atris 3.37.1 → 3.40.0

package/commands/task.js

@@ -5,8 +5,10 @@
 
 const fs = require('fs');
 const http = require('http');
+const { execSync } = require('node:child_process');
 const path = require('path');
 const os = require('os');
+const { hasFlag } = require('../lib/arg-parser');
 const { taskProofState } = require('../lib/task-proof');
 const {
   evaluateAutoAccept,
@@ -17,10 +19,11 @@ const {
   runVerifyCommandCached,
   DENIED_TAGS,
 } = require('../lib/auto-accept-certified');
+const { evaluateAcceptVerify } = require('../lib/accept-verify-gate');
 const { extractReceiptEvidence, RECEIPT_PATH_PATTERN } = require('../lib/receipt-evidence');
 const escapeRegExp = require('../lib/escape-regexp');
 const reviewIntegrity = require('../lib/review-integrity');
-const { gateForHuman, isRetiredFillerReason, landingWhyClause, numberWord } = require('../lib/voice-gate');
+const { gateForHuman, isRetiredFillerReason, landingWhyClause, numberWord, plainLandingReason } = require('../lib/voice-gate');
 const {
   normalizeOwnerSlug,
   resolveFunctionalOwner: resolveFunctionalTaskOwner,
@@ -34,6 +37,11 @@ const {
   inspectTextLines,
   buildInspectPayload,
 } = require('../lib/inspect-fields');
+const {
+  isDecisionTask,
+  decisionMarkerFor,
+  DECISION_REFUSE_REASON,
+} = require('../lib/task-decision');
 
 const DEFAULT_OWNER = process.env.ATRIS_AGENT_ID
   || process.env.USER
@@ -128,7 +136,7 @@ function taskUsageText() {
   return `
 atris task - durable local task state (SQLite, gitignored)
 
-  golden path (zero human turns):
+  golden path (one tick, by cron or by hand):
     atris task delegate "fix the login bug" --to <member>
     atris task claim <id> --as <member>
     ... build ...
@@ -136,7 +144,7 @@ atris task - durable local task state (SQLite, gitignored)
     atris autoland tick   # second check runs, task lands
 
   atris task                              Show the task desk
-  atris task new "<title>"                Create a task
+  atris task new "<title>" [--verify <cmd>]  Create a task; weak or missing checks are marked degraded
   atris task next [--tag <tag>] [--create-next]
                                            Claim/show next open task; optionally create the generated Endgame fallback
   atris task continue-work <id>           Create/reuse a certified Review follow-up task
@@ -168,8 +176,8 @@ atris task - durable local task state (SQLite, gitignored)
   atris task audit [--limit <n>] [--revise] re-run stored verifies for newest accepted tasks; report-only unless --revise
   atris task revise <id> --note "..."      Send reviewed work back to Do
 
-  atris task add "<title>" [--tag <tag>] [--goal-id <id>]  Create a task
-  atris task delegate "<title>" [--to <member>] [--executed-by <engine>] [--goal-id <id>] [--tag <tag>]  Create assigned work
+  atris task add "<title>" [--tag <tag>] [--goal-id <id>] [--verify <cmd>]  Create a task
+  atris task delegate "<title>" [--to <member>] [--executed-by <engine>] [--goal-id <id>] [--tag <tag>] [--verify <cmd>]  Create assigned work
   atris task plan <id> --goal "..." --exit "..." --proof-needed "..."
                                            Record a task-owned Plan stage
   atris task do <id> --as <owner> --first-move "..."
@@ -212,6 +220,7 @@ atris task - durable local task state (SQLite, gitignored)
                                            Sweep off-roadmap/duplicate work as archived (not failed);
                                            --from-failed opts in to relabel a fail-closed row (never done)
   atris task clear-done [--before <days>] [--dry-run] [--json]  Archive completed rows, oldest first
+  atris task reap-mission-blockers [--json] Close blocker rows whose missions are complete or stopped
   atris task relabel-archived [--dry-run|--apply]
                                            One-time OBL-1622 migration: relabel June-10 backlog-reset rows failed -> archived
   atris task finish <id> --proof "..."     Legacy alias for done with proof
@@ -269,10 +278,6 @@ function flag(args, name) {
   return args[i + 1] || true;
 }
 
-function hasFlag(args, name) {
-  return args.indexOf(name) !== -1;
-}
-
 function taskScopeEverywhere(args = [], options = {}) {
   if (options.everywhere !== undefined) return Boolean(options.everywhere);
   return hasFlag(args, '--everywhere');
@@ -880,10 +885,15 @@ function certifiedReviewNextAction(nextTaskTitle) {
 function proofBoundaryBlockedEvaluation(task) {
   const missionXpBoundary = missionXpProofBoundaryEvaluation(task);
   if (missionXpBoundary) return missionXpBoundary;
-  // strictVerify stays off here: this is a render-path probe for the boundary
-  // reason only, and the default-true strict mode would spawn the verify
-  // subprocess for every certified row just to draw the desk.
-  const evaluation = evaluateAutoAccept(task, { strictVerify: false, minPasses: 0 });
+  // This is a render-path probe for the boundary reason only. strictVerify
+  // alone is not enough to keep it read-only because probationary actors
+  // still require strict verification. Never execute a stored verifier while
+  // drawing task reviews, status, queues, or projections.
+  const evaluation = evaluateAutoAccept(task, {
+    strictVerify: false,
+    minPasses: 0,
+    executeVerify: false,
+  });
   return evaluation && evaluation.reason === 'proof_unmerged_or_draft_pr_boundary'
     ? evaluation
     : null;
@@ -1583,9 +1593,74 @@ function enrichTaskProjection(projection) {
     },
     streams: buildTaskStreams(enrichedTasks, goalSource.goals),
     tasks: enrichedTasks,
+    missions: projectionMissions(root),
+    wishes: projectionWishes(root),
   };
 }
 
+// The desktop app renders projection.missions but the writer never filled it,
+// so live workers were invisible on every dashboard. Best-effort: a broken
+// mission or wish store must never take the task projection down with it.
+const PROJECTION_MISSION_LIMIT = 50;
+const PROJECTION_WISH_LIMIT = 30;
+const PROJECTION_CLIP = 240;
+
+function clipForProjection(value) {
+  const text = String(value || '');
+  return text.length > PROJECTION_CLIP ? `${text.slice(0, PROJECTION_CLIP - 3)}...` : text;
+}
+
+function projectionMissions(root) {
+  try {
+    const { listMissions } = require('./mission.js');
+    const recentCutoff = Date.now() - 48 * 60 * 60 * 1000;
+    return listMissions(root)
+      .filter(mission => {
+        const status = String(mission.status || '');
+        if (!['complete', 'stopped'].includes(status)) return true;
+        const updated = Date.parse(mission.updated_at || mission.created_at || '') || 0;
+        return updated >= recentCutoff;
+      })
+      .slice(0, PROJECTION_MISSION_LIMIT)
+      .map(mission => ({
+        id: mission.id,
+        objective: clipForProjection(String(mission.objective || '')),
+        status: mission.status || null,
+        owner: mission.owner || null,
+        runner: mission.runner || null,
+        cadence: mission.cadence || null,
+        lane: mission.lane || null,
+        next_action: clipForProjection(String(mission.next_action || '')),
+        last_tick_at: mission.last_tick_at || null,
+        last_tick_status: mission.last_tick_status || null,
+        receipt_path: mission.receipt_path || null,
+        wish_id: mission.wish_id || null,
+        created_at: mission.created_at || null,
+        updated_at: mission.updated_at || null,
+      }));
+  } catch {
+    return [];
+  }
+}
+
+function projectionWishes(root) {
+  try {
+    const { readWishes } = require('../lib/wish-store');
+    return readWishes(root)
+      .filter(wish => String(wish.status || '') !== 'closed')
+      .slice(-PROJECTION_WISH_LIMIT)
+      .map(wish => ({
+        id: wish.id,
+        n: wish.n ?? null,
+        text: clipForProjection(String(wish.text || '')),
+        status: wish.status || null,
+        created_at: wish.first_ts || wish.ts || null,
+      }));
+  } catch {
+    return [];
+  }
+}
+
 function taskTypeForCloud(task) {
   const tag = String(task.tag || '').toLowerCase();
   if (['inbound', 'outbound', 'creative', 'improvement'].includes(tag)) return tag;
@@ -5105,13 +5180,49 @@ function evaluateReviewAutoAccept(task, root) {
   if (!protectedGate.ok) return { eligible: false, ref, reason: protectedGate.reason };
   const sizeGate = reviewAutoAcceptSizeGate(task, root);
   if (!sizeGate.ok) return { eligible: false, ref, reason: sizeGate.reason, size: sizeGate.stats };
-  const evaluation = evaluateAutoAccept(task, { strictVerify: true });
+  // executeVerify: false — this is a READ path. The verdict comes from
+  // metadata.verify_cache, stamped by the two lanes allowed to spawn
+  // checks (certify-verified, autoland landing re-check). Spawning here is
+  // what turned `atris task reviews` into a fork-bomb multiplier.
+  const evaluation = evaluateAutoAccept(task, { strictVerify: true, executeVerify: false });
   if (!evaluation.eligible) {
     return {
       ...evaluation,
       size: sizeGate.stats,
     };
   }
+  if (evaluation.verification_pending) {
+    const verdict = cachedVerifyVerdict(task, root);
+    if (!verdict.fresh) {
+      return {
+        eligible: false,
+        ref,
+        reason: 'verification_pending',
+        verify: verdict.command || null,
+        next_action: 'no fresh executed verify on record; `atris task certify-verified` or the autoland tick runs the stored check and stamps metadata.verify_cache',
+        size: sizeGate.stats,
+      };
+    }
+    if (!verdict.ok) {
+      return {
+        eligible: false,
+        ref,
+        reason: verdict.reason || 'verify_failed',
+        verify: verdict.command,
+        verify_cache: verdict,
+        size: sizeGate.stats,
+      };
+    }
+    return {
+      ...evaluation,
+      verification_pending: false,
+      verify_cache: verdict,
+      eligible: true,
+      reason: 'certified_small',
+      policy: REVIEW_AUTO_ACCEPT_POLICY,
+      size: sizeGate.stats,
+    };
+  }
   return {
     ...evaluation,
     eligible: true,
@@ -5442,19 +5553,17 @@ function taskReviewLandingLines(item) {
 function cmdReviews(args) {
   const taskDb = getTaskDb();
   const db = taskDb.open();
-  let { projection, outPath } = writeDefaultProjection(taskDb, db);
-  const workspaceRoot = projection.workspace_root || process.cwd();
-  const previousAutoAcceptState = readReviewAutoAcceptState(workspaceRoot);
-  const autoAcceptRun = autoAcceptCertifiedSmallReviews(taskDb, db, projection);
-  if (autoAcceptRun.changed) {
-    ({ projection, outPath } = writeDefaultProjection(taskDb, db));
-  }
-  const autoAcceptRollup = reviewAutoAcceptRollup(taskDb, db, workspaceRoot, previousAutoAcceptState, autoAcceptRun);
-  writeReviewAutoAcceptState(workspaceRoot, {
-    ...previousAutoAcceptState,
-    last_look_at: new Date().toISOString(),
-    last_count: autoAcceptRollup.count,
-  });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  // Reviews is a view, not an execution lane. Certification and landing are
+  // persisted by certify-verified, explicit receipt/ready commands, sweep,
+  // and autoland; this command only reports that stored state.
+  const autoAcceptView = {
+    enabled: false,
+    read_only: true,
+    accepted_now: 0,
+    accepted_since_last_look: 0,
+    results: [],
+  };
   const groupByRaw = flag(args, '--group-by');
   if (groupByRaw) {
     const key = reviewGroupKey(groupByRaw);
@@ -5464,20 +5573,12 @@ function cmdReviews(args) {
         ok: true,
         action: 'review_groups',
         projection_path: outPath,
-        autoaccept: {
-          enabled: autoAcceptRun.enabled,
-          accepted_now: autoAcceptRun.accepted,
-          accepted_since_last_look: autoAcceptRollup.count,
-          results: autoAcceptRun.results,
-        },
+        autoaccept: autoAcceptView,
         groups,
       });
       return;
     }
     console.log(gateForHuman(`${numberWord(groups.total_certified)} finished things are waiting, grouped by ${key}.`).text);
-    if (autoAcceptRollup.count > 0) {
-      console.log(gateForHuman(`${numberWord(autoAcceptRollup.count)} landed on their own since you last looked.`).text);
-    }
     const visibleGroups = groups.groups.slice(0, reviewGroupTextLimit(args, groups.groups.length));
     visibleGroups.forEach((g, index) => {
       console.log('');
@@ -5498,12 +5599,7 @@ function cmdReviews(args) {
       ok: true,
       action: 'review_queue',
       projection_path: outPath,
-      autoaccept: {
-        enabled: autoAcceptRun.enabled,
-        accepted_now: autoAcceptRun.accepted,
-        accepted_since_last_look: autoAcceptRollup.count,
-        results: autoAcceptRun.results,
-      },
+      autoaccept: autoAcceptView,
       queue,
     });
     return;
@@ -5512,9 +5608,6 @@ function cmdReviews(args) {
   const blockedItems = queue.items.filter(item => item.queue_role === 'blocked');
   if (!approvalItems.length && !blockedItems.length) {
     console.log('nothing is waiting on you. everything that finished has already landed.');
-    if (autoAcceptRollup.count > 0) {
-      console.log(gateForHuman(`${numberWord(autoAcceptRollup.count)} landed on their own since you last looked.`).text);
-    }
     return;
   }
   if (queue.counts.certified > 0) {
@@ -5528,9 +5621,6 @@ function cmdReviews(args) {
       ? 'one more is almost ready; a second check is still running.'
       : `${numberWord(queue.counts.blocking)} more are almost ready; second checks are still running.`).text);
   }
-  if (autoAcceptRollup.count > 0) {
-    console.log(gateForHuman(`${numberWord(autoAcceptRollup.count)} landed on their own since you last looked.`).text);
-  }
   approvalItems.forEach((item, index) => {
     if (index > 0) console.log('');
     const ref = item.display_id || taskRef(item.id);
@@ -5555,7 +5645,7 @@ function cmdReviews(args) {
     if (item.accept_command) {
       console.log(`   say yes: atris task accept ${item.display_id || taskRef(item.id)}`);
     } else if (item.blocked_accept_reason) {
-      console.log(`   approve: blocked (${item.blocked_accept_reason})`);
+      console.log(`   approve: blocked; ${plainLandingReason(item.blocked_accept_reason)}`);
       console.log(`   rework: ${item.revise_command}`);
     }
   });
@@ -5764,7 +5854,8 @@ function formatTaskLine(task) {
   const owner = task.claimed_by ? ` @${task.claimed_by}` : '';
   const assigned = !task.claimed_by && taskAssignee(task) ? ` -> ${taskAssignee(task)}` : '';
   const tag = task.tag ? ` #${task.tag}` : '';
-  return `${taskRef(task)}${owner}${assigned}${tag} ${task.title}`;
+  const decision = decisionMarkerFor(task) ? ` ${decisionMarkerFor(task)}` : '';
+  return `${taskRef(task)}${owner}${assigned}${tag}${decision} ${task.title}`;
 }
 
