE tasks
        SET metadata = ?,
@@ -8196,16 +8708,28 @@ function cmdCertifyVerified(args) {
     // something an executed second-actor check cannot cure. A row with two
     // passes from ONE actor is exactly what this command exists to cure —
     // "certified" alone is not landable.
+    // strictVerify stays off in this eligibility probe: certify-verified runs
+    // the check itself right below, and strict mode here would execute it a
+    // second time per row before the real run.
     const evaluation = evaluateAutoAccept(task, { strictVerify: false });
     if (evaluation.eligible) {
       results.push({ ref, action: 'skipped', reason: 'already_landable' });
       continue;
     }
-    const curable = ['not_agent_certified', 'needs_second_reviewer_or_third_pass', 'insufficient_review_passes'];
+    // proof_not_executed is curable by definition: this command re-runs the
+    // named check and replaces the free-text claim with executed evidence.
+    const curable = ['not_agent_certified', 'needs_independent_reviewer', 'needs_second_reviewer_or_third_pass', 'insufficient_review_passes', 'proof_not_executed'];
     if (!curable.includes(evaluation.reason)) {
       results.push({ ref, action: 'skipped', reason: evaluation.reason });
       continue;
     }
+    // judge != worker: the re-run only counts as an independent check when
+    // its actor is not the builder of the row it is judging.
+    const builder = reviewIntegrity.taskBuilder(task);
+    if (builder && reviewIntegrity.normalizeActor(actor) === builder) {
+      results.push({ ref, action: 'skipped', reason: 'verifier_is_builder' });
+      continue;
+    }
     const verify = certifyVerifyCandidate(task);
     if (!verify) {
       results.push({ ref, action: 'skipped', reason: 'no_runnable_check_in_proof' });
@@ -8262,9 +8786,26 @@ function cmdCertifyVerified(args) {
   return payload;
 }
 
+// The landing: everything certified, one summary, one human gesture.
+// Review-by-N-pastes was the operator pain; this is the batch gate that
+// keeps human accept as the one gate without making it N gates.
+function cmdLanding(args) {
+  if (hasFlag(args, '--accept')) {
+    const passthrough = args.filter(arg => arg !== '--accept');
+    if (!passthrough.includes('--confirm-human-accept')) passthrough.push('--confirm-human-accept');
+    return cmdAutoAcceptCertified(passthrough);
+  }
+  cmdReviews(args);
+  console.log('');
+  console.log('land everything certified above in one gesture:');
+  console.log('  atris task landing --accept --as <you>');
+  console.log('(items needing one more check stay in review; only certified work lands)');
+}
+
 function cmdAutoAcceptCertified(args) {
   const dryRun = hasFlag(args, '--dry-run');
-  const strictVerify = hasFlag(args, '--strict-verify');
+  const acceptAll = hasFlag(args, '--all');
+  const strictVerify = !hasFlag(args, '--no-strict-verify') && !acceptAll;
   const actorFlag = flag(args, '--as');
   const hasHumanActor = validHumanActorFlag(actorFlag);
   const confirmedHumanAccept = hasFlag(args, '--confirm-human-accept');
@@ -8277,7 +8818,17 @@ function cmdAutoAcceptCertified(args) {
     : { ok: false };
   const actor = String(actorFlag || (policyAuth.ok ? policyAuth.actor : 'auto-accept-certified'));
   const limitRaw = flag(args, '--limit');
-  const max = limitRaw && limitRaw !== true ? Math.max(1, Number(limitRaw) || 12) : 12;
+  const hasExplicitLimit = Boolean(limitRaw) && limitRaw !== true;
+  // --all means sweep the full certified backlog, not just the first page of
+  // it. Before this fix `max` was hard-capped at 12 even under --all, so a
+  // real backlog (78 certified rows observed live) only ever drained 12/run —
+  // an invisible undercount the autoland heartbeat repeated every hour.
+  // AUTO_ACCEPT_ALL_SWEEP_CAP is a safety ceiling, not a target: a well-formed
+  // --all run should always scan fewer rows than this.
