atris 3.34.0 → 3.35.0

package/commands/autoland.js

@@ -7,6 +7,9 @@ const { spawnSync } = require('child_process');
 
 const autoland = require('../lib/autoland');
 const { operatorReady, hasAgentJargon } = autoland;
+const MISSION_AUTO_VERIFY_STATUSES = new Set(['planning', 'paused', 'ready']);
+const CLOSED_TASK_STATUSES = new Set(['done', 'archived']);
+const MAX_MISSION_AUTO_VERIFY_PER_TICK = 3;
 
 function repoRoot(cwd = process.cwd()) {
   const result = spawnSync('git', ['rev-parse', '--show-toplevel'], { cwd, encoding: 'utf8' });
@@ -62,6 +65,130 @@ function readProjection(root) {
   }
 }
 
+function compactId(value) {
+  return String(value || '').trim();
+}
+
+function taskIdentityRefs(task) {
+  return [
+    task?.id,
+    task?.display_id,
+    task?.legacy_ref,
+    task?.ref,
+    task?.task_id,
+    task?.metadata?.task_id,
+    task?.metadata?.display_id,
+    task?.metadata?.ref,
+  ].map(compactId).filter(Boolean);
+}
+
+function taskGoalRefs(task) {
+  return [
+    task?.goal_id,
+    task?.goalId,
+    task?.mission_id,
+    task?.missionId,
+    task?.metadata?.goal_id,
+    task?.metadata?.goalId,
+    task?.metadata?.mission_id,
+    task?.metadata?.missionId,
+    task?.metadata?.goal?.id,
+  ].map(compactId).filter(Boolean);
+}
+
+function missionTaskRefs(mission) {
+  return [
+    ...(Array.isArray(mission?.task_ids) ? mission.task_ids : []),
+    mission?.task_id,
+    mission?.current_task_id,
+    mission?.task_ref,
+    mission?.xp_task?.task_id,
+    mission?.xp_task?.ref,
+  ].map(compactId).filter(Boolean);
+}
+
+function attachedTasksForMission(mission, tasks) {
+  const missionId = compactId(mission?.id);
+  const taskRefs = new Set(missionTaskRefs(mission));
+  return (tasks || []).filter((task) => {
+    if (missionId && taskGoalRefs(task).includes(missionId)) return true;
+    if (taskRefs.size === 0) return false;
+    return taskIdentityRefs(task).some((ref) => taskRefs.has(ref));
+  });
+}
+
+function taskIsClosed(task) {
+  return CLOSED_TASK_STATUSES.has(String(task?.status || '').trim().toLowerCase());
+}
+
+function missionHasVerifier(mission) {
+  return Boolean(String(mission?.verifier || mission?.effective_verifier || '').trim());
+}
+
+function missionReadyForClosedTaskVerify(mission, tasks) {
+  const status = String(mission?.status || '').trim().toLowerCase();
+  if (!MISSION_AUTO_VERIFY_STATUSES.has(status)) return false;
+  if (!missionHasVerifier(mission)) return false;
+  if (mission?.verifier_result?.passed === true) return false;
+  const attached = attachedTasksForMission(mission, tasks);
+  return attached.length > 0 && attached.every(taskIsClosed);
+}
+
+function parseMissionVerifyResult(id, result) {
+  let payload = null;
+  try {
+    payload = JSON.parse(result.stdout || '{}');
+  } catch {}
+  const verifier = payload?.verifier_result || null;
+  const passed = verifier ? verifier.passed === true : null;
+  return {
+    id,
+    result: passed === true ? 'passed' : passed === false ? 'failed' : (payload?.action || (result.status === 0 ? 'tick_recorded' : 'tick_failed')),
+    status: payload?.mission?.status || null,
+    receipt_path: payload?.receipt_path || null,
+    exit_status: result.status,
+  };
+}
+
+function verifyClosedTaskMissions(root, tasks, { limit = MAX_MISSION_AUTO_VERIFY_PER_TICK } = {}) {
+  const verified = [];
+  const errors = [];
+  let candidates = [];
+  try {
+    const { listMissions } = require('./mission');
+    candidates = listMissions(root).filter((mission) => missionReadyForClosedTaskVerify(mission, tasks)).slice(0, limit);
+  } catch (err) {
+    return {
+      verified,
+      errors: [{ error: String((err && err.message) || err).slice(0, 200) }],
+    };
+  }
+
+  for (const mission of candidates) {
+    const result = runOwnCli(root, [
+      'mission',
+      'tick',
+      mission.id,
+      '--verify',
+      '--summary',
+      'All linked repair tasks are closed; autoland re-ran the mission verifier.',
+      '--json',
+    ]);
+    const outcome = parseMissionVerifyResult(mission.id, result);
+    verified.push(outcome);
+    if (result.status !== 0 || outcome.result === 'failed' || outcome.result === 'tick_failed') {
+      errors.push({
+        id: mission.id,
+        result: outcome.result,
+        status: result.status,
+        stderr: String(result.stderr || '').slice(0, 200),
+        stdout: String(result.stdout || '').slice(-500),
+      });
+    }
+  }
+  return { verified, errors };
+}
+
 function landSummarySafe(root) {
   try {
     return require('./land').landSummary(root);
@@ -70,9 +197,10 @@ function landSummarySafe(root) {
   }
 }
 
