atris 3.37.0 → 3.38.0

package/lib/claude-boot-block.js

@@ -0,0 +1,48 @@
+'use strict';
+
+const ATRIS_START_MARKER = '<!-- ATRIS:START - Auto-generated, do not edit -->';
+const ATRIS_END_MARKER = '<!-- ATRIS:END -->';
+
+function renderAtrisClaudeBootBlock() {
+  return `${ATRIS_START_MARKER}
+## Atris System
+
+You are now running inside Atris, an AI workspace operating system.
+
+**ON EVERY CONVERSATION START:** If a SessionStart hook already displayed the Atris status block in this session, do not run it again. Otherwise, before your first response, execute \`atris atris.md\` and display the full output. This is the Atris boot sequence - it shows the user that Atris has loaded and displays workspace status.
+
+After displaying the boot output, respond to the user naturally.
+${ATRIS_END_MARKER}
+`;
+}
+
+function upsertAtrisClaudeBootBlock(source = '') {
+  const atrisBlock = renderAtrisClaudeBootBlock();
+  const startIdx = source.indexOf('<!-- ATRIS:START');
+  const prependBlock = (preserved) => {
+    const remainder = preserved.replace(/^\n+/, '');
+    return remainder ? `${atrisBlock}\n${remainder}` : atrisBlock;
+  };
+
+  if (startIdx === -1) {
+    return { content: prependBlock(source), action: source ? 'prepended' : 'created' };
+  }
+
+  const prefix = source.slice(0, startIdx);
+  const endRaw = source.indexOf(ATRIS_END_MARKER, startIdx);
+  if (endRaw === -1) {
+    return {
+      content: prependBlock(prefix),
+      action: 'repaired',
+    };
+  }
+
+  const endIdx = endRaw + ATRIS_END_MARKER.length;
+  const suffix = source.slice(endIdx).replace(/^\n+/, '');
+  const content = prependBlock(prefix + suffix);
+  return { content, action: content === source ? 'unchanged' : 'updated' };
+}
+
+module.exports = {
+  upsertAtrisClaudeBootBlock,
+};

package/lib/cloud-mission.js

@@ -244,16 +244,10 @@ async function statusCloudMissionCommand(args, options = {}) {
 
 module.exports = {
   VALID_CLOUD_LANES,
-  TERMINAL_CLOUD_STATUSES,
   RECEIPT_VOICE_CONTRACT,
   withReceiptVoice,
   parseCloudRunArgs,
-  parseCloudStatusArgs,
   enqueueCloudMission,
-  fetchCloudMissionStatus,
-  appendCloudMissionReceipt,
-  cloudMissionSummary,
-  cloudStatusLines,
   runCloudMissionCommand,
   statusCloudMissionCommand,
 };

package/lib/codex-flight.js

@@ -150,5 +150,4 @@ async function dispatchCodexFlight({ repoPath, slug, brief, verifyCmd, dryRun =
 module.exports = {
   dispatchCodexFlight,
   buildPrompt,
-  parseTaskId,
 };

package/lib/conductor-artifacts.js

@@ -0,0 +1,25 @@
+'use strict';
+
+// Files the conductor itself writes into an agent worktree before the engine runs.
+// They are harness plumbing, not work product, so no dirty-checkout check may
+// count them as dirt. Both the worktree guard and the sealed-review import read
+// this list; keeping it in one place is what stops an engine from being blocked
+// by its own prompt file.
+const CONDUCTOR_UNTRACKED_PATTERN =
+  /^\.atris\/(?:agent-worktree\.json|fleet-prompt-[^/]+\.md|runtime-tmp(?:\/.*)?|state\/briefs\.jsonl)$/;
+
+function isConductorArtifact(file) {
+  return CONDUCTOR_UNTRACKED_PATTERN.test(String(file || ''));
+}
+
+// Accepts a `git status --porcelain` line ("?? .atris/fleet-prompt-BCK-1.md").
+function isConductorStatusLine(line) {
+  const text = String(line || '');
+  if (!text.startsWith('?? ')) return false;
+  return isConductorArtifact(text.slice(3));
+}
+
+module.exports = {
+  isConductorArtifact,
+  isConductorStatusLine,
+};