+  const AUTO_ACCEPT_ALL_SWEEP_CAP = 500;
+  const max = hasExplicitLimit
+    ? Math.max(1, Number(limitRaw) || 12)
+    : (acceptAll ? AUTO_ACCEPT_ALL_SWEEP_CAP : 12);
   const parsedReward = parseAcceptReward(flag(args, '--reward'));
   if (!parsedReward.ok) {
     console.error('atris task auto-accept-certified: reward must be a positive number');
@@ -8297,10 +8848,18 @@ function cmdAutoAcceptCertified(args) {
       'live auto-accept requires --as <human> so XP has an explicit human acceptance actor',
     );
   }
-  if (agentProofOnlyMode() && !dryRun) {
+  // The standing autoland policy clears this gate too, same as the two
+  // per-run human gates above: the owner flipped the policy, accepts run as
+  // that owner, and the cron tick would land the same rows an hour later
+  // anyway. Without this exception `atris autoland tick` was blind whenever
+  // invoked from an agent session (CLAUDECODE etc. in env): the spawned
+  // sweep failTask'd with no summary and the tick receipt showed nulls.
+  // A per-run --confirm-human-accept claim from an agent is still refused —
+  // policyAuth is only consulted when no per-run confirmation is passed.
+  if (agentProofOnlyMode() && !dryRun && !policyAuth.ok) {
     failAgentProofOnly(
       'atris task auto-accept-certified',
-      'Agent proof-only mode can preview certified rows with --dry-run, but cannot live-accept them.',
+      'Agent proof-only mode can preview certified rows with --dry-run, but cannot live-accept them without the standing autoland policy.',
     );
   }
 
@@ -8308,16 +8867,30 @@ function cmdAutoAcceptCertified(args) {
   const db = taskDb.open();
   const { projection, outPath } = writeDefaultProjection(taskDb, db);
   const queue = taskReviewQueue(projection, ['--limit', String(max)]);
+  const pendingReview = (projection.tasks || [])
+    .filter((t) => t && t.status === 'review' && t.review && t.review.approval_status === 'pending');
+  // Honest denominator for the summary line below: how many rows the
+  // projection actually certified, independent of any scan cap. If `scanned`
+  // ever comes in under `certified`, the undercount is visible instead of
+  // silent (the exact failure mode this fix closes).
+  const certifiedTotal = pendingReview.filter((t) => isAgentCertified(t)).length;
+  // The review queue only surfaces certified rows. Under --all the bar is
+  // the protected lanes, not certification, so scan every pending review.
+  const pool = acceptAll
+    ? pendingReview
+      .sort((a, b) => Number(b.updated_at || 0) - Number(a.updated_at || 0))
+      .slice(0, max)
+    : queue.items.filter(item => item.queue_role !== 'blocked');
   const results = [];
 
-  for (const item of queue.items) {
+  for (const item of pool) {
     const fullProjection = enrichTaskProjection(taskDb.taskProjection(db, { taskId: item.id }));
     const task = fullProjection.tasks[0] || null;
     if (!task) {
       results.push({ ref: item.display_id || item.id, eligible: false, reason: 'task_not_found', action: 'skipped' });
       continue;
     }
-    const evaluation = evaluateAutoAccept(task, { strictVerify });
+    const evaluation = evaluateAutoAccept(task, { strictVerify, acceptAll });
     if (!evaluation.eligible) {
       results.push({ ...evaluation, action: 'skipped' });
       continue;
@@ -8332,6 +8905,7 @@ function cmdAutoAcceptCertified(args) {
       reward: parsedReward.value,
       lesson: String(task.review?.lesson || task.metadata?.latest_agent_lesson || ''),
       nextTask: String(task.review?.next_task || task.metadata?.latest_agent_next_task || ''),
+      autoAccepted: true,
     });
     if (!accepted.ok) {
       results.push({ ...evaluation, action: 'accept_failed', reason: accepted.reason });
@@ -8349,17 +8923,24 @@ function cmdAutoAcceptCertified(args) {
 
   const { projection: finalProjection, outPath: finalPath } = writeDefaultProjection(taskDb, db);
   const summary = {
-    scanned: queue.items.length,
+    certified: certifiedTotal,
+    scanned: pool.length,
     accepted: results.filter(row => row.action === 'accepted').length,
     would_accept: results.filter(row => row.action === 'would_accept').length,
     skipped: results.filter(row => row.action === 'skipped').length,
     failed: results.filter(row => row.action === 'accept_failed').length,
+    // Visible undercount flag: true only if the pool was cut short by `max`
+    // while certified rows still existed beyond it. --all uses a high safety
+    // cap (AUTO_ACCEPT_ALL_SWEEP_CAP), so this should stay false in practice;
+    // if it ever flips true, the cap itself needs raising, not silence.