-function evaluateQueue(root, { strictVerify }) {
+function evaluateQueue(root, { strictVerify, acceptAll }) {
   const cliArgs = ['task', 'auto-accept-certified', '--dry-run', '--json', '--limit', '50'];
-  if (strictVerify) cliArgs.push('--strict-verify');
+  if (acceptAll) cliArgs.push('--all');
+  else if (strictVerify === false) cliArgs.push('--no-strict-verify');
   const result = runOwnCli(root, cliArgs);
   try {
     const parsed = JSON.parse(result.stdout);
@@ -92,6 +220,9 @@ function plainReason(reason) {
     denied_tag_feedback: 'customer feedback — yours to approve',
     denied_tag_voice: 'voice/comms — yours to approve',
     needs_second_reviewer_or_third_pass: 'needs one more independent check first',
+    needs_independent_reviewer: 'built and judged by the same actor, needs an independent check',
+    verifier_is_builder: 'the re-check actor built this row, another actor must re-check',
+    judge_equals_worker: 'built and judged by the same actor, hand the review to someone else',
     not_agent_certified: 'not certified yet',
     insufficient_review_passes: 'not enough review passes yet',
     strict_verify_missing: 'no recorded check command to re-run',
@@ -106,7 +237,8 @@ function showStatus(root, args) {
   const policy = autoland.readPolicy(root);
   const enabled = Boolean(policy && policy.enabled);
   const strictVerify = policy ? policy.strict_verify !== false : true;
-  const results = evaluateQueue(root, { strictVerify })
+  const acceptAll = Boolean(policy && policy.accept_all);
+  const results = evaluateQueue(root, { strictVerify, acceptAll })
     .filter((r) => r.reason !== 'not_in_review');
   const wouldLand = results.filter((r) => r.action === 'would_accept');
   const blocked = results.filter((r) => r.action !== 'would_accept');
@@ -128,9 +260,18 @@ function showStatus(root, args) {
   console.log('');
   console.log(`autoland — certified work lands itself; you keep the irreversible calls`);
   console.log('');
-  console.log(`  policy: ${enabled ? `on (flipped by ${policy.enabled_by}${policy.enabled_at ? ` on ${String(policy.enabled_at).slice(0, 10)}` : ''})` : 'off — everything waits for you'}`);
+  const policyOwner = String(policy?.enabled_by || 'unknown').trim() || 'unknown';
+  const policyText = enabled
+    ? (policy.default
+      ? `on by default for this workspace (no policy set; would accept as ${policyOwner}). set it: atris autoland on`
+      : `on (flipped by ${policyOwner}${policy.enabled_at ? ` on ${String(policy.enabled_at).slice(0, 10)}` : ''})`)
+    : 'off - everything waits for you';
+  console.log(`  policy: ${policyText}`);