package/lib/context-gatherer.js

@@ -173,6 +173,5 @@ module.exports = {
   renderPrompt,
   starterTaskTitle,
   inferDomain,
-  normalizeQuestionText,
   isAtrisMetaQuestion,
 };

package/lib/deck-compose.js

@@ -137,7 +137,6 @@ function composeSpec(text, opts = {}) {
 
 module.exports = {
   parseBlocks,
-  blocksToSections,
   classify,
   toItem,
   splitQuote,

package/lib/deck-history.js

@@ -56,7 +56,6 @@ function historyFor(query, historyPath = DEFAULT_HISTORY_PATH) {
 }
 
 module.exports = {
-  DEFAULT_HISTORY_PATH,
   specHash,
   recordBuild,
   readHistory,

package/lib/deck-layout.js

@@ -159,11 +159,6 @@ function planLayout(sections, opts = {}) {
 }
 
 module.exports = {
-  BOXED,
-  ONCE,
-  BOXED_BUDGET,
-  DOWNGRADE,
   preferredType,
-  mapToSlide,
   planLayout,
 };

package/lib/deck-review.js

@@ -414,18 +414,11 @@ function confirmReview(presentationId, note = 'visual review passed', outRoot =
 
 module.exports = {
   SCHEMA,
-  RECEIPT_SCHEMA,
   DEFAULT_OUT_ROOT,
-  DEFAULT_RECEIPTS_PATH,
-  AGENT_CHECKLIST,
   CLIP_LIMITS,
-  buildReceipt,
   extractPresentationId,
-  summarizeSlide,
   lintSpec,
-  downloadUrl,
   autoReviewSlides,
   reviewDeck,
-  loadReviewManifest,
   confirmReview,
 };

package/lib/deck-schema.js

@@ -143,7 +143,6 @@ function checkSpec(spec, lintSpec) {
 }
 
 module.exports = {
-  KNOWN_THEMES,
   SLIDE_SCHEMA,
   validateSpec,
   sortFindings,

package/lib/default-verifier.js

@@ -62,8 +62,6 @@ function verifierBudgetWarning(command, env = process.env) {
 }
 
 module.exports = {
-  DEFAULT_MISSION_VERIFIER_TIMEOUT_MS,
-  broadSuiteVerifier,
   missionVerifierTimeoutMs,
   resolveDefaultVerifier,
   verifierBudgetWarning,

package/lib/engine-registry.js

@@ -144,7 +144,7 @@ function resolveRegisteredEngine(name, root = process.cwd()) {
   return engine;
 }
 
-function resolveEngineForRole(role, root = process.cwd(), options = {}) {
+function resolveEngineForRoleRanked(role, root = process.cwd(), options = {}) {
   const normalizedRole = String(role || '').trim().toLowerCase();
   if (!ENGINE_ROLES.includes(normalizedRole)) {
     throw new Error(`Unknown role "${role}". Known roles: ${ENGINE_ROLES.join(', ')}`);
@@ -160,11 +160,21 @@ function resolveEngineForRole(role, root = process.cwd(), options = {}) {
     root,
     taskType: options.taskType || options.task_type || normalizedRole,
   });
-  const selected = ranked.candidates[0] || null;
-  if (selected && process.env.ATRIS_ROUTER_EXPLAIN === '1') {
-    console.error(routerPickExplanation(ranked));
+  return {
+    engine: ranked.candidates[0] || null,
+    reason: routerPickExplanation(ranked),
+    ranked: ranked.candidates,
+  };
+}
+
+function resolveEngineForRole(role, root = process.cwd(), options = {}) {
+  const picked = resolveEngineForRoleRanked(role, root, options);
+  // every pick logs one plain sentence saying which engine won and why;
+  // set ATRIS_ROUTER_EXPLAIN=0 to silence it in quiet contexts.
+  if (picked.engine && picked.reason && process.env.ATRIS_ROUTER_EXPLAIN !== '0') {
+    console.error(picked.reason);
   }
-  return selected;
+  return picked.engine;
 }
 