+    undercounted: certifiedTotal > pool.length,
   };
   if (wantsJson(args)) {
     printJson({
       ok: true,
       action: dryRun ? 'auto_accept_certified_dry_run' : 'auto_accept_certified',
       strict_verify: strictVerify,
+      accept_all: acceptAll,
       summary,
       ...summary,
       results,
@@ -8369,7 +8950,7 @@ function cmdAutoAcceptCertified(args) {
     return;
   }
   console.log(`AUTO-ACCEPT CERTIFIED (${dryRun ? 'dry-run' : 'execute'})`);
-  console.log(`${summary.accepted || summary.would_accept} accepted / ${summary.skipped} skipped / ${summary.failed} failed / ${summary.scanned} scanned`);
+  console.log(`${summary.certified} certified, ${summary.scanned} scanned, ${summary.accepted || summary.would_accept} accepted, ${summary.skipped} skipped${summary.failed ? `, ${summary.failed} failed` : ''}${summary.undercounted ? ' (UNDERCOUNTED — raise --limit or the sweep cap)' : ''}`);
   for (const row of results) {
     const nextAction = row.next_action ? ` next_action=${row.next_action}` : '';
     const reviewChat = row.review_chat_command ? ` review_chat=${row.review_chat_command}` : '';
@@ -8377,6 +8958,246 @@ function cmdAutoAcceptCertified(args) {
   }
 }
 
+const SWEEP_AUTO_ACCEPT_PROTECTED = new Set([
+  'money', 'deploy', 'release', 'publish', 'security', 'customer', 'outward',
+]);
+
+function autoAcceptSweepLabelValues(task) {
+  const metadata = task && task.metadata && typeof task.metadata === 'object' ? task.metadata : {};
+  const tags = Array.isArray(metadata.tags) ? metadata.tags : [];
+  return [
+    task && task.tag,
+    task && task.lane,
+    metadata.tag,
+    metadata.lane,
+    metadata.mission_lane,
+    metadata.stage,
+    ...tags,
+  ].filter(value => value !== undefined && value !== null && String(value).trim());
+}
+
+function autoAcceptSweepNormalizedTokens(value) {
+  const normalized = String(value || '').trim().toLowerCase().replace(/_/g, '-');
+  if (!normalized) return [];
+  return [normalized, ...normalized.split(/[^a-z0-9-]+/).filter(Boolean)];
+}
+
+function autoAcceptSweepDeniedReason(task) {
+  for (const value of autoAcceptSweepLabelValues(task)) {
+    const tokens = autoAcceptSweepNormalizedTokens(value);
+    for (const token of tokens) {
+      if (token === 'needs-human' || token === 'needshuman') {
+        return 'needs_human';
+      }
+      const protectedLane = [...SWEEP_AUTO_ACCEPT_PROTECTED].find((denied) =>
+        token === denied || token.replace(/s$/, '') === denied
+      );
+      if (protectedLane) return 'protected_lane';
+    }
+  }
+  return null;
+}
+
+function autoAcceptSweepLatestProof(task) {
+  const metadata = task && task.metadata || {};
+  const review = task && task.review || {};
+  return String(review.proof || metadata.latest_agent_proof || '').trim();
+}
+
+function autoAcceptSweepVerifierEvidence(proof, root) {
+  const evidence = extractReceiptEvidence(proof, root);
+  if (!evidence || !evidence.receipts || !evidence.receipts.length) {
+    return { ok: false, reason: 'no_passing_verifier', evidence: evidence || null };
+  }
+  if (evidence.missing && evidence.missing.length) {
+    return { ok: false, reason: 'receipt_missing', evidence };
+  }
+  const passing = evidence.receipts.filter((receipt) => receipt.verifier_passed === true);
+  if (!passing.length) {
+    return { ok: false, reason: 'no_passing_verifier', evidence };
+  }