+  if (enabled && acceptAll) console.log('  bar: everything lands except the protected lanes (money, deploys, security, customer, outward)');
   console.log(`  heartbeat: ${autoland.cronInstalled(root) ? 'running hourly' : 'not installed'}`);
   if (policy && policy.imessage_to) console.log(`  daily message: ${policy.imessage_to} at ${policy.digest_hour ?? autoland.DEFAULT_DIGEST_HOUR}:00`);
+  const reapTrouble = autoland.readState(root).last_reap_error;
+  if (reapTrouble) console.log(`  cleanup trouble: daily sweep failed on ${reapTrouble.date} (${reapTrouble.error}) — run: atris land --reap`);
   console.log('');
   if (wouldLand.length > 0) {
     console.log(`  ready to land on their own: ${wouldLand.length}`);
@@ -163,6 +304,7 @@ function turnOn(root, args) {
   const to = flag(args, '--to', '');
   const digestHour = Number(flag(args, '--digest-hour', autoland.DEFAULT_DIGEST_HOUR));
   const alarmHours = Number(flag(args, '--alarm-hours', autoland.DEFAULT_ALARM_HOURS));
+  const acceptAll = args.includes('--all');
   const policy = autoland.writePolicy(root, {
     enabled: true,
     enabled_by: owner,
@@ -171,11 +313,13 @@ function turnOn(root, args) {
     digest_hour: Number.isFinite(digestHour) ? digestHour : autoland.DEFAULT_DIGEST_HOUR,
     alarm_hours: Number.isFinite(alarmHours) && alarmHours > 0 ? alarmHours : autoland.DEFAULT_ALARM_HOURS,
     strict_verify: !args.includes('--no-strict-verify'),
+    accept_all: acceptAll,
   });
   const cronOk = autoland.installCron(root);
   console.log('');
   console.log('autoland is on.');
-  console.log(`  certified, verified, reversible work now lands itself, accepted as ${owner}.`);
+  if (acceptAll) console.log(`  everything in review now lands itself, accepted as ${owner} — only the protected lanes wait.`);
+  else console.log(`  certified, verified, reversible work now lands itself, accepted as ${owner}.`);
   console.log('  protected lanes (money, deploys, security, customer, outward) still wait for you.');
   console.log(`  heartbeat: ${cronOk ? 'installed, runs hourly' : 'could not install cron — run atris autoland tick yourself'}`);
   if (policy.imessage_to) {
@@ -209,6 +353,8 @@ function runDigest(root, args, { forceSend = false } = {}) {
     landed: landSummarySafe(root),
     project: projectName(root),
     nextMoves: digestNextMoves(root),
+    acceptAll: Boolean(policy.accept_all),
+    reapError: autoland.readState(root).last_reap_error?.error || null,
   });
   console.log(text);
   // the full story: what each piece actually was, in its own words
@@ -239,6 +385,15 @@ function runDigest(root, args, { forceSend = false } = {}) {
   return 0;
 }
 