 function resolveEngineForRoleWithPreference(role, root = process.cwd(), preferredEngineId = '', options = {}) {
@@ -215,8 +225,6 @@ function setEngineHealth(name, status, root = process.cwd()) {
 }
 
 module.exports = {
-  ENGINE_REGISTRY_SCHEMA,
-  ENGINE_TIERS,
   ENGINE_ROLES,
   ENGINE_HEALTH_STATUSES,
   engineRegistryFile,
@@ -224,8 +232,8 @@ module.exports = {
   canonicalEngineName,
   readEngineRegistry,
   engineRegistryView,
-  registeredEngineIds,
   resolveRegisteredEngine,
+  resolveEngineForRoleRanked,
   resolveEngineForRole,
   resolveEngineForRoleWithPreference,
   setEngineHealth,

package/lib/experiments/daily.js

@@ -618,21 +618,15 @@ function queueList(root, args = []) {
 
 module.exports = {
   SCORECARD_SCHEMA,
-  BENCH_SCHEMA,
   appendQueueEntry,
-  appendResultsTsv,
   appendScorecardRow,
-  areTargetsClean,
   buildScorecardRow,
   evaluateKeepRule,
-  parseBenchResult,
   parseDailyArgs,
-  parseQueueAddArgs,
   pickQueueEntry,
   queueAdd,
   queueList,
   readDailyState,
-  readQueue,
   runApplyScript,
   runBench,
   runDaily,

package/lib/fleet.js

@@ -30,10 +30,11 @@ const {
   parseOneLapValidatorVerdict,
 } = require('./one-lap-validator');
 const { listWorktrees } = require('../commands/worktree');
+const { isConductorStatusLine } = require('./conductor-artifacts');
 
 // Lanes a fleet may never staff on its own: the human keeps irreversible
 // calls. Mirrors the autoland denied lanes.
-const DENIED_TAGS = ['billing', 'deploy', 'security', 'customer', 'external', 'feedback'];
+const DENIED_TAGS = ['billing', 'money', 'payments', 'deploy', 'security', 'customer', 'external', 'feedback'];
 
 // ---------------------------------------------------------------------------
 // T1 — dispatch primitive
@@ -317,6 +318,20 @@ function dispatchResultExitCode(result) {
   return 0;
 }
 
+// A child killed by a signal comes back either with spawnSync's `signal` field
+// set (plain spawn) or a 128+N exit status (the sealed supervisor re-exits 143
+// on SIGTERM). Either way stdout/report and stderr are empty, so name the
+// signal instead of letting the leg read as a silent no-op (CLI-1190: on
+// WEB-455 2026-07-25 the claude engine exited 143/SIGTERM with an empty report
+// and the restaff receipt looked like nothing had happened).
+const SIGNAL_EXIT_NAMES = Object.freeze({ 129: 'SIGHUP', 130: 'SIGINT', 137: 'SIGKILL', 143: 'SIGTERM' });
+function dispatchResultSignal(result) {
+  if (!result || typeof result !== 'object') return null;
+  if (result.signal) return String(result.signal);
+  const code = dispatchResultExitCode(result);
+  return SIGNAL_EXIT_NAMES[code] || null;
+}
+
 function dispatchTaskId(task) {
   return task && (task.display_id || task.task_id || task.id) ? String(task.display_id || task.task_id || task.id) : '';
 }
@@ -364,6 +379,8 @@ function detectDeadEngineDispatch(result) {
   const output = dispatchResultOutput(result).toLowerCase();
   const pattern = DEAD_ENGINE_OUTPUT_PATTERNS.find((p) => output.includes(p));
   if (pattern) return { reason: 'usage_limit', pattern };
+  const signal = dispatchResultSignal(result);
+  if (signal) return { reason: 'signalled', signal, exitCode };
   return { reason: 'nonzero_exit', exitCode };
 }
 