+  const notPassed = evidence.receipts.find((receipt) => receipt.verifier_passed !== true);
+  if (notPassed) {
+    return { ok: false, reason: 'receipt_verifier_not_passed', evidence };
+  }
+  return {
+    ok: true,
+    evidence,
+    passing,
+    proved_by: passing.map((receipt) => `${receipt.path} verifier_passed=true`),
+  };
+}
+
+function autoAcceptSweepHappened(task) {
+  const review = task && task.review || {};
+  return clipStatusText(
+    review.landing?.happened
+      || review.result?.changed
+      || task?.title
+      || 'accepted verified task',
+    180,
+  );
+}
+
+function evaluateSweepAutoAccept(task, root) {
+  const ref = taskRef(task);
+  if (!task) return { eligible: false, ref, reason: 'task_not_found' };
+  if (task.status !== 'review') return { eligible: false, ref, reason: 'not_in_review' };
+  const metadata = task.metadata || {};
+  const review = task.review || {};
+  const approval = String(review.approval_status || metadata.approval_status || 'pending').toLowerCase();
+  if (approval !== 'pending') return { eligible: false, ref, reason: `approval_${approval}` };
+  if (metadata.auto_accepted_at) return { eligible: false, ref, reason: 'already_auto_accepted' };
+  const denied = autoAcceptSweepDeniedReason(task);
+  if (denied) return { eligible: false, ref, reason: denied };
+  const proof = autoAcceptSweepLatestProof(task);
+  if (!proof) return { eligible: false, ref, reason: 'no_proof' };
+
+  // 1. An explicit, stored verifier (`atris task ready --verify`, or a prior
+  // certify-verified stamp) is the strongest signal: re-run it live, right
+  // now, against the current checkout, and let it decide outright. This is
+  // what unblocks CLI-762/CLI-861-shaped proofs: a real green test cited (or
+  // executed) in the proof, but the older receipt-path check below could not
+  // find file evidence for it once `ready --verify` stopped writing a
+  // receipt file and started embedding the executed result into proof text.
+  const storedVerify = typeof metadata.verify === 'string' ? metadata.verify.trim() : '';
+  if (storedVerify) {
+    const result = runVerifyCommand(storedVerify, root);
+    if (!result.ok) return { eligible: false, ref, reason: result.reason, verify: storedVerify };
+    return {
+      eligible: true,
+      ref,
+      reason: 'verified_command',
+      policy: 'sweep_auto_accept_verified_command',
+      proof,
+      verify: storedVerify,
+      proved_by: [`${storedVerify} exited 0`],
+      happened: autoAcceptSweepHappened(task),
+    };
+  }
+
+  // 2. Legacy path: a receipt file explicitly named in proof text.
+  const verifier = autoAcceptSweepVerifierEvidence(proof, root);
+  if (verifier.ok) {
+    return {
+      eligible: true,
+      ref,
+      reason: 'verified_receipt',
+      policy: 'sweep_auto_accept_verified',
+      proof,
+      evidence: verifier.evidence,
+      proved_by: verifier.proved_by,
+      happened: autoAcceptSweepHappened(task),
+    };
+  }
+
+  // 3. No stored verifier and no receipt was even cited: try deriving a
+  // safe, runnable command straight from the proof text itself (same
+  // extractor certify-verified uses) and re-run it live. Only reached when
+  // there is nothing else to go on, so a proof that legitimately cites a
+  // real receipt keeps taking the receipt path above rather than racing an
+  // unrelated command mentioned in the same sentence.