 function cmdStatus(args) {
@@ -5859,7 +5950,8 @@ function renderTaskDesk(rows, refRows = rows) {
     const owner = r.claimed_by ? ` @${r.claimed_by}` : '';
     const assigned = !r.claimed_by && taskAssignee(r) ? ` -> ${taskAssignee(r)}` : '';
     const tag = r.tag ? ` #${r.tag}` : '';
-    console.log(`${r.status.padEnd(7)} ${taskRef(r)}${owner}${assigned}${tag}`);
+    const decision = decisionMarkerFor(r) ? ` ${decisionMarkerFor(r)}` : '';
+    console.log(`${r.status.padEnd(7)} ${taskRef(r)}${owner}${assigned}${tag}${decision}`);
     console.log(`        ${r.title}`);
   }
   if (active.length === 0) console.log('clear   no active tasks');
@@ -5877,12 +5969,14 @@ function cmdAdd(args) {
   const tag = flag(args, '--tag');
   const goalId = flag(args, '--goal-id');
   const goalObjective = flag(args, '--goal-objective') || flag(args, '--goal');
+  const verify = flag(args, '--verify');
   const metadata = {};
   if (goalId && goalId !== true) metadata.goal_id = String(goalId);
   if (goalObjective && goalObjective !== true) {
     metadata.task_goal = String(goalObjective);
     metadata.goal_objective = String(goalObjective);
   }
+  if (typeof verify === 'string' && verify.trim()) metadata.verify = verify.trim();
   const taskDb = getTaskDb();
   const db = taskDb.open();
   const ws = taskDb.workspaceRoot();
@@ -5949,6 +6043,7 @@ function delegateTask(args, options = {}) {
   const note = flag(args, '--note');
   const goalId = flag(args, '--goal-id');
   const goalObjective = flag(args, '--goal-objective') || flag(args, '--goal');
+  const verify = flag(args, '--verify');
   const claimNow = hasFlag(args, '--claim');
   const requestedOwner = flag(args, '--to') || flag(args, '--as');
   const explicitExecutedBy = flag(args, '--executed-by');
@@ -5986,6 +6081,7 @@ function delegateTask(args, options = {}) {
     metadata.task_goal = String(goalObjective);
     metadata.goal_objective = String(goalObjective);
   }
+  if (typeof verify === 'string' && verify.trim()) metadata.verify = verify.trim();
   const result = taskDb.addTask(db, {
     title,
     tag: typeof tag === 'string' ? tag : null,
@@ -6141,7 +6237,8 @@ function cmdDay(args) {
     for (const task of group.tasks) {
       const tag = task.tag ? ` #${task.tag}` : '';
       const claim = task.claimed_by ? ` @${task.claimed_by}` : '';
-      console.log(`  ${task.status.padEnd(7)} ${taskRef(task)}${claim}${tag} ${taskDayTitle(task.title)}`);
+      const decision = decisionMarkerFor(task) ? ` ${decisionMarkerFor(task)}` : '';
+      console.log(`  ${task.status.padEnd(7)} ${taskRef(task)}${claim}${tag}${decision} ${taskDayTitle(task.title)}`);
     }
   }
   if (textView.hiddenTasks > 0) {
@@ -6210,7 +6307,8 @@ function cmdList(args) {
   for (const r of displayRows) {
     const claim = r.claimed_by ? ` [${r.claimed_by}]` : '';
     const tag = r.tag ? ` #${r.tag}` : '';
-    console.log(`${r.status.padEnd(8)} ${taskRef(r)}${claim}${tag}\t${r.title}`);
+    const decision = decisionMarkerFor(r) ? ` ${decisionMarkerFor(r)}` : '';
+    console.log(`${r.status.padEnd(8)} ${taskRef(r)}${claim}${tag}${decision}\t${r.title}`);
   }
 }
 
@@ -6240,7 +6338,11 @@ function guardExplicitActor(command, value) {
 // instead of just reporting the failure, straight from the live projection
 // (never the rendered file), preferring the same tag when one is open.
 function suggestNextClaimableTask(projection, { excludeId = null, tag = '' } = {}) {
-  const open = (projection && projection.tasks || []).filter((t) => t && t.status === 'open' && t.id !== excludeId);
+  // Decision rows (needs-human / decision) belong to a human. Autonomous
+  // recovery after already_done must not hand an agent a judgment call.
+  const open = (projection && projection.tasks || []).filter((t) => (
+    t && t.status === 'open' && t.id !== excludeId && !isDecisionTask(t)
+  ));
   if (!open.length) return null;
   const normalizedTag = String(tag || '').trim().toLowerCase();
   if (normalizedTag) {
@@ -6490,13 +6592,31 @@ function cmdNext(args) {
   const reviewTasks = filterTasksByScope(reviewProjection.projection.tasks || [], scope)
     .map(compactTaskForStatus)
     .filter(task => task && task.review && task.review.handoff);
-  const open = filterTasksByScope(taskDb.listTasks(db, {
+  const openAll = filterTasksByScope(taskDb.listTasks(db, {
     workspaceRoot: taskDb.workspaceRoot(),
     status: 'open',
-    limit: scoped ? null : 1,
+    limit: scoped ? null : 50,
   }), scope);
+  const open = openAll.filter((task) => !isDecisionTask(task));
+  const skippedDecisions = openAll.length - open.length;
   if (!open.length) {
     const { projection, outPath } = reviewProjection;
+    if (skippedDecisions > 0 && !reviewTasks.length) {
+      if (wantsJson(args)) {
+        printJson({
+          ok: false,
+          action: 'refused',
+          reason: DECISION_REFUSE_REASON,
+          skipped_decision_count: skippedDecisions,
+          owner: String(owner),
+          scope: normalizeTaskQueueScope(scope),
+          projection_path: outPath,
+        });
+        process.exit(1);
+      }
+      console.error(DECISION_REFUSE_REASON);
+      process.exit(1);
+    }
     const reviewTask = reviewTasks.find(task => task.review.handoff.next_action === 'agent_review_again')
       || reviewTasks.find(task => task.review.handoff.next_action === 'continue_work')
       || reviewTasks.find(task => task.review.handoff.next_action === 'human_accept_waiting');
@@ -7147,6 +7267,12 @@ function cmdShow(args) {
       : task.status.toUpperCase();
   console.log(`${statusLabel} ${taskRef(task)} v${task.current_version}${owner}${tag}`);
   console.log(task.title);
+  if (task.metadata?.verification_status === 'degraded') {
+    const reason = task.metadata.verification_degraded_reason === 'diff_only_verify'
+      ? 'diff-only verify command'
+      : 'missing verify command';
+    console.log(`verification: degraded (${reason})`);
+  }
   if (task.review) {
     console.log('');
     printReviewLanding(task.review);
@@ -9145,6 +9271,36 @@ function cmdClearDone(args) {
   console.log(`cleared ${candidates.length} completed task(s).`);
 }
 