+function pidAlive(pid) {
+  try {
+    process.kill(Number(pid), 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function runTick(root, args) {
   const json = args.includes('--json');
   const policy = autoland.readPolicy(root);
@@ -249,28 +404,70 @@ function runTick(root, args) {
     return 0;
   }
 
+  // One live tick at a time: verify re-runs can take minutes each, and a
+  // second hourly cron firing into the same snapshot double-accepts,
+  // double-alarms, and double-digests. A stale lock (dead pid or >55min)
+  // never wedges the loop.
+  const lockPath = path.join(root, '.atris', 'state', 'autoland.tick.lock');
+  try {
+    const prev = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+    const fresh = Date.now() - Number(prev.at || 0) < 55 * 60 * 1000;
+    if (fresh && pidAlive(prev.pid)) {
+      receipt.skipped_reason = 'tick_already_running';
+      if (json) console.log(JSON.stringify(receipt));
+      else console.log('autoland tick: another tick is still running; skipped.');
+      return 0;
+    }
+  } catch {}
+  try {
+    fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+    fs.writeFileSync(lockPath, JSON.stringify({ pid: process.pid, at: Date.now() }));
+  } catch {}
+  try {
+    return runTickBody(root, { json, policy, receipt });
+  } finally {
+    try { fs.unlinkSync(lockPath); } catch {}
+  }
+}
+
+function runTickBody(root, { json, policy, receipt }) {
+
   // 1. certify what has executable proof — re-run the runnable check named in
   // each Review proof as a second actor. Without this the tick only lands rows
   // some always-on mission happened to certify, and everything else waits on a
   // human who never needed to look. Denied lanes and check-less proofs still wait.
-  if (policy.drain_reviews !== false) {
-    const certify = runOwnCli(root, ['task', 'certify-verified', '--json']);
-    try {
-      const parsed = JSON.parse(certify.stdout);
-      receipt.reviews_certified = parsed.certified ?? 0;
-      if (parsed.ok !== true) receipt.certify_error = 'certify-verified failed';
-    } catch {
-      receipt.certify_error = certify.stderr.slice(0, 200) || 'certify-verified output unreadable';
-    }
+  const certify = runOwnCli(root, ['task', 'certify-verified', '--json']);
+  try {
+    const parsed = JSON.parse(certify.stdout);
+    receipt.reviews_certified = parsed.certified ?? 0;
+    if (parsed.ok !== true) receipt.certify_error = 'certify-verified failed';
+  } catch {
+    receipt.certify_error = certify.stderr.slice(0, 200) || 'certify-verified output unreadable';
   }
 
-  // 2. land what is eligible — the policy is the standing authorization
-  const cliArgs = ['task', 'auto-accept-certified', '--json', '--limit', '12'];
-  if (policy.strict_verify !== false) cliArgs.push('--strict-verify');
+  // 2. land what is eligible — the policy is the standing authorization.
+  // No hardcoded --limit here: a fixed low cap (this used to be 12) silently
+  // undercounts a real backlog every single tick — 12/hour forever even with
+  // 78 certified rows waiting. Let `atris task auto-accept-certified` apply
+  // its own default (12 without --all, a high safety cap under --all) so a
+  // policy with accept_all:true actually drains the full certified set.
+  const cliArgs = ['task', 'auto-accept-certified', '--json'];
+  if (policy.accept_all) cliArgs.push('--all');
+  else if (policy.strict_verify === false) cliArgs.push('--no-strict-verify');
   const accept = runOwnCli(root, cliArgs);
   try {
     const parsed = JSON.parse(accept.stdout);
+    // A refused sweep (ok:false — a guard tripped, policy race) carries no
+    // summary fields. Name the reason instead of leaving nulls that read as
+    // "no work": a blind heartbeat must say WHY it is blind.
+    if (parsed.ok === false) {
+      receipt.accept_error = String(parsed.reason || 'auto-accept refused');
+    }
     receipt.landed = (parsed.results || []).filter((r) => r.action === 'accepted').map((r) => r.ref);
+    receipt.certified = parsed.certified ?? null;
+    receipt.scanned = parsed.scanned ?? null;
+    receipt.skipped = parsed.skipped ?? null;
+    receipt.undercounted = Boolean(parsed.undercounted);
   } catch (err) {
     receipt.accept_error = accept.stderr.slice(0, 200) || 'auto-accept output unreadable';
   }
@@ -306,6 +503,42 @@ function runTick(root, args) {
     }
   }
 