+  if (verifier.reason === 'no_passing_verifier') {
+    const derived = certifyVerifyCandidate(task);
+    if (derived) {
+      const result = runVerifyCommand(derived, root);
+      if (result.ok) {
+        return {
+          eligible: true,
+          ref,
+          reason: 'verified_derived_command',
+          policy: 'sweep_auto_accept_verified_derived',
+          proof,
+          verify: derived,
+          proved_by: [`${derived} exited 0`],
+          happened: autoAcceptSweepHappened(task),
+        };
+      }
+      return { eligible: false, ref, reason: result.reason, verify: derived };
+    }
+  }
+
+  return { eligible: false, ref, reason: verifier.reason, evidence: verifier.evidence };
+}
+
+function cmdSweep(args) {
+  if (!hasFlag(args, '--auto-accept')) {
+    failTask(
+      'atris task sweep',
+      'missing_auto_accept',
+      'atris task sweep currently requires --auto-accept for the explicit verified accept policy',
+    );
+  }
+  const actor = String(flag(args, '--as') || 'orb-autoaccept');
+  const parsedReward = parseAcceptReward(flag(args, '--reward'));
+  if (!parsedReward.ok) {
+    failTask('atris task sweep', 'invalid_reward', 'atris task sweep --auto-accept reward must be a positive number');
+  }
+  const limitRaw = flag(args, '--limit');
+  const explicitLimit = limitRaw && limitRaw !== true ? Math.max(1, Number(limitRaw) || 0) : null;
+  const taskDb = getTaskDb();
+  const db = taskDb.open();
+  const { projection } = writeDefaultProjection(taskDb, db);
+  const root = projection.workspace_root || process.cwd();
+  let pendingReview = (projection.tasks || [])
+    .filter((task) => task && task.status === 'review' && task.review && task.review.approval_status === 'pending')
+    .sort((a, b) => Number(b.updated_at || 0) - Number(a.updated_at || 0));
+  if (explicitLimit) pendingReview = pendingReview.slice(0, explicitLimit);
+  const results = [];
+  for (const item of pendingReview) {
+    const fullProjection = enrichTaskProjection(taskDb.taskProjection(db, { taskId: item.id }));
+    const task = fullProjection.tasks[0] || null;
+    const evaluation = evaluateSweepAutoAccept(task, root);
+    if (!evaluation.eligible) {
+      results.push({ ...evaluation, action: 'skipped', task_id: task?.id || item.id || null });
+      continue;
+    }
+    const accepted = acceptReviewTask(taskDb, db, task.id, {
+      actor,
+      proof: evaluation.proof,
+      reward: parsedReward.value,
+      lesson: String(task.review?.lesson || task.metadata?.latest_agent_lesson || ''),
+      nextTask: String(task.review?.next_task || task.metadata?.latest_agent_next_task || ''),
+      autoAccepted: true,
+    });
+    if (!accepted.ok) {
+      results.push({ ...evaluation, action: 'accept_failed', task_id: task.id, reason: accepted.reason });
+      continue;
+    }
+    stampAutoAcceptMetadata(taskDb, db, task.id, actor, evaluation.policy);
+    refreshCareerXpAfterReview(accepted.reviewed);
+    results.push({
+      ...evaluation,
+      action: 'accepted',
+      task_id: task.id,
+      reward: accepted.reviewed.episode.reward.value,
+    });
+  }
+  const { outPath } = writeDefaultProjection(taskDb, db);
+  const summary = {
+    scanned: pendingReview.length,
+    accepted: results.filter((row) => row.action === 'accepted').length,
+    skipped: results.filter((row) => row.action === 'skipped').length,
+    failed: results.filter((row) => row.action === 'accept_failed').length,
+  };
+  if (wantsJson(args)) {
+    printJson({
+      ok: true,
+      action: 'sweep_auto_accept',
+      actor,
+      summary,
+      ...summary,
+      results,
+      projection_path: outPath,
+    });
+    return;
+  }
+  console.log(`TASK SWEEP AUTO-ACCEPT: ${summary.accepted} accepted / ${summary.scanned} scanned / ${summary.skipped} skipped${summary.failed ? ` / ${summary.failed} failed` : ''}`);
+  for (const row of results.filter((item) => item.action === 'accepted')) {
+    console.log(`ACCEPTED ${row.ref}: ${row.happened} | proved by ${row.proved_by.join(', ')}`);
+  }
+}
+
 function cmdRevise(args) {
   const pos = positional(args);
   const id = pos[0];
@@ -8444,6 +9265,7 @@ function cmdReview(args) {