+function cmdReapMissionBlockers(args) {
+  const taskDb = getTaskDb();
+  const db = taskDb.open();
+  const workspaceRoot = taskDb.workspaceRoot();
+  const actor = String(flag(args, '--as') || DEFAULT_OWNER);
+  const missions = require('./mission').listMissions(workspaceRoot);
+  const result = taskDb.reapMissionBlockerTasks(db, { workspaceRoot, missions, actor });
+  const { outPath } = writeDefaultProjection(taskDb, db);
+  const taskById = new Map(taskDb.withTaskDisplayRefs(taskDb.listTasks(db, { workspaceRoot, limit: null }))
+    .map(task => [task.id, task]));
+  const closed = result.closed.map(row => ({
+    ...row,
+    task_ref: taskRef(taskById.get(row.task_id)),
+  }));
+  if (wantsJson(args)) {
+    printJson({
+      ok: true,
+      action: 'reaped_mission_blockers',
+      closed_count: closed.length,
+      closed,
+      projection_path: outPath,
+    });
+    return;
+  }
+  console.log(`closed ${closed.length} mission blocker task(s).`);
+  for (const row of closed) {
+    console.log(`closed ${row.task_ref} because its mission is ${row.mission_status}.`);
+  }
+}
+
 // One-time migration for OBL-1622: the 2026-06-10 "first-principles backlog
 // reset" archived ~125 certified, proof-backed tasks by writing status
 // 'failed' (no distinct archived status existed yet). This relabels exactly
@@ -9231,6 +9387,20 @@ function cmdReady(args) {
       if (receipt.receiptPath) console.error(`receipt: ${receipt.receiptPath}`);
       process.exit(1);
     }
+    // Exit 0 says the check passed. It does not say the check could have
+    // failed. Run it again with none of the work present: a check anchored to
+    // this codebase fails there, and one that passes anywhere passes there too.
+    if (!hasFlag(args, '--no-falsify-check')) {
+      const { probeVerifierCanFail } = require('../lib/falsifier-probe');
+      const probe = probeVerifierCanFail({ command: verifyFlag });
+      if (probe.probed && probe.canFail === false) {
+        console.error(`atris task ready: this check cannot fail — ${probe.reason}`);
+        console.error(`  command: ${verifyFlag}`);
+        console.error('  give a check that fails when the work is missing, or pass --no-falsify-check to accept anyway.');
+        process.exit(1);
+      }
+      if (!probe.probed && !wantsJson(args)) console.log(`  ${probe.reason}`);
+    }
     const base = proof.trim();
     proof = `[verified] \`${verifyFlag}\` passed (exit 0)${base ? ` — ${base}` : ''}${receipt.output ? `\n${receipt.output}` : ''}\nReceipt: ${receipt.receiptPath}`;
     if (!wantsJson(args)) console.log(`✓ verified: \`${verifyFlag}\` exited 0 (receipt ${receipt.receiptPath})`);
@@ -9303,7 +9473,10 @@ function cmdReady(args) {
     nextTask: nextTaskInput.nextTask,
   });
   const reviewChat = taskReviewChatHandoff(verifierTask, { reviewer: 'codex-review' });
-  const autolandOn = require('../lib/autoland').liveAcceptAuthorization(taskDb.workspaceRoot()).ok;
+  const autolandLib = require('../lib/autoland');
+  const workspaceRoot = taskDb.workspaceRoot();
+  const autolandOn = autolandLib.liveAcceptAuthorization(workspaceRoot).ok;
+  const whenLands = autolandLib.whenAutolandLands(workspaceRoot);
   const needsExternalVerifier = Boolean(usedVerify && !verifyAutoCertifyAllowed);
   const handoff = {
     native_goal_status: agentCertified ? 'agent_certified' : 'needs_second_agent_review',
@@ -9311,10 +9484,10 @@ function cmdReady(args) {
     next_action: agentCertified ? certifiedReviewNextAction(nextTaskInput.nextTask) : 'agent_review_again',
     rule: autolandOn
       ? (agentCertified
-        ? 'double-check complete; autoland will accept this on the next tick.'
+        ? `double-check complete; autoland will accept this ${whenLands}.`
         : needsExternalVerifier
         ? 'proof is ready; this verifier needs a second agent review because autoland cannot rerun it.'
-        : 'proof is ready; autoland runs the second check and lands it on the next tick.')
+        : `proof is ready; autoland runs the second check and lands it ${whenLands}.`)
       : (agentCertified
         ? 'double-check complete; ready to keep moving. XP is awarded only after the human approves the task.'
         : 'proof is ready; one more agent check before human approval. XP waits for the human.'),
@@ -9440,6 +9613,28 @@ async function cmdAccept(args) {
   if (missionXpIssue) {
     failTask('atris task accept', MISSION_XP_END_TO_END_REASON, missionXpIssue);
   }
+  // The proof must be able to fail. Run the stored verify command and refuse the
+  // accept if it does not parse, does not run, or does not pass. Prose describing a
+  // check is not a check.
+  const acceptVerify = evaluateAcceptVerify(beforeTask, taskDb.workspaceRoot());
+  const verifyOverride = hasFlag(args, '--accept-unverified');
+  const overrideReason = String(flag(args, '--reason') || '').trim();
+  if (!acceptVerify.ok && !verifyOverride) {
+    failTask(
+      'atris task accept',
+      acceptVerify.reason,
+      `${acceptVerify.detail}. Stored verify: ${acceptVerify.command || '(none)'}. `
+        + 'Fix the verify command and re-run, or accept deliberately with '
+        + '--accept-unverified --reason "why this cannot be machine-checked".',
+    );
+  }
+  if (!acceptVerify.ok && verifyOverride && !overrideReason) {
+    failTask(
+      'atris task accept',
+      'unverified_accept_needs_reason',
+      '--accept-unverified records an unfalsifiable accept in the ledger, so it requires --reason "<why>".',
+    );
+  }
   const readyReview = beforeTask?.review || {};
   const clearLesson = hasEmptyFlagValue(args, '--lesson');
   const clearNextTask = hasEmptyFlagValue(args, '--next');
@@ -9609,6 +9804,52 @@ function stampCertifyVerifyMetadata(taskDb, db, taskId, actor, verify) {
   `).run(JSON.stringify(metadata), Date.now(), taskId);
 }
 
+function currentHeadSha(workspaceRoot) {
+  try {
+    return execSync('git rev-parse HEAD', {
+      cwd: workspaceRoot || process.cwd(),
+      stdio: ['ignore', 'pipe', 'pipe'],
+      encoding: 'utf8',
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+// metadata.verify_cache is the read path's only verify verdict: `reviews`
+// must never spawn a check (that read-side execution fork-bombed the fleet
+// on 2026-07-29), so the two lanes that legitimately execute verifies —
+// certify-verified and the autoland landing re-check — persist the outcome
+// here for the read path to consult.
+function stampVerifyCacheMetadata(taskDb, db, taskId, { verify, result, actor, workspaceRoot }) {
+  const row = taskDb.getTask(db, taskId);
+  if (!row) return;
+  const metadata = row.metadata && typeof row.metadata === 'object' ? { ...row.metadata } : {};
+  metadata.verify_cache = {
+    command: verify,
+    ok: result && result.ok === true,
+    reason: (result && result.reason) || null,
+    ran_at: new Date().toISOString(),
+    ran_by: actor,
+    code_sha: currentHeadSha(workspaceRoot),
+  };
+  db.prepare(`
+    UPDATE tasks
+       SET metadata = ?,
+           updated_at = ?
+     WHERE id = ?
+  `).run(JSON.stringify(metadata), Date.now(), taskId);
+}
+
+function cachedVerifyVerdict(task, root) {
+  const metadata = (task && task.metadata) || {};
+  const cache = metadata.verify_cache;
+  if (!cache || typeof cache !== 'object') return { fresh: false, command: metadata.verify || null };
+  const fresh = cache.command === metadata.verify
+    && (!cache.code_sha || cache.code_sha === currentHeadSha(task.workspace_root || root));
+  return { ...cache, fresh: Boolean(fresh) };
+}
+
 // `atris task ready --verify "<cmd>"` already runs the command live and
 // gates on exit 0, but that alone leaves no machine re-runnable trace once
 // the proof text scrolls out of easy reach: storing the exact command on
@@ -9650,6 +9891,7 @@ function reverifyBeforeLanding(taskDb, db, task, { actor = 'autoland-verifier',
     };
   }
   const result = runVerifyCommandCached(verify, task.workspace_root || process.cwd(), verifyCache);
+  stampVerifyCacheMetadata(taskDb, db, task.id, { verify, result, actor, workspaceRoot: task.workspace_root });
   if (result.ok) return { ok: true, verify, result };
   const note = landingVerifyFailureNote(verify, result);
   const revised = taskDb.reviseTask(db, {
@@ -9719,8 +9961,10 @@ function cmdCertifyVerified(args, options = {}) {
     // "certified" alone is not landable.
     // strictVerify stays off in this eligibility probe: certify-verified runs
     // the check itself right below, and strict mode here would execute it a
-    // second time per row before the real run.
-    const evaluation = evaluateAutoAccept(task, { strictVerify: false });
+    // second time per row before the real run. executeVerify: false as well —
+    // an untrusted trust tier re-enables the strict block internally even
+    // with strictVerify off, which is how this probe spawned a verify per row.
+    const evaluation = evaluateAutoAccept(task, { strictVerify: false, executeVerify: false });
     if (evaluation.eligible) {
       results.push({ ref, action: 'skipped', reason: 'already_landable' });
       continue;
@@ -9749,6 +9993,7 @@ function cmdCertifyVerified(args, options = {}) {
       continue;
     }
     const run = runVerifyCommandCached(verify, task.workspace_root || process.cwd(), verifyCache);
+    stampVerifyCacheMetadata(taskDb, db, task.id, { verify, result: run, actor, workspaceRoot: task.workspace_root });
     if (!run.ok) {
       results.push({ ref, action: 'verify_failed', reason: run.reason, verify });
       continue;
@@ -9927,11 +10172,19 @@ function cmdAutoAcceptCertified(args) {
     }
     const landingVerify = reverifyBeforeLanding(taskDb, db, task, { verifyCache });
     if (!landingVerify.ok) {
+      // A refused landing whose revise also failed is the worst state in the
+      // loop: the work does not land AND nobody is told to fix it, so the row
+      // sits in review forever being re-refused every hour. Mark it so the
+      // heartbeat can raise it instead of counting it as routine.
       results.push({
         ...evaluation,
         eligible: false,
         action: landingVerify.revised ? 'revised' : 'revise_failed',
         reason: landingVerify.result.reason || landingVerify.revise_reason || 'verify_failed',
+        ...(landingVerify.result.unrunnable_cause
+          ? { unrunnable_cause: landingVerify.result.unrunnable_cause }
+          : {}),
+        alarm: landingVerify.revised !== true || landingVerify.result.reason === 'verify_unrunnable',
         verify: landingVerify.verify,
         exit_code: landingVerify.result.status,
         revision_note: landingVerify.note,
@@ -10029,7 +10282,7 @@ function autoAcceptSweepDeniedReason(task) {
   for (const value of autoAcceptSweepLabelValues(task)) {
     const tokens = autoAcceptSweepNormalizedTokens(value);
     for (const token of tokens) {
-      if (token === 'needs-human' || token === 'needshuman') {
+      if (token === 'needs-human' || token === 'needshuman' || token === 'decision') {
         return 'needs_human';
       }
       const protectedLane = [...SWEEP_AUTO_ACCEPT_PROTECTED].find((denied) =>
@@ -11057,7 +11310,45 @@ function taskHasReview(task) {
   return review.reward != null || Boolean(review.proof || review.lesson || review.next_task);
 }
 
-function taskBoardHtml() {
+const TASK_BOARD_COLUMNS = [
+  ['backlog', 'Backlog'],
+  ['open', 'Open'],
+  ['doing', 'Doing'],
+  ['review', 'Review'],
+  ['blocked', 'Blocked'],
+  ['done', 'Done'],
+];
+
+// Pure state shaping: projection in, board view model out. No markup here.
+function taskBoardViewModel(projection = {}) {
+  const tasks = Array.isArray(projection.tasks) ? projection.tasks : [];
+  const rows = tasks.map((task) => ({
+    id: task.id,
+    task,
+    column: taskColumn(task),
+    decision: taskHasReview(task),
+  }));
+  const columns = TASK_BOARD_COLUMNS.map(([key, label]) => ({
+    key,
+    label,
+    rows: rows.filter((row) => row.column === key),
+  }));
+  const counts = {};
+  for (const column of columns) counts[column.key] = column.rows.length;
+  return {
+    columns,
+    counts,
+    rows,
+    total: rows.length,
+    planTags: Array.from(STATUS_PLAN_TAGS),
+  };
+}
+
+// Markup only: view model in, board page out. The page hydrates itself from
+// /api/tasks in the browser, so the template bakes in just the shared
+// plan-tag list; the column keys and labels must stay in step with
+// TASK_BOARD_COLUMNS above.
+function taskBoardTemplate(model) {
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -11216,7 +11507,7 @@ function taskBoardHtml() {
       ['blocked', 'Blocked'],
       ['done', 'Done']
     ];
-    const planTags = new Set(${JSON.stringify(Array.from(STATUS_PLAN_TAGS))});
+    const planTags = new Set(${JSON.stringify(model.planTags)});
     let state = { tasks: [] };
     let selected = null;
     const $ = (id) => document.getElementById(id);
@@ -11489,6 +11780,10 @@ function taskBoardHtml() {
 </html>`;
 }
 