@@ -406,12 +423,21 @@ function normalizeDispatchResult(result, engineName) {
 }
 
 function failedDispatchLeg(result, engineName) {
-  return {
+  const report = String(result && result.report || '').slice(-2000);
+  const signal = dispatchResultSignal(result);
+  const leg = {
     engine: String(result && result.engine || engineName || ''),
     exitCode: dispatchResultExitCode(result),
     stderr: String(result && result.stderr || '').slice(-2000),
-    report: String(result && result.report || '').slice(-2000),
+    report,
   };
+  if (signal) {
+    // Record that the predecessor was killed; a signalled leg has no report of
+    // its own, so name the signal in place of the empty string (CLI-1190).
+    leg.signal = signal;
+    if (!report) leg.report = `(no report: killed by ${signal})`;
+  }
+  return leg;
 }
 
 async function dispatchEntryWithRestaff({
@@ -535,6 +561,7 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
     brief_id: capturedBriefId || null,
     command,
     exitCode: result.status,
+    signal: result.signal || null,
     report: String(result.stdout || '').slice(-8000),
     stderr: String(result.stderr || '').slice(-2000),
   };
@@ -617,10 +644,41 @@ function assignEngines(staffed, engines) {
 // Land one arrival: rebase onto latest base first; a conflict pauses the
 // landing (never auto-resolve) and reports which files collided so the
 // conductor or a human can take it. `git` is injectable for tests.
+// Ship failures print the cause first (MODULE_NOT_FOUND, command name) and a
+// long node stack after. Tail-only clips hide the cause; keep a head+tail.
+function clipHeadTail(text, { head = 400, tail = 300 } = {}) {
+  const s = String(text || '');
+  if (s.length <= head + tail) return s;
+  return `${s.slice(0, head)}\n...\n${s.slice(-tail)}`;
+}
+
 // Fleet landings always target master. Without the explicit --target, ship
 // falls back to the launcher branch's atris-base — a flight launched from a
 // feature-branch checkout would merge PRs into that branch while the receipt
 // and land board define "landed" as in-master (PRs #207/#208, 2026-07-04).
+// A ship failure must name its real cause. MODULE_NOT_FOUND from the spawned
+// CLI is usually transient: the fleet ships by spawning node against this
+// live checkout, and a concurrent rebase/pull can make a require vanish for a
+// moment. So the ship retries once on that signature, and the failure detail
+// always surfaces the missing-module line from either stream instead of
+// letting head/tail clipping truncate it away (cost measured live: CLI-1185
+// receipts kept only a loader stack tail and the module name was lost).
+function shipWithRetry(cli, args, cwd) {
+  let shipped = cli(args, cwd);
+  if (shipped.status !== 0 && /MODULE_NOT_FOUND|Cannot find module/.test(`${shipped.stderr}${shipped.stdout}`)) {
+    shipped = cli(args, cwd);
+    shipped.retried_module_not_found = true;
+  }
+  return shipped;
+}
+
+function shipFailureDetail(shipped, { head = 400, tail = 300 } = {}) {
+  const combined = `${shipped.stderr || ''}\n${shipped.stdout || ''}`;
+  const moduleLine = combined.match(/Cannot find module '[^']+'[^\n]*/);
+  const cause = moduleLine ? `${moduleLine[0]}${shipped.retried_module_not_found ? ' (persisted after one retry)' : ''}\n` : '';
+  return `${cause}${clipHeadTail(combined.trim(), { head, tail })}`;
+}
+
 function fleetShipArgs(entry, check) {
   return [
     'worktree', 'ship',
@@ -631,19 +689,113 @@ function fleetShipArgs(entry, check) {
   ];
 }
 