   if (clearNextTask || (typeof nextTaskFlag === 'string' && !String(nextTaskFlag).trim())) clearedFields.push('next_task');
   const proof = proofFlagValue(args);
   const verify = textFlag(args, ['--verify']);
+  guardExplicitActor('atris task review', flag(args, '--as'));
   const actor = flag(args, '--as') || DEFAULT_OWNER;
   const rewardValue = reward === true || reward === null ? 0 : reward;
   if (agentProofOnlyMode() && Number(rewardValue) > 0) {
@@ -8481,7 +9303,11 @@ function cmdReview(args) {
     clearedFields,
   });
   if (!result.reviewed) {
-    console.error(`review failed: ${result.reason}`);
+    if (result.reason === 'judge_equals_worker') {
+      console.error(`review failed: judge_equals_worker: ${result.builder} built this task and cannot judge it. Hand off: atris task review ${id} --reward 1 --as <another member>`);
+    } else {
+      console.error(`review failed: ${result.reason}`);
+    }
     process.exit(1);
   }
   const nextCreated = createNextTaskIfRequested(taskDb, db, args, currentTask, result.episode.next_task_suggestion);
@@ -8587,21 +9413,23 @@ function cmdEvents(args) {
   const pos = positional(args);
   let taskId = pos[0] || null;
   const all = hasFlag(args, '--all');
+  const everywhere = taskScopeEverywhere(args);
   const rawLimit = flag(args, '--limit');
   const explicitLimit = rawLimit && rawLimit !== true ? Number(rawLimit) : null;
   const defaultRecentLimit = 24;
-  const limit = explicitLimit || (taskId ? 500 : (all ? null : defaultRecentLimit));
+  const limit = explicitLimit || (taskId ? 500 : (all || everywhere ? null : defaultRecentLimit));
   const taskDb = getTaskDb();
   const db = taskDb.open();
   if (taskId) taskId = requireTaskId(taskDb, db, taskId, 'atris task events');
+  const workspaceRoot = scopedWorkspaceRoot(taskDb, args, { everywhere });
   const events = taskDb.listTaskEvents(db, {
     taskId,
-    workspaceRoot: all || taskId ? null : taskDb.workspaceRoot(),
+    workspaceRoot: taskId ? null : workspaceRoot,
     limit,
-    order: taskId || all ? 'asc' : 'desc',
+    order: taskId || all || everywhere ? 'asc' : 'desc',
   });
   const refRows = taskDb.listTasks(db, {
-    workspaceRoot: all ? null : (taskId ? (taskDb.getTask(db, taskId) || {}).workspace_root : taskDb.workspaceRoot()),
+    workspaceRoot: everywhere ? null : (taskId ? (taskDb.getTask(db, taskId) || {}).workspace_root : workspaceRoot),
   });
   const refById = taskDb.taskDisplayRefMap(refRows);
   if (wantsJson(args)) {
@@ -8609,7 +9437,7 @@ function cmdEvents(args) {
       ok: true,
       action: 'events',
       task_id: taskId,
-      mode: taskId ? 'task' : (all ? 'ledger' : 'recent'),
+      mode: taskId ? 'task' : (everywhere ? 'ledger_everywhere' : (all ? 'ledger' : 'recent')),
       limit,
       events,
     });
@@ -8619,7 +9447,7 @@ function cmdEvents(args) {
     console.log('(no task events)');
     return;
   }
-  if (!taskId && !all) {
+  if (!taskId && !all && !everywhere) {
     console.log('TASK EVENTS');
     console.log(`recent ${events.length} event${events.length === 1 ? '' : 's'} (use --all for the full ledger, --limit N to adjust)`);
     console.log('');
@@ -8720,12 +9548,13 @@ function cmdLineage(args) {
 function cmdExport(args) {
   const out = flag(args, '--out') || path.join('.atris', 'state', 'tasks.projection.json');
   const all = hasFlag(args, '--all');
+  const everywhere = taskScopeEverywhere(args);
   const taskDb = getTaskDb();
   const db = taskDb.open();
   const outPath = path.resolve(String(out));
   const projection = enrichTaskProjection(taskDb.taskProjection(db, {
-    workspaceRoot: all ? null : taskDb.workspaceRoot(),
-    limit: 500,
+    workspaceRoot: scopedWorkspaceRoot(taskDb, args, { everywhere }),
+    limit: all ? null : 500,
   }));
   fs.mkdirSync(path.dirname(outPath), { recursive: true });
   fs.writeFileSync(outPath, JSON.stringify(projection, null, 2) + '\n', 'utf8');
@@ -8902,21 +9731,42 @@ function taskRenderSummaryLine(counts) {
   ].join('; ');
 }
 
+function refreshExistingTodoMarkdown(taskDb, db, workspaceRoot) {
+  const ws = workspaceRoot || taskDb.workspaceRoot();
+  const outPath = path.join(ws, 'atris', 'TODO.md');
+  if (!fs.existsSync(outPath)) return null;
+  const rows = taskDb.listTasks(db, { workspaceRoot: ws, limit: 500 });