+  // 3b. janitor, every tick: a mission left paused past 48h and a worktree
+  // already merged into base are the same rot pattern as an unlanded branch —
+  // left alone they accumulate until a human runs `mission stop` and
+  // `worktree cleanup --apply` by hand, which is exactly the chore autoland
+  // exists to remove. Off switch: policy.janitor === false (default on, the
+  // same absent-means-on convention as live_updates/strict_verify). Counts
+  // accumulate in state so the daily digest reports the day's total, not
+  // just the last tick's.
+  receipt.missions_stopped = 0;
+  receipt.worktrees_reaped = 0;
+  if (policy.janitor !== false) {
+    try {
+      const { reapPausedMissions } = require('./mission');
+      const stopped = reapPausedMissions(root);
+      receipt.missions_stopped = stopped.length;
+      if (stopped.length > 0) receipt.missions_stopped_refs = stopped.map((m) => m.id);
+    } catch (err) {
+      receipt.janitor_mission_error = String((err && err.message) || err).slice(0, 200);
+    }
+    try {
+      const { cleanupWorktrees } = require('./worktree');
+      const cleaned = cleanupWorktrees({ root, apply: true });
+      receipt.worktrees_reaped = cleaned.removed.length;
+      if (cleaned.removed.length > 0) receipt.worktrees_reaped_paths = cleaned.removed.map((w) => w.path);
+    } catch (err) {
+      receipt.janitor_worktree_error = String((err && err.message) || err).slice(0, 200);
+    }
+    if (receipt.missions_stopped || receipt.worktrees_reaped) {
+      const tally = state.janitor && typeof state.janitor === 'object' ? state.janitor : {};
+      state.janitor = {
+        missions_stopped: (Number(tally.missions_stopped) || 0) + receipt.missions_stopped,
+        worktrees_reaped: (Number(tally.worktrees_reaped) || 0) + receipt.worktrees_reaped,
+      };
+    }
+  }
+
   // 4. daily digest at the configured hour
   const today = new Date().toISOString().slice(0, 10);
   const digestHour = Number(policy.digest_hour ?? autoland.DEFAULT_DIGEST_HOUR);
@@ -316,6 +549,9 @@ function runTick(root, args) {
       landed: landSummarySafe(root),
       project: projectName(root),
       nextMoves: digestNextMoves(root),
+      acceptAll: Boolean(policy.accept_all),
+      reapError: state.last_reap_error?.error || null,
+      janitor: state.janitor || null,
     });
     if (policy.imessage_to) {
       const sent = autoland.sendImessage(root, policy.imessage_to, text);
@@ -323,6 +559,7 @@ function runTick(root, args) {
     }
     receipt.digest_text = text;
     state.last_digest_date = today;
+    delete state.janitor;
 