+// A fleet build worktree is ephemeral. If any process inside one runs
+// `npm link` (which repoints the global `atris` package symlink at that
+// worktree), then removing the worktree at teardown leaves the global `atris`
+// binary a dangling symlink, and everything resolving `atris` through PATH —
+// interactive shells, any tooling that shells out to the bare command — dies
+// with 'command not found'. Measured scope, not assumed: crons that invoke
+// `node <checkout>/bin/atris.js` by absolute path are UNAFFECTED; an autoland
+// tick ran fine four minutes before the repair. The failure is silent and
+// reads like a shell/PATH problem, not a worktree-cleanup one (found live
+// 2026-07-26, CLI-1193; same shape as the cron PATH wedge that cost 20 days
+// of autoland).
+// Recovery was one line: repoint the global link at the real checkout. So
+// teardown does exactly that on its own: if the global `atris` link points
+// into one of this flight's worktrees, repoint it at the primary checkout and
+// verify the CLI still runs before the flight reports success.
+function defaultReadGlobalCliLink() {
+  const rootResult = spawnSync('npm', ['root', '-g'], { encoding: 'utf8' });
+  if (rootResult.status !== 0) return null;
+  const globalRoot = String(rootResult.stdout || '').trim();
+  if (!globalRoot) return null;
+  const pkgPath = path.join(globalRoot, 'atris');
+  let stat;
+  try {
+    stat = fs.lstatSync(pkgPath);
+  } catch {
+    return null; // atris is not installed globally at all
+  }
+  if (!stat.isSymbolicLink()) return { path: pkgPath, target: null }; // real install, not a link
+  return { path: pkgPath, target: path.resolve(path.dirname(pkgPath), fs.readlinkSync(pkgPath)) };
+}
+
+function defaultRepointGlobalCliLink(primaryCheckout) {
+  // `npm link` from the real checkout re-creates the global symlink pointing at it.
+  return spawnSync('npm', ['link'], { cwd: primaryCheckout, encoding: 'utf8' });
+}
+
+function defaultVerifyCliRuns() {
+  const result = spawnSync('atris', ['--version'], { encoding: 'utf8' });
+  return { ok: result.status === 0, status: result.status, stdout: String(result.stdout || '').trim() };
+}
+
+function guardGlobalCliLink({
+  root = process.cwd(),
+  worktreePaths = [],
+  readGlobalLink = defaultReadGlobalCliLink,
+  repointLink = defaultRepointGlobalCliLink,
+  verifyCli = defaultVerifyCliRuns,
+} = {}) {
+  const link = readGlobalLink();
+  if (!link || !link.target) return { ok: true, changed: false, reason: 'not_linked' };
+  const resolvedTarget = realpathOrResolve(link.target);
+  const worktrees = worktreePaths.filter(Boolean).map((wt) => realpathOrResolve(wt));
+  // Match the raw string so a worktree already removed by ship still matches
+  // (its path is gone from disk but the dangling link still names it).
+  const insideWorktree = worktrees.some((wt) => resolvedTarget === wt || resolvedTarget.startsWith(`${wt}${path.sep}`));
+  if (!insideWorktree) return { ok: true, changed: false, reason: 'healthy', target: link.target };
+  let primaryPath = root;
+  try {
+    primaryPath = listWorktrees(root)[0]?.path || root;
+  } catch {
+    primaryPath = root;
+  }
+  const primary = realpathOrResolve(primaryPath);
+  const repoint = repointLink(primary);
+  const verify = verifyCli();
+  return {
+    ok: Boolean(verify && verify.ok),
+    changed: true,
+    reason: 'linked_into_worktree',
+    was: link.target,
+    restoredTo: primary,
+    repoint: { status: repoint ? repoint.status : null },
+    verify,
+  };
+}
+
+// One-line " (path, path)" suffix naming the files behind a paused landing —
+// unmerged files for a rebase_conflict, uncommitted paths for a dirty_worktree.
+function pausedPathsSuffix(landed) {
+  const paths = (landed && landed.conflicts) || (landed && landed.dirty) || [];
+  return paths.length ? ` (${paths.join(', ')})` : '';
+}
+
 function landArrival({ worktreePath, git = null }) {
   const run = git || ((args) => spawnSync('git', args, { cwd: worktreePath, encoding: 'utf8' }));
   const fetch = run(['fetch', 'origin']);
   if (fetch.status !== 0) return { ok: false, stage: 'fetch', detail: String(fetch.stderr || '').trim() };
   const rebase = run(['rebase', 'origin/master']);
   if (rebase.status !== 0) {
-    const conflicted = run(['diff', '--name-only', '--diff-filter=U']);
+    const conflicts = String(run(['diff', '--name-only', '--diff-filter=U']).stdout || '')
+      .trim().split('\n').filter(Boolean);
     run(['rebase', '--abort']);
-    return {
-      ok: false,
-      stage: 'rebase_conflict',
-      conflicts: String(conflicted.stdout || '').trim().split('\n').filter(Boolean),
-    };
+    // git rebase refuses outright when the worktree has uncommitted changes:
+    // it stops before a single conflict can occur, so the unmerged-file list is
+    // empty. Reporting an empty list as rebase_conflict sends the operator
+    // chasing a merge problem that does not exist while intact work sits
+    // uncommitted in the worktree (CLI-1190; hit live on WEB-455 2026-07-25
+    // after a killed engine left modified/untracked files behind). An empty
+    // conflicts list is never a conflict: name the dirty paths instead.
+    if (!conflicts.length) {
+      const dirty = String(run(['status', '--porcelain']).stdout || '')
+        .split('\n')
+        .map((line) => line.slice(3).trim())
+        .filter(Boolean);
+      return { ok: false, stage: 'dirty_worktree', dirty };
+    }
+    return { ok: false, stage: 'rebase_conflict', conflicts };
   }
   return { ok: true, stage: 'rebased' };
 }
@@ -651,11 +803,15 @@ function landArrival({ worktreePath, git = null }) {
 module.exports = {
   DENIED_TAGS,
   DEAD_ENGINE_OUTPUT_PATTERNS,
+  reviewOnlyEngineEnvironment,
+  shipWithRetry,
+  shipFailureDetail,
   get FLEET_CAPABLE() { return FLEET_CAPABLE; },
   get runFleetFlight() { return runFleetFlight; },
   get focusedCheck() { return focusedCheck; },
   get dispatchCheck() { return dispatchCheck; },
   get runDispatchFlight() { return runDispatchFlight; },
+  get prepareReviewSandbox() { return prepareReviewSandbox; },
   YOLO_ENGINE_FLAGS,
   DISPATCH_SELF_LAND_TARGET,
   parseDoneCheck,
@@ -665,19 +821,19 @@ module.exports = {
   buildEngineCommand,
   isSafeLane,
   taskTags,
-  detectDeadEngineDispatch,
-  rankFleetEngines,
   nextInstalledFleetEngine,
   dispatchToEngine,
   taskTags,
   isHumanHoldTag,
   isSafeLane,
-  fileSurface,
-  surfacesOverlap,
   staffFlight,
   assignEngines,
   landArrival,
+  detectDeadEngineDispatch,
+  failedDispatchLeg,
   fleetShipArgs,
+  clipHeadTail,
+  guardGlobalCliLink,
   defaultSelfLandCheck,
 };
 