+function taskBoardHtml() {
+  return taskBoardTemplate(taskBoardViewModel());
+}
+
 function readJsonBody(req) {
   return new Promise((resolve, reject) => {
     let body = '';
@@ -11507,10 +11802,11 @@ function readJsonBody(req) {
   });
 }
 
-function sendJson(res, status, value) {
+function sendJson(res, status, value, headers = {}) {
   res.writeHead(status, {
     'content-type': 'application/json; charset=utf-8',
     'access-control-allow-origin': 'http://localhost',
+    ...headers,
   });
   res.end(JSON.stringify(value, null, 2));
 }
@@ -11520,551 +11816,655 @@ function sendHtml(res, value) {
   res.end(value);
 }
 
-async function handleTaskApi(req, res, taskDb, db) {
-  const url = new URL(req.url, 'http://127.0.0.1');
-  if (req.method === 'OPTIONS') return sendJson(res, 200, { ok: true });
-  if (req.method === 'GET' && url.pathname === '/') return sendHtml(res, taskBoardHtml());
-  if (req.method === 'GET' && url.pathname === '/api/tasks') {
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, { ok: true, projection_path: outPath, projection });
-  }
-  if (req.method === 'GET' && url.pathname === '/api/stream') {
-    // Time-ordered feed of what the agent actually did + heartbeat liveness.
-    const { projection } = writeDefaultProjection(taskDb, db);
-    const root = projection.workspace_root || process.cwd();
-    const stateDir = path.join(root, '.atris', 'state');
-    const activity = require('../lib/activity-stream');
-    const { readJsonl } = require('../lib/pulse');
-    const rd = (f) => readJsonl(path.join(stateDir, f));
-    const pulseReceipts = rd('pulse_agi_loop_receipts.jsonl');
-    const events = activity.buildActivityStream({
-      pulseReceipts,
-      scorecards: rd('scorecards.jsonl'),
-      taskEpisodes: rd('task_episodes.jsonl').slice(-200),
-      xpReceipts: rd('career_xp_receipts.jsonl').slice(-200),
-      missionEvents: rd('mission_events.jsonl').slice(-200),
-    }, { limit: 60 });
-    return sendJson(res, 200, { ok: true, heartbeat: activity.buildHeartbeat(pulseReceipts), events });
-  }
-  if (req.method === 'GET' && url.pathname === '/api/tasks/capabilities') {
-    return sendJson(res, 200, {
-      ok: true,
-      action: 'capabilities',
-      capabilities: taskCapabilitiesContract(),
-      safety: {
-        read_only: true,
-        claims_work: false,
-        human_accept: false,
-        xp_after_human_accept: true,
-      },
+function taskApiQueueOptions(url) {
+  const limitParam = url.searchParams.get('limit');
+  const limit = limitParam ? Number(limitParam) : 8;
+  return {
+    owner: url.searchParams.get('owner') || url.searchParams.get('as') || DEFAULT_OWNER,
+    reviewer: url.searchParams.get('reviewer') || url.searchParams.get('as_reviewer') || 'codex-review',
+    all: url.searchParams.get('all') === '1' || url.searchParams.get('all') === 'true',
+    everywhere: url.searchParams.get('everywhere') === '1' || url.searchParams.get('everywhere') === 'true',
+    limit: Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 8,
+    scope: taskQueueScopeFromSearchParams(url.searchParams),
+  };
+}
+
+function serveTaskApiOptions({ res }) {
+  return sendJson(res, 200, { ok: true });
+}
+
+function serveTaskBoardPage({ res }) {
+  return sendHtml(res, taskBoardHtml());
+}
+
+function serveTaskList({ res, taskDb, db }) {
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, { ok: true, projection_path: outPath, projection });
+}
+
+function serveTaskActivityStream({ res, taskDb, db }) {
+  // Time-ordered feed of what the agent actually did + heartbeat liveness.
+  const { projection } = writeDefaultProjection(taskDb, db);
+  const root = projection.workspace_root || process.cwd();
+  const stateDir = path.join(root, '.atris', 'state');
+  const activity = require('../lib/activity-stream');
+  const { readJsonl } = require('../lib/pulse');
+  const readStateRows = (file) => readJsonl(path.join(stateDir, file));
+  const pulseReceipts = readStateRows('pulse_agi_loop_receipts.jsonl');
+  const events = activity.buildActivityStream({
+    pulseReceipts,
+    scorecards: readStateRows('scorecards.jsonl'),
+    taskEpisodes: readStateRows('task_episodes.jsonl').slice(-200),
+    xpReceipts: readStateRows('career_xp_receipts.jsonl').slice(-200),
+    missionEvents: readStateRows('mission_events.jsonl').slice(-200),
+  }, { limit: 60 });
+  return sendJson(res, 200, {
+    ok: true,
+    heartbeat: activity.buildHeartbeat(pulseReceipts),
+    events,
+  }, {
+    'content-type': 'text/event-stream; charset=utf-8',
+    'cache-control': 'no-cache',
+    connection: 'keep-alive',
+  });
+}
+
+function serveTaskCapabilities({ res }) {
+  return sendJson(res, 200, {
+    ok: true,
+    action: 'capabilities',
+    capabilities: taskCapabilitiesContract(),
+    safety: {
+      read_only: true,
+      claims_work: false,
+      human_accept: false,
+      xp_after_human_accept: true,
+    },
+  });
+}
+
+function serveTaskCapabilitiesCheck({ res, taskDb, db, url }) {
+  const report = taskCapabilitiesCheckReport(taskDb, db, [], taskApiQueueOptions(url));
+  return sendJson(res, report.ok ? 200 : 409, report);
+}
+
+function serveTaskReviewLaneDrain({ res, taskDb, db, url }) {
+  const report = taskReviewLaneDrainReport(taskDb, db, [], taskApiQueueOptions(url));
+  return sendJson(res, report.ok ? 200 : 409, report);
+}
+
+async function postTaskReviewLaneAct({ req, res, taskDb, db, url }) {
+  const body = await readJsonBody(req);
+  const result = taskReviewLaneAct(taskDb, db, taskReviewLaneActOptionsFromBody(body, url.searchParams));
+  return sendJson(res, result.ok ? 200 : result.status || 409, result);
+}
+
+async function postTaskReviewLaneLoop({ req, res, taskDb, db, url }) {
+  const body = await readJsonBody(req);
+  const result = taskReviewLaneLoop(taskDb, db, taskReviewLaneLoopOptionsFromBody(body, url.searchParams));
+  return sendJson(res, result.ok ? 200 : result.status || 409, result);
+}
+
+async function postTaskReviewLaneRun({ req, res, taskDb, db, url }) {
+  const body = await readJsonBody(req);
+  const result = taskReviewLaneRun(taskDb, db, taskReviewLaneRunOptionsFromBody(body, url.searchParams));
+  return sendJson(res, result.ok ? 200 : result.status || 409, result);
+}
+
+function serveTaskCurrent({ res, taskDb, db, url }) {
+  const { outPath, current } = buildTaskCurrent(taskDb, db, [], taskApiQueueOptions(url));
+  const action = url.pathname.endsWith('/queue') ? 'queue' : 'current';
+  return sendJson(res, 200, {
+    ok: true,
+    action,
+    projection_path: outPath,
+    current,
+    selected: current.selected,
+    page: current.page,
+    queue: current.queue,
+  });
+}
+
+async function postCurrentTaskStep({ req, res, taskDb, db, url }) {
+  const body = await readJsonBody(req);
+  const options = taskCurrentStepOptionsFromBody(body, url.searchParams);
+  try {
+    const result = runCurrentTaskStep(taskDb, db, options);
+    return sendJson(res, 200, result);
+  } catch (error) {
+    const errorCurrent = error.current || null;
+    return sendJson(res, error.status || 409, {
+      ok: false,
+      action: 'current_step',
+      reason: error.reason || 'step_failed',
+      detail: error.message,
+      selected_task_id: errorCurrent ? errorCurrent.selected_task_id : null,
+      selected_ref: errorCurrent ? errorCurrent.selected_ref : null,
+      selected_next_key: selectedNextKeyFromCurrent(errorCurrent),
+      current: errorCurrent,
+      page: error.page || null,
     });
   }
-  if (req.method === 'GET' && url.pathname === '/api/tasks/capabilities/check') {
-    const owner = url.searchParams.get('owner') || url.searchParams.get('as') || DEFAULT_OWNER;
-    const reviewer = url.searchParams.get('reviewer') || url.searchParams.get('as_reviewer') || 'codex-review';
-    const limitParam = url.searchParams.get('limit');
-    const limit = limitParam ? Number(limitParam) : 8;
-    const scope = taskQueueScopeFromSearchParams(url.searchParams);
-    const report = taskCapabilitiesCheckReport(taskDb, db, [], {
-      owner,
-      reviewer,
-      all: url.searchParams.get('all') === '1' || url.searchParams.get('all') === 'true',
-      everywhere: url.searchParams.get('everywhere') === '1' || url.searchParams.get('everywhere') === 'true',
-      limit: Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 8,
-      scope,
-    });
-    return sendJson(res, report.ok ? 200 : 409, report);
-  }
-  if (req.method === 'GET' && url.pathname === '/api/tasks/review-lane-drain') {
-    const owner = url.searchParams.get('owner') || url.searchParams.get('as') || DEFAULT_OWNER;
-    const reviewer = url.searchParams.get('reviewer') || url.searchParams.get('as_reviewer') || 'codex-review';
-    const limitParam = url.searchParams.get('limit');
-    const limit = limitParam ? Number(limitParam) : 8;
-    const scope = taskQueueScopeFromSearchParams(url.searchParams);
-    const report = taskReviewLaneDrainReport(taskDb, db, [], {
-      owner,
-      reviewer,
-      all: url.searchParams.get('all') === '1' || url.searchParams.get('all') === 'true',
-      everywhere: url.searchParams.get('everywhere') === '1' || url.searchParams.get('everywhere') === 'true',
-      limit: Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 8,
-      scope,
-    });
-    return sendJson(res, report.ok ? 200 : 409, report);
-  }
-  if (req.method === 'POST' && url.pathname === '/api/tasks/review-lane-act') {
-    const body = await readJsonBody(req);
-    const result = taskReviewLaneAct(taskDb, db, taskReviewLaneActOptionsFromBody(body, url.searchParams));
-    return sendJson(res, result.ok ? 200 : result.status || 409, result);
-  }
-  if (req.method === 'POST' && url.pathname === '/api/tasks/review-lane-loop') {
-    const body = await readJsonBody(req);
-    const result = taskReviewLaneLoop(taskDb, db, taskReviewLaneLoopOptionsFromBody(body, url.searchParams));
-    return sendJson(res, result.ok ? 200 : result.status || 409, result);
-  }
-  if (req.method === 'POST' && url.pathname === '/api/tasks/review-lane-run') {
-    const body = await readJsonBody(req);
-    const result = taskReviewLaneRun(taskDb, db, taskReviewLaneRunOptionsFromBody(body, url.searchParams));
-    return sendJson(res, result.ok ? 200 : result.status || 409, result);
-  }
-  if (req.method === 'GET' && (url.pathname === '/api/tasks/current' || url.pathname === '/api/tasks/queue')) {
-    const owner = url.searchParams.get('owner') || url.searchParams.get('as') || DEFAULT_OWNER;
-    const reviewer = url.searchParams.get('reviewer') || url.searchParams.get('as_reviewer') || 'codex-review';
-    const limitParam = url.searchParams.get('limit');
-    const limit = limitParam ? Number(limitParam) : 8;
-    const scope = taskQueueScopeFromSearchParams(url.searchParams);
-    const { outPath, current } = buildTaskCurrent(taskDb, db, [], {
-      owner,
-      reviewer,
-      all: url.searchParams.get('all') === '1' || url.searchParams.get('all') === 'true',
-      everywhere: url.searchParams.get('everywhere') === '1' || url.searchParams.get('everywhere') === 'true',