     // 5. once a day, keep the receipt shelf lean: compress old run receipts
     // into the manifest and drop unreferenced clutter, newest 200 kept.
@@ -334,11 +571,58 @@ function runTick(root, args) {
       receipt.receipts_pruned = null;
     }
   }
+  // 6. once a day, drain the landing itself: back up (bundle + patches into
+  // .atris/salvage/) then clear branches already landed or past TTL, and
+  // their worktrees. Local-only — remote branches may back open PRs, and
+  // closing those is a human call. Its own date gate, not the digest hour,
+  // so a machine asleep at digest time still drains on its next tick.
+  // Without this the board grows until a human runs `atris land --reap`,
+  // which is exactly the chore autoland exists to remove.
+  if (state.last_reap_date !== today) {
+    try {
+      const { reap } = require('./land');
+      const reaped = reap(root, { remote: false, includeDetached: false });
+      receipt.reaped = {
+        branches: reaped.deletedBranches.length,
+        worktrees: reaped.removedWorktrees.length,
+        bundle: reaped.bundle,
+        patches: reaped.patches.length,
+      };
+      if (reaped.bundleError) receipt.reap_error = `backup failed, unlanded work kept in place: ${reaped.bundleError}`;
+    } catch (err) {
+      receipt.reap_error = String((err && err.message) || err).slice(0, 200);
+    }
+    // Missions rot the same way branches do: paused/planning/ready and
+    // untouched for a week means abandoned. Age them out under the same
+    // daily gate so `mission list` shows work, not archaeology.
+    try {
+      const { expireStaleMissions } = require('./mission');
+      const expiredMissions = expireStaleMissions(root);
+      if (expiredMissions.length > 0) receipt.expired_missions = expiredMissions.length;
+    } catch (err) {
+      receipt.mission_expiry_error = String((err && err.message) || err).slice(0, 200);
+    }
+    try {
+      const missionVerify = verifyClosedTaskMissions(root, readProjection(root));
+      if (missionVerify.verified.length > 0) receipt.verified_missions = missionVerify.verified;
+      if (missionVerify.errors.length > 0) receipt.mission_verify_errors = missionVerify.errors;
+    } catch (err) {
+      receipt.mission_verify_errors = [{ error: String((err && err.message) || err).slice(0, 200) }];
+    }
+    state.last_reap_date = today;
+    // a failed sweep must not be a secret: status and the next digest carry
+    // it until a sweep succeeds. The date gate above still holds so a broken
+    // repo errors once a day, not hourly.
+    if (receipt.reap_error) state.last_reap_error = { date: today, error: receipt.reap_error };
+    else delete state.last_reap_error;
+  }
   autoland.writeState(root, state);
 
   if (json) console.log(JSON.stringify(receipt));
   else {
-    console.log(`autoland tick: ${receipt.reviews_certified ?? 0} reviews certified, ${receipt.landed.length} landed${receipt.landed.length ? ` (${receipt.landed.join(', ')})` : ''}, ${receipt.alarms} alarms, digest ${receipt.digest_sent ? 'sent' : 'not due'}`);
+    const reapNote = receipt.reaped ? `, reaped ${receipt.reaped.branches} landed/overdue branches` : '';
+    const janitorNote = `, janitor stopped ${receipt.missions_stopped} mission${receipt.missions_stopped === 1 ? '' : 's'} + reaped ${receipt.worktrees_reaped} worktree${receipt.worktrees_reaped === 1 ? '' : 's'}`;
+    console.log(`autoland tick: ${receipt.reviews_certified ?? 0} reviews certified, ${receipt.landed.length} landed${receipt.landed.length ? ` (${receipt.landed.join(', ')})` : ''}, ${receipt.alarms} alarms, digest ${receipt.digest_sent ? 'sent' : 'not due'}${reapNote}${janitorNote}`);
   }
   return 0;
 }
@@ -355,6 +639,9 @@ function showHelp() {
   console.log('  atris autoland on [--to <phone>]   flip it on: hourly heartbeat, daily');
   console.log('                                     message, ping when something waits');
   console.log('                                     on you past 24h');
+  console.log('  atris autoland on --all            lower the bar: everything lands except');
+  console.log('                                     the protected lanes; a failing recorded');
+  console.log('                                     check still blocks');
   console.log('  atris autoland off                 back to approving every item');
   console.log('  atris autoland digest [--send]     the daily message, now');
   console.log('  atris autoland tick [--json]       one heartbeat (what the hourly cron runs)');
@@ -382,4 +669,11 @@ function autolandCommand(args = []) {
   return 1;
 }
 
-module.exports = { autolandCommand, operatorReady, hasAgentJargon };
+module.exports = {
+  autolandCommand,
+  attachedTasksForMission,
+  missionReadyForClosedTaskVerify,
+  operatorReady,
+  hasAgentJargon,
+  verifyClosedTaskMissions,
+};

package/commands/business.js

@@ -28,6 +28,42 @@ function isHelpToken(arg) {
   return arg === '--help' || arg === '-h' || arg === 'help' || arg === '-?';
 }
 