+  const refRows = taskDb.listTasks(db, { workspaceRoot: ws });
+  const existingTodo = fs.readFileSync(outPath, 'utf8');
+  const preservedSections = [];
+  const endgameSection = extractTodoSectionMarkdown(existingTodo, 'Endgame');
+  if (endgameSection) preservedSections.push(endgameSection);
+  const markdownRows = markdownRowsForRender(taskDb, outPath, rows, refRows);
+  const markdown = taskDb.renderTodoMarkdown([...rows, ...markdownRows], {
+    refRows,
+    preservedSections,
+  });
+  fs.writeFileSync(outPath, markdown, 'utf8');
+  return outPath;
+}
+
 function cmdRender(args) {
   const out = flag(args, '--out') || path.join('atris', 'TODO.md');
   const all = hasFlag(args, '--all');
+  const everywhere = taskScopeEverywhere(args);
   const doneLimitRaw = flag(args, '--done-limit');
   const doneLimit = doneLimitRaw && doneLimitRaw !== true ? Number(doneLimitRaw) : undefined;
   const failedLimitRaw = flag(args, '--failed-limit');
   const failedLimit = failedLimitRaw && failedLimitRaw !== true ? Number(failedLimitRaw) : undefined;
   const taskDb = getTaskDb();
   const db = taskDb.open();
+  const workspaceRoot = scopedWorkspaceRoot(taskDb, args, { everywhere });
   const rows = taskDb.listTasks(db, {
-    workspaceRoot: all ? null : taskDb.workspaceRoot(),
-    limit: 500,
+    workspaceRoot,
+    limit: all ? null : 500,
   });
   const refRows = taskDb.listTasks(db, {
-    workspaceRoot: all ? null : taskDb.workspaceRoot(),
+    workspaceRoot,
   });
   const outPath = path.resolve(String(out));
   const existingTodo = fs.existsSync(outPath) ? fs.readFileSync(outPath, 'utf8') : '';
@@ -9525,6 +10375,7 @@ async function handleTaskApi(req, res, taskDb, db) {
       owner,
       reviewer,
       all: url.searchParams.get('all') === '1' || url.searchParams.get('all') === 'true',
+      everywhere: url.searchParams.get('everywhere') === '1' || url.searchParams.get('everywhere') === 'true',
       limit: Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 8,
       scope,
     });
@@ -9540,6 +10391,7 @@ async function handleTaskApi(req, res, taskDb, db) {
       owner,
       reviewer,
       all: url.searchParams.get('all') === '1' || url.searchParams.get('all') === 'true',
+      everywhere: url.searchParams.get('everywhere') === '1' || url.searchParams.get('everywhere') === 'true',
       limit: Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 8,
       scope,
     });
@@ -9570,6 +10422,7 @@ async function handleTaskApi(req, res, taskDb, db) {
       owner,
       reviewer,
       all: url.searchParams.get('all') === '1' || url.searchParams.get('all') === 'true',
+      everywhere: url.searchParams.get('everywhere') === '1' || url.searchParams.get('everywhere') === 'true',
       limit: Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 8,
       scope,
     });
@@ -10114,6 +10967,9 @@ async function run(args) {
       return cmdPlanPreview(rest);
     case 'note':   return cmdNote(rest);
     case 'say':    return cmdNote(rest);
+    case 'tag':
+    case 'tags':
+      return cmdTag(rest);
     case 'show':   return cmdShow(rest);
     case 'inspect': return cmdInspect(rest);
     case 'page':   return cmdPage(rest);
@@ -10122,11 +10978,17 @@ async function run(args) {
     case 'chat-review':
       return cmdReviewChat(rest);
     case 'ready':  return cmdReady(rest);
+    case 'receipt': return cmdTaskReceipt(rest);
     case 'result': return cmdResult(rest);
     case 'accept': return cmdAccept(rest);
+    case 'landing':
+    case 'land-review':
+      return cmdLanding(rest);
     case 'auto-accept-certified':
     case 'auto-accept':
       return cmdAutoAcceptCertified(rest);
+    case 'sweep':
+      return cmdSweep(rest);
     case 'certify-verified':
       return cmdCertifyVerified(rest);
     case 'accept-group':
@@ -10135,6 +10997,8 @@ async function run(args) {
     case 'done':   return cmdDone(rest);
     case 'finish': return cmdFinish(rest);
     case 'fail':   return cmdDone([...rest, '--failed']);
+    case 'archive': return cmdArchive(rest);
+    case 'relabel-archived': return cmdRelabelArchived(rest);
     case 'review': return cmdReview(rest);
     case 'reviews':
     case 'review-queue':