-      limit: Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 8,
-      scope,
+}
+
+async function postTaskCreate({ req, res, taskDb, db }) {
+  const body = await readJsonBody(req);
+  const title = String(body.title || '').trim();
+  if (!title) return sendJson(res, 400, { ok: false, reason: 'missing_title', detail: 'title required' });
+  const operatorTitleWarning = warnIfTaskTitleNeedsOperatorWhy(title);
+  const result = taskDb.addTask(db, {
+    title,
+    tag: body.tag ? String(body.tag) : 'tasks',
+    workspaceRoot: taskDb.workspaceRoot(),
+    metadata: body.verify ? { verify: String(body.verify).trim() } : null,
+  });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, {
+    ok: true,
+    action: 'created',
+    task_id: result.id,
+    operator_title_warning: operatorTitleWarning,
+    projection_path: outPath,
+    task: taskFromProjection(projection, result.id),
+  });
+}
+
+async function postTaskClearPlan({ req, res, taskDb, db }) {
+  const body = await readJsonBody(req);
+  if (!body.confirm && !body.yes) {
+    return sendJson(res, 400, { ok: false, reason: 'confirm_required', detail: stageErrorDetail('task clear-plan', 'confirm_required') });
+  }
+  const result = taskDb.clearPlanTasks(db, {
+    workspaceRoot: taskDb.workspaceRoot(),
+    actor: String(body.actor || DEFAULT_OWNER),
+    reason: String(body.reason || body.note || 'clear_plan'),
+    tag: String(body.tag || 'capture'),
+  });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  const taskById = new Map((projection.tasks || []).map(task => [task.id, task]));
+  return sendJson(res, 200, {
+    ok: true,
+    action: 'clear_plan',
+    cleared_count: result.cleared.length,
+    skipped_count: result.skipped.length,
+    skipped: result.skipped,
+    projection_path: outPath,
+    tasks: result.cleared.map(task => taskFromProjection(projection, task.id) || taskById.get(task.id)).filter(Boolean),
+  });
+}
+
+const TASK_API_ROUTES = [
+  { method: 'OPTIONS', pathname: null, serve: serveTaskApiOptions },
+  { method: 'GET', pathname: '/', serve: serveTaskBoardPage },
+  { method: 'GET', pathname: '/api/tasks', serve: serveTaskList },
+  { method: 'GET', pathname: '/api/stream', serve: serveTaskActivityStream },
+  { method: 'GET', pathname: '/api/tasks/capabilities', serve: serveTaskCapabilities },
+  { method: 'GET', pathname: '/api/tasks/capabilities/check', serve: serveTaskCapabilitiesCheck },
+  { method: 'GET', pathname: '/api/tasks/review-lane-drain', serve: serveTaskReviewLaneDrain },
+  { method: 'POST', pathname: '/api/tasks/review-lane-act', serve: postTaskReviewLaneAct },
+  { method: 'POST', pathname: '/api/tasks/review-lane-loop', serve: postTaskReviewLaneLoop },
+  { method: 'POST', pathname: '/api/tasks/review-lane-run', serve: postTaskReviewLaneRun },
+  { method: 'GET', pathname: '/api/tasks/current', serve: serveTaskCurrent },
+  { method: 'GET', pathname: '/api/tasks/queue', serve: serveTaskCurrent },
+  { method: 'POST', pathname: '/api/tasks/current/step', serve: postCurrentTaskStep },
+  { method: 'POST', pathname: '/api/tasks', serve: postTaskCreate },
+  { method: 'POST', pathname: '/api/tasks/clear-plan', serve: postTaskClearPlan },
+  { pattern: /^\/api\/tasks\/([^/]+)$/, serve: serveTaskDetail },
+  { pattern: /^\/api\/tasks\/([^/]+)\/page$/, serve: serveTaskPage },
+  { pattern: /^\/api\/tasks\/([^/]+)\/(claim|message|chat|step|plan|do|backlog|ready|accept|revise|finish|review|review-chat|continue-work|events)$/, serve: serveTaskOperation },
+];
+
+function serveTaskDetail({ req, res, taskDb, db, match }) {
+  if (req.method !== 'GET') return sendJson(res, 405, { ok: false, reason: 'method_not_allowed' });
+  const resolved = resolveTaskRef(taskDb, db, match[1]);
+  if (!resolved.ok) return sendJson(res, resolved.reason === 'ambiguous' ? 409 : 404, { ok: false, reason: resolved.reason });
+  const task = taskDetail(taskDb, db, resolved.id);
+  if (!task) return sendJson(res, 404, { ok: false, reason: 'not_found' });
+  const { outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, { ok: true, action: 'detail', task_id: resolved.id, projection_path: outPath, task, page: taskPageContract(task) });
+}
+
+function serveTaskPage({ req, res, taskDb, db, match }) {
+  if (req.method !== 'GET') return sendJson(res, 405, { ok: false, reason: 'method_not_allowed' });
+  const resolved = resolveTaskRef(taskDb, db, match[1]);
+  if (!resolved.ok) return sendJson(res, resolved.reason === 'ambiguous' ? 409 : 404, { ok: false, reason: resolved.reason });
+  const task = taskDetail(taskDb, db, resolved.id);
+  if (!task) return sendJson(res, 404, { ok: false, reason: 'not_found' });
+  const { outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, { ok: true, action: 'page', task_id: resolved.id, projection_path: outPath, page: taskPageContract(task) });
+}
+
+function postTaskApiStep({ res, taskDb, db, taskId, body }) {
+  try {
+    const result = runTaskStep(taskDb, db, taskId, taskStepOptionsFromBody(body));
+    return sendJson(res, 200, result);
+  } catch (error) {
+    return sendJson(res, error.status || 409, {
+      ok: false,
+      action: 'step',
+      task_id: taskId,
+      reason: error.reason || 'step_failed',
+      detail: error.message,
+      page: error.page || null,
     });
-    const action = url.pathname.endsWith('/queue') ? 'queue' : 'current';
-    return sendJson(res, 200, {
-      ok: true,
-      action,
-      projection_path: outPath,
-      current,
-      selected: current.selected,
-      page: current.page,
-      queue: current.queue,
+  }
+}
+
+function postTaskApiContinueWork({ res, taskDb, db, taskId, body }) {
+  try {
+    const result = continueWorkForReviewTask(taskDb, db, taskId, { owner: body.owner || body.actor || DEFAULT_OWNER });
+    return sendJson(res, 200, result);
+  } catch (error) {
+    return sendJson(res, error.status || 409, {
+      ok: false,
+      action: 'continue_work',
+      task_id: taskId,
+      reason: error.reason || 'continue_work_failed',
+      detail: error.message,
     });
   }
-  if (req.method === 'POST' && url.pathname === '/api/tasks/current/step') {
-    const body = await readJsonBody(req);
-    const options = taskCurrentStepOptionsFromBody(body, url.searchParams);
-    try {
-      const result = runCurrentTaskStep(taskDb, db, options);
-      return sendJson(res, 200, result);
-    } catch (error) {
-      const errorCurrent = error.current || null;
-      return sendJson(res, error.status || 409, {
-        ok: false,
-        action: 'current_step',
-        reason: error.reason || 'step_failed',
-        detail: error.message,
-        selected_task_id: errorCurrent ? errorCurrent.selected_task_id : null,
-        selected_ref: errorCurrent ? errorCurrent.selected_ref : null,
-        selected_next_key: selectedNextKeyFromCurrent(errorCurrent),
-        current: errorCurrent,
-        page: error.page || null,
-      });
-    }
+}
+
+function postTaskApiClaim({ res, taskDb, db, taskId, body }) {
+  const owner = String(body.owner || body.actor || DEFAULT_OWNER);
+  const result = taskDb.claimTask(db, { id: taskId, claimedBy: owner });
+  if (!result.claimed) return sendJson(res, 409, { ok: false, reason: result.reason, claimed_by: result.claimed_by || null });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, { ok: true, action: 'claimed', task_id: taskId, projection_path: outPath, task: taskFromProjection(projection, taskId) });
+}
+
+function postTaskApiMessage({ res, taskDb, db, taskId, body }) {
+  const result = taskDb.noteTask(db, { id: taskId, actor: String(body.actor || DEFAULT_OWNER), content: String(body.content || '') });
+  if (!result.noted) return sendJson(res, 404, { ok: false, reason: result.reason });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, { ok: true, action: 'noted', task_id: taskId, projection_path: outPath, task: taskFromProjection(projection, taskId) });
+}
+
+function postTaskApiChat({ res, taskDb, db, taskId, body }) {
+  const result = taskDb.chatTask(db, {
+    id: taskId,
+    actor: String(body.actor || DEFAULT_OWNER),
+    content: String(body.content || body.message || body.text || ''),
+    goal: String(body.goal || body.objective || ''),
+    summary: String(body.summary || ''),
+  });
+  if (!result.chatted) {
+    const status = result.reason === 'content_required' ? 400 : result.reason === 'not_found' ? 404 : 409;
+    return sendJson(res, status, { ok: false, reason: result.reason, detail: stageErrorDetail('task chat', result.reason, result) });
   }
-  if (req.method === 'POST' && url.pathname === '/api/tasks') {
-    const body = await readJsonBody(req);
-    const title = String(body.title || '').trim();
-    if (!title) return sendJson(res, 400, { ok: false, reason: 'missing_title', detail: 'title required' });
-    const operatorTitleWarning = warnIfTaskTitleNeedsOperatorWhy(title);
-    const result = taskDb.addTask(db, {
-      title,
-      tag: body.tag ? String(body.tag) : 'tasks',
-      workspaceRoot: taskDb.workspaceRoot(),
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, {
+    ok: true,
+    action: 'chatted',
+    task_id: taskId,
+    version: result.event.version,
+    goal_changed: result.goal_changed,
+    chat_packet: result.chat_packet,
+    projection_path: outPath,
+    task: taskFromProjection(projection, taskId),
+  });
+}
+
+function postTaskApiPlan({ res, taskDb, db, taskId, body }) {
+  const actor = String(body.actor || DEFAULT_OWNER);
+  const goal = String(body.goal || body.objective || '');
+  const summary = String(body.summary || body.plan || '');
+  const owner = String(body.owner || body.assignee || '');
+  const exit = String(body.exit || body.exit_condition || '');
+  const firstMove = String(body.first_move || body.firstMove || body.first || '');
+  const task = taskDetail(taskDb, db, taskId);
+  const automaticPlan = buildAutomaticPlanTrace(taskDb, task, {
+    actor,
+    actorExplicit: Boolean(body.actor),
+    owner,
+    goal,
+    summary,
+    firstMove,
+    exit,
+  });
+  const result = taskDb.stageTask(db, {
+    id: taskId,
+    actor,
+    stage: 'plan',
+    goal,
+    summary,
+    owner: automaticPlan.ownerForStage || owner,
+    exit,
+    proofNeeded: String(body.proof_needed || body.proofNeeded || body.proof || body.verify || ''),
+    firstMove,
+    nextButton: String(body.next_button || body.nextButton || ''),
+    confidence: body.confidence,
+    planTrace: automaticPlan.trace,
+  });
+  if (!result.staged) return sendJson(res, 409, { ok: false, reason: result.reason, detail: stageErrorDetail('task plan', result.reason, result) });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, { ok: true, action: 'planned', task_id: taskId, version: result.event.version, plan_trace: automaticPlan.trace, stage_packet: result.stage_packet, projection_path: outPath, task: taskFromProjection(projection, taskId) });
+}
+
+function postTaskApiDo({ res, taskDb, db, taskId, body }) {
+  const firstMove = String(body.first_move || body.firstMove || body.first || '').trim();