@@ -913,7 +1069,9 @@ function reviewOnlyEngineEnvironment(worktreePath, options = {}) {
     STRIPE_SECRET_KEY: '',
     OPENAI_API_KEY: selectedSecret(['codex'], 'OPENAI_API_KEY'),
     CODEX_API_KEY: selectedSecret(['codex'], 'CODEX_API_KEY'),
-    ANTHROPIC_API_KEY: selectedSecret(['claude'], 'ANTHROPIC_API_KEY'),
+    // owner policy: claude work runs on the subscription login, never API
+    // billing, so the api key is stripped even when the parent env has one.
+    ANTHROPIC_API_KEY: '',
     CLAUDE_CODE_OAUTH_TOKEN: selectedSecret(['claude'], 'CLAUDE_CODE_OAUTH_TOKEN'),
     CURSOR_API_KEY: selectedSecret(['cursor'], 'CURSOR_API_KEY'),
     DEVIN_API_KEY: selectedSecret(['devin'], 'DEVIN_API_KEY'),
@@ -1042,6 +1200,15 @@ function prepareReviewSandbox({ root, taskId, engine }) {
     env: conductorGitEnvironment(),
     timeout: 30000,
   });
+  // `git` walks up to the nearest enclosing repository when `root` is not itself
+  // a git checkout. Without this guard, review-only dispatch would fetch and
+  // trust the origin/master of whatever repo happens to sit above `root`, and
+  // build against it. Refuse unless `root` is its own git top level.
+  const toplevel = runConductorGit(['rev-parse', '--show-toplevel']);
+  if (toplevel.status !== 0
+    || realpathOrResolve(String(toplevel.stdout || '').trim()) !== realpathOrResolve(root)) {
+    return { ok: false, detail: 'review-only dispatch requires the workspace to be its own git repository' };
+  }
   const fetched = runConductorGit(['fetch', 'origin', 'master']);
   const original = runConductorGit(['remote', 'get-url', 'origin']);
   const base = run(['rev-parse', '--verify', 'origin/master^{commit}']);
@@ -1213,9 +1380,8 @@ function reviewCandidateSnapshot(boundary, expected = null) {
   const repeatedCommit = String(secondHead.stdout || '').trim();
   const treeOid = String(tree.stdout || '').trim();
   if (commit !== repeatedCommit) return fail('the executor changed HEAD while its candidate was being frozen');
-  const conductorEntry = /^\?\? \.atris\/(?:agent-worktree\.json|state\/briefs\.jsonl)$/;
   const dirty = String(status.stdout || '').trim().split(/\r?\n/).filter(Boolean)
-    .filter((line) => !conductorEntry.test(line));
+    .filter((line) => !isConductorStatusLine(line));
   if (dirty.length) return fail(`the executor left uncommitted changes: ${dirty.slice(0, 10).join(', ')}`);
   if (expected && (commit !== expected.commit || treeOid !== expected.tree)) {
     return fail('the sealed candidate changed after the executor exited', { commit, tree: treeOid });
@@ -1415,8 +1581,7 @@ function importReviewCommit(boundary, { cli, taskId, engine, expectedCommit = ''
   const status = runSandbox(['status', '--porcelain=v1', '--untracked-files=all']);
   if (status.status !== 0) return fail('review_import', status.stderr || 'could not inspect the sealed sandbox');
   const dirtyEntries = String(status.stdout || '').trim().split(/\r?\n/).filter(Boolean);
-  const conductorEntries = /^\?\? \.atris\/(?:agent-worktree\.json|fleet-prompt-[^/]+\.md|runtime-tmp(?:\/.*)?|state\/briefs\.jsonl)$/;
-  const uncommitted = dirtyEntries.filter((line) => !conductorEntries.test(line));
+  const uncommitted = dirtyEntries.filter((line) => !isConductorStatusLine(line));
   if (uncommitted.length) return fail('uncommitted_change', `the sealed executor must commit every requested change before Review: ${uncommitted.join(', ')}`);
   const headOid = expectedCommit;
   if (headOid === boundary.baseOid) return fail('no_change', 'the executor produced no committed change');
@@ -1543,9 +1708,12 @@ function inspectReviewChange(worktreePath, baseRef = 'origin/master') {
       detail: String(status.stderr || 'could not inspect worktree changes').trim(),
     };
   }
-  const conductorEntry = /^\?\? \.atris\/(?:agent-worktree\.json|state\/briefs\.jsonl)$/;
+  // Conductor plumbing is not engine output. Counting it as a change is what let a
+  // flight report "landed" for an engine that said "nothing to commit": the fleet's
+  // own prompt file registered as dirt, has_change went true, and the no_change
+  // pause never fired.
   const dirty = String(status.stdout || '').trim().split('\n').filter(Boolean)
-    .filter((line) => !conductorEntry.test(line));
+    .filter((line) => !isConductorStatusLine(line));
   const hasCommittedDiff = committed.status === 1;
   return {
     has_change: hasCommittedDiff || dirty.length > 0,
@@ -1932,7 +2100,9 @@ async function runFleetFlight({
   ownCli = null,
   dispatcher = null,
   lander = null,
+  rebase = null,
   checkoutBase = 'origin/master',
+  guardCliLink = guardGlobalCliLink,
 } = {}) {
   const cli = ownCli || defaultOwnCli(root);
   const roster = engines || (() => {
@@ -2021,13 +2191,14 @@ async function runFleetFlight({
   });
 