+const BUSINESS_CREATE_USAGE = 'Usage: atris business create <name> [--description "..."] [--workspace] [--here|--root <dir>]';
+
+function isAccidentalHelpBusiness(value) {
+  const raw = String(value || '').trim();
+  if (!raw) return false;
+  if (isHelpToken(raw)) return true;
+  const normalized = slugify(raw);
+  if (normalized === 'help') return true;
+  if (/^help-\d+$/.test(normalized)) return true;
+  return false;
+}
+
+function validateBusinessCreateName(name) {
+  if (!name || !String(name).trim()) {
+    return { ok: false, usage: BUSINESS_CREATE_USAGE };
+  }
+  if (isHelpToken(name)) {
+    return { ok: false, usage: BUSINESS_CREATE_USAGE };
+  }
+  if (String(name).startsWith('-')) {
+    return {
+      ok: false,
+      usage: BUSINESS_CREATE_USAGE,
+      detail: `Refusing to create a business named "${name}" — looks like a flag, not a name.`,
+    };
+  }
+  if (isAccidentalHelpBusiness(name)) {
+    return {
+      ok: false,
+      usage: BUSINESS_CREATE_USAGE,
+      detail: `Refusing to create a business named "${name}" — looks like accidental help output, not a real business.`,
+    };
+  }
+  return { ok: true };
+}
+
 function loadBusinesses() {
   const p = getBusinessConfigPath();
   if (!fs.existsSync(p)) return {};
@@ -308,14 +344,46 @@ function analyzeBusinessDoctor({ cache = {}, cloudBusinesses = [], folderBinding
     }
   }
 
+  const cacheRemovals = [];
+  for (const business of cloudBusinesses || []) {
+    if (!isAccidentalHelpBusiness(business?.name) && !isAccidentalHelpBusiness(business?.slug)) continue;
+    const label = business.slug || business.name || business.id;
+    issues.push({
+      level: 'warn',
+      code: 'accidental-help-business',
+      subject: label,
+      message: `${label} looks like an accidental help business (April 2026 ghost rows)`,
+      fixable: true,
+    });
+  }
+
+  for (const [key, entry] of Object.entries(cache || {})) {
+    const active = findActiveMatch(key, entry);
+    const accidental = isAccidentalHelpBusiness(key)
+      || isAccidentalHelpBusiness(entry?.name)
+      || isAccidentalHelpBusiness(entry?.slug)
+      || (active && (isAccidentalHelpBusiness(active.name) || isAccidentalHelpBusiness(active.slug)));
+    if (!accidental) continue;
+    issues.push({
+      level: 'warn',
+      code: 'accidental-help-cache',
+      subject: key,
+      message: `${key} is cached for an accidental help business`,
+      fixable: true,
+    });
+    if (!cacheRemovals.includes(key)) cacheRemovals.push(key);
+  }
+
   return {
     issues,
     cacheUpdates,
+    cacheRemovals,
     stats: {
       cache_entries: Object.keys(cache || {}).length,
       cloud_active: cloudBusinesses.length,
       folders: folderBindings.length,
       fixable_cache_entries: Object.keys(cacheUpdates).length,
+      accidental_help_cache_removals: cacheRemovals.length,
     },
   };
 }
@@ -2191,11 +2259,20 @@ async function businessDoctor(...args) {
   });
 
   const cacheUpdateKeys = Object.keys(analysis.cacheUpdates);
+  const cacheRemovalKeys = analysis.cacheRemovals || [];
   let fixed = [];
-  if (options.fix && cacheUpdateKeys.length > 0) {
-    cache = { ...cache, ...analysis.cacheUpdates };
+  if (options.fix && (cacheUpdateKeys.length > 0 || cacheRemovalKeys.length > 0)) {
+    if (cacheUpdateKeys.length > 0) {
+      cache = { ...cache, ...analysis.cacheUpdates };
+    }
+    for (const key of cacheRemovalKeys) {
+      delete cache[key];
+      fixed.push(`removed:${key}`);
+    }
+    if (cacheUpdateKeys.length > 0) {
+      fixed.push(...cacheUpdateKeys);
+    }
     saveBusinesses(cache);
-    fixed = cacheUpdateKeys;
     analysis = analyzeBusinessDoctor({
       cache,
       cloudBusinesses: listResult.data,
@@ -2237,11 +2314,10 @@ async function businessDoctor(...args) {
 }
 