+  if (!firstMove) return sendJson(res, 400, { ok: false, reason: 'first_move_required', detail: 'task do: first_move required' });
+  const result = taskDb.stageTask(db, {
+    id: taskId,
+    actor: String(body.actor || DEFAULT_OWNER),
+    stage: 'do',
+    goal: String(body.goal || body.objective || ''),
+    summary: String(body.summary || ''),
+    owner: String(body.actor || DEFAULT_OWNER),
+    exit: String(body.exit || body.exit_condition || body.exitCondition || ''),
+    proofNeeded: String(body.proof_needed || body.proofNeeded || body.proof || body.verify || ''),
+    firstMove,
+    nextButton: String(body.next_button || body.nextButton || ''),
+    confidence: body.confidence,
+  });
+  if (!result.staged) return sendJson(res, 409, { ok: false, reason: result.reason, detail: stageErrorDetail('task do', result.reason, result) });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, { ok: true, action: 'doing', task_id: taskId, version: result.event.version, stage_packet: result.stage_packet, projection_path: outPath, task: taskFromProjection(projection, taskId) });
+}
+
+function postTaskApiBacklog({ res, taskDb, db, taskId, body }) {
+  const result = taskDb.backlogTask(db, {
+    id: taskId,
+    actor: String(body.actor || DEFAULT_OWNER),
+    reason: String(body.reason || body.note || 'clear_plan'),
+    tag: String(body.tag || 'capture'),
+  });
+  if (!result.backlogged) return sendJson(res, 409, { ok: false, reason: result.reason, detail: stageErrorDetail('task backlog', result.reason, result) });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, {
+    ok: true,
+    action: 'backlogged',
+    task_id: taskId,
+    version: result.event.version,
+    cleared_keys: result.cleared_keys,
+    projection_path: outPath,
+    task: taskFromProjection(projection, taskId),
+  });
+}
+
+function postTaskApiReviewChat({ res, taskDb, db, taskId, body }) {
+  try {
+    const result = appendTaskReviewChat(taskDb, db, taskId, {
+      reviewer: body.reviewer || body.actor || 'codex-review',
+      dryRun: Boolean(body.dryRun || body.noNote),
+    });
+    const { event, compactProjection, outPath, ...payload } = result;
+    return sendJson(res, 200, payload);
+  } catch (error) {
+    return sendJson(res, error.status || 409, {
+      ok: false,
+      reason: error.reason || 'review_chat_failed',
+      detail: error.message,
     });
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, { ok: true, action: 'created', task_id: result.id, operator_title_warning: operatorTitleWarning, projection_path: outPath, task: taskFromProjection(projection, result.id) });
   }
-  if (req.method === 'POST' && url.pathname === '/api/tasks/clear-plan') {
-    const body = await readJsonBody(req);
-    if (!body.confirm && !body.yes) {
-      return sendJson(res, 400, { ok: false, reason: 'confirm_required', detail: stageErrorDetail('task clear-plan', 'confirm_required') });
-    }
-    const result = taskDb.clearPlanTasks(db, {
-      workspaceRoot: taskDb.workspaceRoot(),
+}
+
+function postTaskApiFinish({ res, taskDb, db, taskId, body }) {
+  const currentTask = taskDb.getTask(db, taskId);
+  const failed = Boolean(body.failed);
+  const proof = String(body.proof || '').trim();
+  const shouldReview = Boolean(body.proof || body.lesson || body.next || body.reward !== undefined);
+  const proofIssue = meaningfulTaskProofIssue(proof, { required: !failed || shouldReview });
+  if (proofIssue) return sendProofIssue(res, proof, proofIssue);
+  const done = taskDb.doneTask(db, {
+    id: taskId,
+    status: failed ? 'failed' : 'done',
+    actor: String(body.actor || DEFAULT_OWNER),
+    action: failed ? 'failed' : 'finished',
+    proof,
+  });
+  if (!done.updated) return sendJson(res, 409, { ok: false, reason: 'not_open_or_claimed' });
+  let episode = null;
+  let nextCreated = null;
+  let xpProjection = null;
+  if (shouldReview) {
+    const reviewed = taskDb.reviewTask(db, {
+      id: taskId,
       actor: String(body.actor || DEFAULT_OWNER),
-      reason: String(body.reason || body.note || 'clear_plan'),
-      tag: String(body.tag || 'capture'),
-    });
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    const taskById = new Map((projection.tasks || []).map(task => [task.id, task]));
-    return sendJson(res, 200, {
-      ok: true,
-      action: 'clear_plan',
-      cleared_count: result.cleared.length,
-      skipped_count: result.skipped.length,
-      skipped: result.skipped,
-      projection_path: outPath,
-      tasks: result.cleared.map(task => taskFromProjection(projection, task.id) || taskById.get(task.id)).filter(Boolean),
+      reward: body.reward === undefined ? 1 : body.reward,
+      lesson: String(body.lesson || ''),
+      nextTask: String(body.next || ''),
+      proof: String(body.proof || ''),
+      careerXpEligible: false,
     });
+    episode = reviewed.episode;
+    nextCreated = body.createNext ? createNextTaskIfRequested(taskDb, db, ['--create-next'], currentTask, episode.next_task_suggestion) : null;
+    xpProjection = refreshCareerXpAfterReview(reviewed);
   }
-  const detailMatch = url.pathname.match(/^\/api\/tasks\/([^/]+)$/);
-  if (detailMatch) {
-    if (req.method !== 'GET') return sendJson(res, 405, { ok: false, reason: 'method_not_allowed' });
-    const resolved = resolveTaskRef(taskDb, db, detailMatch[1]);
-    if (!resolved.ok) return sendJson(res, resolved.reason === 'ambiguous' ? 409 : 404, { ok: false, reason: resolved.reason });
-    const task = taskDetail(taskDb, db, resolved.id);
-    if (!task) return sendJson(res, 404, { ok: false, reason: 'not_found' });
-    const { outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, { ok: true, action: 'detail', task_id: resolved.id, projection_path: outPath, task, page: taskPageContract(task) });
-  }
-  const pageMatch = url.pathname.match(/^\/api\/tasks\/([^/]+)\/page$/);
-  if (pageMatch) {
-    if (req.method !== 'GET') return sendJson(res, 405, { ok: false, reason: 'method_not_allowed' });
-    const resolved = resolveTaskRef(taskDb, db, pageMatch[1]);
-    if (!resolved.ok) return sendJson(res, resolved.reason === 'ambiguous' ? 409 : 404, { ok: false, reason: resolved.reason });
-    const task = taskDetail(taskDb, db, resolved.id);
-    if (!task) return sendJson(res, 404, { ok: false, reason: 'not_found' });
-    const { outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, { ok: true, action: 'page', task_id: resolved.id, projection_path: outPath, page: taskPageContract(task) });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, {
+    ok: true,
+    action: 'finished',
+    task_id: taskId,
+    reviewed: Boolean(episode),
+    episode,
+    xp_projection: xpProjection,
+    next_task_id: nextCreated ? nextCreated.id : null,
+    projection_path: outPath,
+    task: taskFromProjection(projection, taskId),
+  });
+}
+
+function postTaskApiReady({ res, taskDb, db, taskId, body }) {
+  const proof = String(body.proof || '').trim();
+  const proofIssue = meaningfulTaskProofIssue(proof);
+  if (proofIssue) return sendProofIssue(res, proof, proofIssue);
+  const nextTaskInput = normalizeReviewNextTaskInput(body.next);
+  const actor = String(body.actor || DEFAULT_OWNER);
+  const resultText = String(body.result || '').replace(/\s+/g, ' ').trim();
+  if (resultText) {
+    const resultIssue = resultSentenceIssue(resultText);
+    if (resultIssue) return sendJson(res, 400, { ok: false, reason: 'weak_result', detail: resultIssue });
   }
-  const match = url.pathname.match(/^\/api\/tasks\/([^/]+)\/(claim|message|chat|step|plan|do|backlog|ready|accept|revise|finish|review|review-chat|continue-work|events)$/);
-  if (!match) return sendJson(res, 404, { ok: false, reason: 'not_found' });
+  const resultTrace = buildAutomaticResultTrace(taskDb, db, taskId, {
+    actor,
+    proof,
+    changed: body.changed || resultText || body.done,
+    checked: body.checked || body.check || body.verified,
+    passed: body.passed || body.pass,
+    failed: body.failed || body.fail,
+    cost: body.cost,
+    saved: body.saved || body.savings,
+    tryNext: body.try_next || body.tryNext || body.try || body.handoff,
+    status: body.status,
+    files: body.files,
+    commands: body.commands || body.command,
+  });
+  const result = taskDb.readyTask(db, {
+    id: taskId,
+    actor,
+    proof,
+    lesson: String(body.lesson || ''),
+    nextTask: nextTaskInput.nextTask,
+    resultTrace: resultTrace && resultTrace.trace,
+    result: resultText,
+    landing: body.landing || {
+      happened: body.happened,
+      checked: body.checked,
+      tested: body.tested,
+      decision: body.decision,
+    },
+  });
+  if (!result.ready) return sendJson(res, 409, { ok: false, reason: result.reason });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, {
+    ok: true,
+    action: 'ready',
+    task_id: taskId,
+    result_trace: resultTrace,
+    ...(nextTaskInput.ignored ? { review_next_task_ignored: nextTaskInput.ignored } : {}),
+    projection_path: outPath,
+    task: taskFromProjection(projection, taskId),
+  });
+}
+
+function postTaskApiAccept({ res, taskDb, db, taskId, body }) {
+  const currentTask = enrichTaskProjection(taskDb.taskProjection(db, { taskId })).tasks[0] || null;
+  const hasExplicitProof = Object.prototype.hasOwnProperty.call(body, 'proof');
+  const proof = String(hasExplicitProof ? body.proof : currentTask?.metadata?.latest_agent_proof || '').trim();
+  const proofIssue = meaningfulTaskProofIssue(proof);
+  if (proofIssue) return sendProofIssue(res, proof, proofIssue);
+  const hasExplicitLesson = Object.prototype.hasOwnProperty.call(body, 'lesson');
+  const hasExplicitNext = Object.prototype.hasOwnProperty.call(body, 'next');
+  const lesson = hasExplicitLesson ? String(body.lesson || '') : String(currentTask?.review?.lesson || currentTask?.metadata?.latest_agent_lesson || '');
+  const nextTask = hasExplicitNext ? String(body.next || '') : String(currentTask?.review?.next_task || currentTask?.metadata?.latest_agent_next_task || '');
+  const clearedFields = [];
+  if (hasExplicitLesson && !lesson.trim()) clearedFields.push('lesson');
+  if (hasExplicitNext && !nextTask.trim()) clearedFields.push('next_task');
+  const parsedReward = parseAcceptReward(body.reward);
+  if (!parsedReward.ok) return sendJson(res, 400, { ok: false, reason: 'invalid_reward', detail: 'reward must be a positive number' });
+  const done = taskDb.doneTask(db, {
+    id: taskId,
+    status: 'done',
+    actor: String(body.actor || DEFAULT_OWNER),
+    allowReview: true,
+    action: 'accepted',
+    proof,
+  });
+  if (!done.updated) return sendJson(res, 409, { ok: false, reason: 'not_open_claimed_or_review' });
+  const reviewed = taskDb.reviewTask(db, {
+    id: taskId,
+    actor: String(body.actor || DEFAULT_OWNER),
+    reward: parsedReward.value,
+    lesson,
+    nextTask,
+    proof,
+    careerXpEligible: true,
+    clearedFields,
+  });
+  const nextCreated = body.createNext ? createNextTaskIfRequested(taskDb, db, ['--create-next'], currentTask, reviewed.episode.next_task_suggestion) : null;
+  const xpProjection = refreshCareerXpAfterReview(reviewed);