   // Land serially: rebase-before-ship, conflict pauses (never auto-resolve).
+  const rebaseArrival = rebase || landArrival;
   const land = lander || (({ entry }) => {
-    const rebased = landArrival({ worktreePath: entry.worktreePath });
+    const rebased = rebaseArrival({ worktreePath: entry.worktreePath });
     if (!rebased.ok) return rebased;
     const check = focusedCheck(entry.task) || 'git log -1 --oneline';
-    const shipped = cli(fleetShipArgs(entry, check), entry.worktreePath);
+    const shipped = shipWithRetry(cli, fleetShipArgs(entry, check), entry.worktreePath);
     if (shipped.status !== 0 || !/done: worktree shipped/.test(shipped.stdout)) {
-      return { ok: false, stage: 'ship', detail: (shipped.stderr || shipped.stdout).slice(-300) };
+      return { ok: false, stage: 'ship', detail: shipFailureDetail(shipped, { head: 400, tail: 300 }) };
     }
     return { ok: true, stage: 'shipped' };
   });
@@ -2064,10 +2235,22 @@ async function runFleetFlight({
     } else {
       flight.paused.push({ task: entry.task.display_id, engine: activeEngine, ...(result.restaffed ? { restaffed: result.restaffed } : {}), ...landed });
       stampDispatchBrief(root, result.brief_id, 'partial', `paused ${entry.task.display_id} at ${landed.stage || 'landing'}`);
-      log(`    ${activeEngine.padEnd(8)} ⏸ paused ${entry.task.display_id} at ${landed.stage}${landed.conflicts ? ` (${landed.conflicts.join(', ')})` : ''} — worktree kept`);
+      log(`    ${activeEngine.padEnd(8)} ⏸ paused ${entry.task.display_id} at ${landed.stage}${pausedPathsSuffix(landed)} — worktree kept`);
     }
   }
 