 async function createBusinessInternal(name, flags = [], mode = 'auto') {
-  if (!name || isHelpToken(name) || String(name).startsWith('-')) {
-    console.error('Usage: atris business create <name> [--description "..."] [--workspace] [--here|--root <dir>]');
-    if (name && String(name).startsWith('-') && !isHelpToken(name)) {
-      console.error(`\n  Refusing to create a business named "${name}" — looks like a flag, not a name.`);
-    }
+  const validation = validateBusinessCreateName(name);
+  if (!validation.ok) {
+    console.error(validation.usage);
+    if (validation.detail) console.error(`\n  ${validation.detail}`);
     process.exit(1);
   }
 
@@ -2897,6 +2973,11 @@ async function businessCommand(subcommand, ...args) {
     printBusinessHelp();
     return;
   }
+  const nameTakingSubcommands = new Set(['create', 'new', 'init', 'workspace']);
+  if (nameTakingSubcommands.has(subcommand) && args.some(isHelpToken)) {
+    printBusinessHelp();
+    return;
+  }
   if (args.length > 0 && isHelpToken(args[0]) && subcommand !== 'doctor') {
     printBusinessHelp();
     return;
@@ -2999,6 +3080,8 @@ module.exports = {
   saveBusinesses,
   getBusinessConfigPath,
   businessMatchesSlug,
+  isAccidentalHelpBusiness,
+  validateBusinessCreateName,
   analyzeBusinessDoctor,
   readBusinessFolderBindings,
   createCanonicalBusinessWorkspace,

package/commands/codex-goal.js

@@ -99,11 +99,35 @@ function chmodPrivate(filePath) {
   }
 }
 
-function runSqliteJson(dbPath, sql, { readonly = true } = {}) {
+function runSqliteOnce(dbPath, sql, readonly) {
   const sqliteArgs = [];
   if (readonly) sqliteArgs.push('-readonly');
   sqliteArgs.push('-json', dbPath, sql);
-  const result = spawnSync('sqlite3', sqliteArgs, { encoding: 'utf8' });
+  return spawnSync('sqlite3', sqliteArgs, { encoding: 'utf8' });
+}
+
+function runSqliteJson(dbPath, sql, { readonly = true } = {}) {
+  let result = runSqliteOnce(dbPath, sql, readonly);
+  // Codex DBs are WAL-mode. `sqlite3 -readonly` cannot open a WAL db unless a
+  // writer already holds the -shm/-wal sidecars open (error 14 with no Codex
+  // running). Fall back to reading a private snapshot copy of db+wal.
+  const walLocked =
+    readonly &&
+    result.status !== 0 &&
+    /unable to open database file/i.test(String(result.stderr || result.stdout || ''));
+  if (walLocked) {
+    const snapDir = fs.mkdtempSync(path.join(os.tmpdir(), 'atris-codex-goal-'));
+    const snapDb = path.join(snapDir, path.basename(dbPath));
+    try {
+      fs.copyFileSync(dbPath, snapDb);
+      for (const ext of ['-wal', '-shm']) {
+        if (fs.existsSync(dbPath + ext)) fs.copyFileSync(dbPath + ext, snapDb + ext);
+      }
+      result = runSqliteOnce(snapDb, sql, false);
+    } finally {
+      fs.rmSync(snapDir, { recursive: true, force: true });
+    }
+  }
   if (result.error) throw new Error(`sqlite3 failed: ${result.error.message}`);
   if (result.status !== 0) {
     const detail = (result.stderr || result.stdout || '').trim();