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, { ok: true, action: 'accepted', task_id: taskId, episode: reviewed.episode, xp_projection: xpProjection, next_task_id: nextCreated ? nextCreated.id : null, projection_path: outPath, task: taskFromProjection(projection, taskId) });
+}
+
+function postTaskApiRevise({ res, taskDb, db, taskId, body }) {
+  const result = taskDb.reviseTask(db, { id: taskId, actor: String(body.actor || DEFAULT_OWNER), note: String(body.note || body.reason || '') });
+  if (!result.revised) return sendJson(res, 409, { ok: false, reason: result.reason });
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, { ok: true, action: 'revise', task_id: taskId, projection_path: outPath, task: taskFromProjection(projection, taskId) });
+}
+
+function postTaskApiReview({ res, taskDb, db, taskId, body }) {
+  const currentTask = taskDb.getTask(db, taskId);
+  const rewardValue = body.reward === undefined ? 0 : body.reward;
+  const proof = String(body.proof || '').trim();
+  const hasExplicitLesson = Object.prototype.hasOwnProperty.call(body, 'lesson');
+  const hasExplicitNext = Object.prototype.hasOwnProperty.call(body, 'next')
+    || Object.prototype.hasOwnProperty.call(body, 'next_task')
+    || Object.prototype.hasOwnProperty.call(body, 'nextTask');
+  const lessonText = hasExplicitLesson ? String(body.lesson || '') : '';
+  const rawNext = Object.prototype.hasOwnProperty.call(body, 'next')
+    ? body.next
+    : Object.prototype.hasOwnProperty.call(body, 'next_task')
+    ? body.next_task
+    : body.nextTask;
+  const nextTaskInput = normalizeReviewNextTaskInput(hasExplicitNext ? rawNext : '');
+  const clearedFields = [];
+  if (hasExplicitLesson && !lessonText.trim()) clearedFields.push('lesson');
+  if (hasExplicitNext && !String(rawNext || '').trim()) clearedFields.push('next_task');
+  const proofIssue = Number(rewardValue) > 0 || proof
+    ? meaningfulTaskProofIssue(proof)
+    : null;
+  if (proofIssue) return sendProofIssue(res, proof, proofIssue);
+  const reviewed = taskDb.reviewTask(db, {
+    id: taskId,
+    actor: String(body.actor || DEFAULT_OWNER),
+    reward: rewardValue,
+    lesson: lessonText,
+    nextTask: nextTaskInput.nextTask,
+    proof,
+    careerXpEligible: false,
+    clearedFields,
+  });
+  const nextCreated = body.createNext ? createNextTaskIfRequested(taskDb, db, ['--create-next'], currentTask, reviewed.episode.next_task_suggestion) : null;
+  const xpProjection = refreshCareerXpAfterReview(reviewed);
+  const { projection, outPath } = writeDefaultProjection(taskDb, db);
+  return sendJson(res, 200, {
+    ok: true,
+    action: 'reviewed',
+    task_id: taskId,
+    episode: reviewed.episode,
+    xp_projection: xpProjection,
+    next_task_id: nextCreated ? nextCreated.id : null,
+    ...(nextTaskInput.ignored ? { review_next_task_ignored: nextTaskInput.ignored } : {}),
+    projection_path: outPath,
+    task: taskFromProjection(projection, taskId),
+  });
+}
+
+const TASK_API_POST_OPERATIONS = {
+  step: postTaskApiStep,
+  'continue-work': postTaskApiContinueWork,
+  claim: postTaskApiClaim,
+  message: postTaskApiMessage,
+  chat: postTaskApiChat,
+  plan: postTaskApiPlan,
+  do: postTaskApiDo,
+  backlog: postTaskApiBacklog,
+  'review-chat': postTaskApiReviewChat,
+  finish: postTaskApiFinish,
+  ready: postTaskApiReady,
+  accept: postTaskApiAccept,
+  revise: postTaskApiRevise,
+  review: postTaskApiReview,
+};
+
+function serveTaskEvents({ res, taskDb, db, taskId }) {
+  const events = taskDb.listTaskEvents(db, { taskId, limit: 500 });
+  return sendJson(res, 200, { ok: true, events });
+}
+
+async function serveTaskOperation({ req, res, taskDb, db, match }) {
   const resolved = resolveTaskRef(taskDb, db, match[1]);
   if (!resolved.ok) return sendJson(res, resolved.reason === 'ambiguous' ? 409 : 404, { ok: false, reason: resolved.reason });
   const taskId = resolved.id;
-  const op = match[2];
-  if (req.method === 'GET' && op === 'events') {
-    const events = taskDb.listTaskEvents(db, { taskId, limit: 500 });
-    return sendJson(res, 200, { ok: true, events });
+  const operation = match[2];
+  if (req.method === 'GET' && operation === 'events') {
+    return serveTaskEvents({ res, taskDb, db, taskId });
   }
   if (req.method !== 'POST') return sendJson(res, 405, { ok: false, reason: 'method_not_allowed' });
   const body = await readJsonBody(req);
-  if (op === 'step') {
-    try {
-      const result = runTaskStep(taskDb, db, taskId, taskStepOptionsFromBody(body));
-      return sendJson(res, 200, result);
-    } catch (error) {
-      return sendJson(res, error.status || 409, {
-        ok: false,
-        action: 'step',
-        task_id: taskId,
-        reason: error.reason || 'step_failed',
-        detail: error.message,
-        page: error.page || null,
-      });
-    }
-  }
-  if (op === 'continue-work') {
-    try {
-      const result = continueWorkForReviewTask(taskDb, db, taskId, { owner: body.owner || body.actor || DEFAULT_OWNER });
-      return sendJson(res, 200, result);
-    } catch (error) {
-      return sendJson(res, error.status || 409, {
-        ok: false,
-        action: 'continue_work',
-        task_id: taskId,
-        reason: error.reason || 'continue_work_failed',
-        detail: error.message,
-      });
-    }
-  }
-  if (op === 'claim') {
-    const owner = String(body.owner || body.actor || DEFAULT_OWNER);
-    const result = taskDb.claimTask(db, { id: taskId, claimedBy: owner });
-    if (!result.claimed) return sendJson(res, 409, { ok: false, reason: result.reason, claimed_by: result.claimed_by || null });
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, { ok: true, action: 'claimed', task_id: taskId, projection_path: outPath, task: taskFromProjection(projection, taskId) });
-  }
-  if (op === 'message') {
-    const result = taskDb.noteTask(db, { id: taskId, actor: String(body.actor || DEFAULT_OWNER), content: String(body.content || '') });
-    if (!result.noted) return sendJson(res, 404, { ok: false, reason: result.reason });
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, { ok: true, action: 'noted', task_id: taskId, projection_path: outPath, task: taskFromProjection(projection, taskId) });
-  }
-  if (op === 'chat') {
-    const result = taskDb.chatTask(db, {
-      id: taskId,
-      actor: String(body.actor || DEFAULT_OWNER),
-      content: String(body.content || body.message || body.text || ''),
-      goal: String(body.goal || body.objective || ''),
-      summary: String(body.summary || ''),
-    });
-    if (!result.chatted) {
-      const status = result.reason === 'content_required' ? 400 : result.reason === 'not_found' ? 404 : 409;
-      return sendJson(res, status, { ok: false, reason: result.reason, detail: stageErrorDetail('task chat', result.reason, result) });
-    }
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, {
-      ok: true,
-      action: 'chatted',
-      task_id: taskId,
-      version: result.event.version,
-      goal_changed: result.goal_changed,
-      chat_packet: result.chat_packet,
-      projection_path: outPath,
-      task: taskFromProjection(projection, taskId),
-    });
-  }
-  if (op === 'plan') {
-    const actor = String(body.actor || DEFAULT_OWNER);
-    const goal = String(body.goal || body.objective || '');
-    const summary = String(body.summary || body.plan || '');
-    const owner = String(body.owner || body.assignee || '');
-    const exit = String(body.exit || body.exit_condition || '');
-    const firstMove = String(body.first_move || body.firstMove || body.first || '');
-    const task = taskDetail(taskDb, db, taskId);
-    const automaticPlan = buildAutomaticPlanTrace(taskDb, task, {
-      actor,
-      actorExplicit: Boolean(body.actor),
-      owner,
-      goal,
-      summary,
-      firstMove,
-      exit,
-    });
-    const result = taskDb.stageTask(db, {
-      id: taskId,
-      actor,
-      stage: 'plan',
-      goal,
-      summary,
-      owner: automaticPlan.ownerForStage || owner,
-      exit,
-      proofNeeded: String(body.proof_needed || body.proofNeeded || body.proof || body.verify || ''),
-      firstMove,
-      nextButton: String(body.next_button || body.nextButton || ''),
-      confidence: body.confidence,
-      planTrace: automaticPlan.trace,
-    });
-    if (!result.staged) return sendJson(res, 409, { ok: false, reason: result.reason, detail: stageErrorDetail('task plan', result.reason, result) });
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, { ok: true, action: 'planned', task_id: taskId, version: result.event.version, plan_trace: automaticPlan.trace, stage_packet: result.stage_packet, projection_path: outPath, task: taskFromProjection(projection, taskId) });
-  }
-  if (op === 'do') {
-    const firstMove = String(body.first_move || body.firstMove || body.first || '').trim();
-    if (!firstMove) return sendJson(res, 400, { ok: false, reason: 'first_move_required', detail: 'task do: first_move required' });
-    const result = taskDb.stageTask(db, {
-      id: taskId,
-      actor: String(body.actor || DEFAULT_OWNER),
-      stage: 'do',
-      goal: String(body.goal || body.objective || ''),
-      summary: String(body.summary || ''),
-      owner: String(body.actor || DEFAULT_OWNER),
-      exit: String(body.exit || body.exit_condition || body.exitCondition || ''),
-      proofNeeded: String(body.proof_needed || body.proofNeeded || body.proof || body.verify || ''),
-      firstMove,
-      nextButton: String(body.next_button || body.nextButton || ''),
-      confidence: body.confidence,
-    });
-    if (!result.staged) return sendJson(res, 409, { ok: false, reason: result.reason, detail: stageErrorDetail('task do', result.reason, result) });
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, { ok: true, action: 'doing', task_id: taskId, version: result.event.version, stage_packet: result.stage_packet, projection_path: outPath, task: taskFromProjection(projection, taskId) });
-  }
-  if (op === 'backlog') {
-    const result = taskDb.backlogTask(db, {
-      id: taskId,
-      actor: String(body.actor || DEFAULT_OWNER),
-      reason: String(body.reason || body.note || 'clear_plan'),
-      tag: String(body.tag || 'capture'),
-    });
-    if (!result.backlogged) return sendJson(res, 409, { ok: false, reason: result.reason, detail: stageErrorDetail('task backlog', result.reason, result) });
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, {
-      ok: true,
-      action: 'backlogged',
-      task_id: taskId,
-      version: result.event.version,
-      cleared_keys: result.cleared_keys,
-      projection_path: outPath,
-      task: taskFromProjection(projection, taskId),
-    });
-  }
-  if (op === 'review-chat') {
-    try {
-      const result = appendTaskReviewChat(taskDb, db, taskId, {
-        reviewer: body.reviewer || body.actor || 'codex-review',
-        dryRun: Boolean(body.dryRun || body.noNote),
-      });
-      const { event, compactProjection, outPath, ...payload } = result;
-      return sendJson(res, 200, payload);
-    } catch (error) {
-      return sendJson(res, error.status || 409, {