+  // Teardown guard: a build worktree may have run `npm link` and hijacked the
+  // global `atris`. Before reporting success, make sure this flight did not
+  // leave the global CLI pointed into one of its own worktrees.
+  const flightWorktrees = prepared.map((entry) => entry.worktreePath).filter(Boolean);
+  const cliLink = guardCliLink({ root, worktreePaths: flightWorktrees });
+  flight.cli_link = cliLink;
+  if (cliLink.changed) {
+    log(cliLink.ok
+      ? `  restored global atris link (was ${cliLink.reason}); repointed at ${path.relative(root, cliLink.restoredTo) || cliLink.restoredTo} and the cli runs`
+      : `  alert: global atris link was ${cliLink.reason}; repoint attempted at ${cliLink.restoredTo} but the cli still fails, so every cron/loop/mission is down`);
+  }
+
   fs.mkdirSync(path.dirname(receiptPath), { recursive: true });
   flight.receipt = receiptPath;
   fs.writeFileSync(flight.receipt, `${JSON.stringify(flight, null, 2)}\n`);
@@ -2351,9 +2534,9 @@ async function runDispatchFlight({
         change,
       };
     }
-    const shipped = cli(fleetShipArgs({ task: entry.task, engine: entry.engine || engine }, check), entry.worktreePath);
+    const shipped = shipWithRetry(cli, fleetShipArgs({ task: entry.task, engine: entry.engine || engine }, check), entry.worktreePath);
     if (shipped.status !== 0 || !/done: worktree shipped/.test(shipped.stdout)) {
-      return { ok: false, stage: 'ship', detail: (shipped.stderr || shipped.stdout).slice(-500) };
+      return { ok: false, stage: 'ship', detail: shipFailureDetail(shipped, { head: 400, tail: 500 }) };
     }
     return {
       ok: true,
@@ -2736,7 +2919,7 @@ async function runDispatchFlight({
         ...landed,
       });
       stampDispatchBrief(root, result.brief_id, 'partial', `paused ${entry.taskId} at ${landed.stage || 'landing'}`);
-      log(`    ⏸ paused ${entry.taskId} at ${landed.stage}${landed.conflicts ? ` (${landed.conflicts.join(', ')})` : ''} — worktree kept`);
+      log(`    ⏸ paused ${entry.taskId} at ${landed.stage}${pausedPathsSuffix(landed)} — worktree kept`);
     }
   }