-        ok: false,
-        reason: error.reason || 'review_chat_failed',
-        detail: error.message,
-      });
+  const postTaskOperation = TASK_API_POST_OPERATIONS[operation];
+  if (!postTaskOperation) return;
+  return postTaskOperation({ res, taskDb, db, taskId, body });
+}
+
+function matchTaskApiRoute(req, url) {
+  for (const route of TASK_API_ROUTES) {
+    if (route.method && route.method !== req.method) continue;
+    if (Object.prototype.hasOwnProperty.call(route, 'pathname')) {
+      if (route.pathname === null || route.pathname === url.pathname) return { route, match: null };
+      continue;
     }
+    const match = url.pathname.match(route.pattern);
+    if (match) return { route, match };
   }
-  if (op === 'finish') {
-    const currentTask = taskDb.getTask(db, taskId);
-    const failed = Boolean(body.failed);
-    const proof = String(body.proof || '').trim();
-    const shouldReview = Boolean(body.proof || body.lesson || body.next || body.reward !== undefined);
-    const proofIssue = meaningfulTaskProofIssue(proof, { required: !failed || shouldReview });
-    if (proofIssue) return sendProofIssue(res, proof, proofIssue);
-    const done = taskDb.doneTask(db, {
-      id: taskId,
-      status: failed ? 'failed' : 'done',
-      actor: String(body.actor || DEFAULT_OWNER),
-      action: failed ? 'failed' : 'finished',
-      proof,
-    });
-    if (!done.updated) return sendJson(res, 409, { ok: false, reason: 'not_open_or_claimed' });
-    let episode = null;
-    let nextCreated = null;
-    let xpProjection = null;
-    if (shouldReview) {
-      const reviewed = taskDb.reviewTask(db, {
-        id: taskId,
-        actor: String(body.actor || DEFAULT_OWNER),
-        reward: body.reward === undefined ? 1 : body.reward,
-        lesson: String(body.lesson || ''),
-        nextTask: String(body.next || ''),
-        proof: String(body.proof || ''),
-        careerXpEligible: false,
-      });
-      episode = reviewed.episode;
-      nextCreated = body.createNext ? createNextTaskIfRequested(taskDb, db, ['--create-next'], currentTask, episode.next_task_suggestion) : null;
-      xpProjection = refreshCareerXpAfterReview(reviewed);
-    }
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, {
-      ok: true,
-      action: 'finished',
-      task_id: taskId,
-      reviewed: Boolean(episode),
-      episode,
-      xp_projection: xpProjection,
-      next_task_id: nextCreated ? nextCreated.id : null,
-      projection_path: outPath,
-      task: taskFromProjection(projection, taskId),
-    });
-  }
-  if (op === 'ready') {
-    const proof = String(body.proof || '').trim();
-    const proofIssue = meaningfulTaskProofIssue(proof);
-    if (proofIssue) return sendProofIssue(res, proof, proofIssue);
-    const nextTaskInput = normalizeReviewNextTaskInput(body.next);
-    const actor = String(body.actor || DEFAULT_OWNER);
-    const resultText = String(body.result || '').replace(/\s+/g, ' ').trim();
-    if (resultText) {
-      const resultIssue = resultSentenceIssue(resultText);
-      if (resultIssue) return sendJson(res, 400, { ok: false, reason: 'weak_result', detail: resultIssue });
-    }
-    const resultTrace = buildAutomaticResultTrace(taskDb, db, taskId, {
-      actor,
-      proof,
-      changed: body.changed || resultText || body.done,
-      checked: body.checked || body.check || body.verified,
-      passed: body.passed || body.pass,
-      failed: body.failed || body.fail,
-      cost: body.cost,
-      saved: body.saved || body.savings,
-      tryNext: body.try_next || body.tryNext || body.try || body.handoff,
-      status: body.status,
-      files: body.files,
-      commands: body.commands || body.command,
-    });
-    const result = taskDb.readyTask(db, {
-      id: taskId,
-      actor,
-      proof,
-      lesson: String(body.lesson || ''),
-      nextTask: nextTaskInput.nextTask,
-      resultTrace: resultTrace && resultTrace.trace,
-      result: resultText,
-      landing: body.landing || {
-        happened: body.happened,
-        checked: body.checked,
-        tested: body.tested,
-        decision: body.decision,
-      },
-    });
-    if (!result.ready) return sendJson(res, 409, { ok: false, reason: result.reason });
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, {
-      ok: true,
-      action: 'ready',
-      task_id: taskId,
-      result_trace: resultTrace,
-      ...(nextTaskInput.ignored ? { review_next_task_ignored: nextTaskInput.ignored } : {}),
-      projection_path: outPath,
-      task: taskFromProjection(projection, taskId),
-    });
-  }
-  if (op === 'accept') {
-    const currentTask = enrichTaskProjection(taskDb.taskProjection(db, { taskId })).tasks[0] || null;
-    const hasExplicitProof = Object.prototype.hasOwnProperty.call(body, 'proof');
-    const proof = String(hasExplicitProof ? body.proof : currentTask?.metadata?.latest_agent_proof || '').trim();
-    const proofIssue = meaningfulTaskProofIssue(proof);
-    if (proofIssue) return sendProofIssue(res, proof, proofIssue);
-    const hasExplicitLesson = Object.prototype.hasOwnProperty.call(body, 'lesson');
-    const hasExplicitNext = Object.prototype.hasOwnProperty.call(body, 'next');
-    const lesson = hasExplicitLesson ? String(body.lesson || '') : String(currentTask?.review?.lesson || currentTask?.metadata?.latest_agent_lesson || '');
-    const nextTask = hasExplicitNext ? String(body.next || '') : String(currentTask?.review?.next_task || currentTask?.metadata?.latest_agent_next_task || '');
-    const clearedFields = [];
-    if (hasExplicitLesson && !lesson.trim()) clearedFields.push('lesson');
-    if (hasExplicitNext && !nextTask.trim()) clearedFields.push('next_task');
-    const parsedReward = parseAcceptReward(body.reward);
-    if (!parsedReward.ok) return sendJson(res, 400, { ok: false, reason: 'invalid_reward', detail: 'reward must be a positive number' });
-    const done = taskDb.doneTask(db, {
-      id: taskId,
-      status: 'done',
-      actor: String(body.actor || DEFAULT_OWNER),
-      allowReview: true,
-      action: 'accepted',
-      proof,
-    });
-    if (!done.updated) return sendJson(res, 409, { ok: false, reason: 'not_open_claimed_or_review' });
-    const reviewed = taskDb.reviewTask(db, {
-      id: taskId,
-      actor: String(body.actor || DEFAULT_OWNER),
-      reward: parsedReward.value,
-      lesson,
-      nextTask,
-      proof,
-      careerXpEligible: true,
-      clearedFields,
-    });
-    const nextCreated = body.createNext ? createNextTaskIfRequested(taskDb, db, ['--create-next'], currentTask, reviewed.episode.next_task_suggestion) : null;
-    const xpProjection = refreshCareerXpAfterReview(reviewed);
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, { ok: true, action: 'accepted', task_id: taskId, episode: reviewed.episode, xp_projection: xpProjection, next_task_id: nextCreated ? nextCreated.id : null, projection_path: outPath, task: taskFromProjection(projection, taskId) });
-  }
-  if (op === 'revise') {
-    const result = taskDb.reviseTask(db, { id: taskId, actor: String(body.actor || DEFAULT_OWNER), note: String(body.note || body.reason || '') });
-    if (!result.revised) return sendJson(res, 409, { ok: false, reason: result.reason });
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, { ok: true, action: 'revise', task_id: taskId, projection_path: outPath, task: taskFromProjection(projection, taskId) });
-  }
-  if (op === 'review') {
-    const currentTask = taskDb.getTask(db, taskId);
-    const rewardValue = body.reward === undefined ? 0 : body.reward;
-    const proof = String(body.proof || '').trim();
-    const hasExplicitLesson = Object.prototype.hasOwnProperty.call(body, 'lesson');
-    const hasExplicitNext = Object.prototype.hasOwnProperty.call(body, 'next')
-      || Object.prototype.hasOwnProperty.call(body, 'next_task')
-      || Object.prototype.hasOwnProperty.call(body, 'nextTask');
-    const lessonText = hasExplicitLesson ? String(body.lesson || '') : '';
-    const rawNext = Object.prototype.hasOwnProperty.call(body, 'next')
-      ? body.next
-      : Object.prototype.hasOwnProperty.call(body, 'next_task')
-      ? body.next_task
-      : body.nextTask;
-    const nextTaskInput = normalizeReviewNextTaskInput(hasExplicitNext ? rawNext : '');
-    const clearedFields = [];
-    if (hasExplicitLesson && !lessonText.trim()) clearedFields.push('lesson');
-    if (hasExplicitNext && !String(rawNext || '').trim()) clearedFields.push('next_task');
-    const proofIssue = Number(rewardValue) > 0 || proof
-      ? meaningfulTaskProofIssue(proof)
-      : null;
-    if (proofIssue) return sendProofIssue(res, proof, proofIssue);
-    const reviewed = taskDb.reviewTask(db, {
-      id: taskId,
-      actor: String(body.actor || DEFAULT_OWNER),
-      reward: rewardValue,
-      lesson: lessonText,
-      nextTask: nextTaskInput.nextTask,
-      proof,
-      careerXpEligible: false,
-      clearedFields,
-    });
-    const nextCreated = body.createNext ? createNextTaskIfRequested(taskDb, db, ['--create-next'], currentTask, reviewed.episode.next_task_suggestion) : null;
-    const xpProjection = refreshCareerXpAfterReview(reviewed);
-    const { projection, outPath } = writeDefaultProjection(taskDb, db);
-    return sendJson(res, 200, {
-      ok: true,
-      action: 'reviewed',
-      task_id: taskId,
-      episode: reviewed.episode,
-      xp_projection: xpProjection,
-      next_task_id: nextCreated ? nextCreated.id : null,
-      ...(nextTaskInput.ignored ? { review_next_task_ignored: nextTaskInput.ignored } : {}),
-      projection_path: outPath,
-      task: taskFromProjection(projection, taskId),
+  return null;
+}
+
+async function handleTaskApi(req, res, taskDb, db) {
+  const url = new URL(req.url, 'http://127.0.0.1');
+  const matchedRoute = matchTaskApiRoute(req, url);
+  if (!matchedRoute) return sendJson(res, 404, { ok: false, reason: 'not_found' });
+  return matchedRoute.route.serve({
+    req,
+    res,
+    taskDb,
+    db,
+    url,
+    match: matchedRoute.match,
+  });
+}
+
+function createTaskApiServer(taskApi = {}) {
+  const taskDb = taskApi.taskDb || getTaskDb();
+  const db = taskApi.db || taskDb.open();
+  return http.createServer((req, res) => {
+    handleTaskApi(req, res, taskDb, db).catch((error) => {
+      sendJson(res, 500, { ok: false, reason: 'server_error', detail: String(error && error.message || error) });
     });
-  }
+  });
 }
 
 function cmdServe(args) {
@@ -12072,11 +12472,7 @@ function cmdServe(args) {
   const port = Number(flag(args, '--port') || process.env.PORT || 8787);
   const taskDb = getTaskDb();
   const db = taskDb.open();
-  const server = http.createServer((req, res) => {
-    handleTaskApi(req, res, taskDb, db).catch((e) => {
-      sendJson(res, 500, { ok: false, reason: 'server_error', detail: String(e && e.message || e) });
-    });
-  });
+  const server = createTaskApiServer({ taskDb, db });
   return new Promise((resolve, reject) => {
     server.on('error', reject);
     server.listen(port, host, () => {
@@ -12201,6 +12597,9 @@ async function runTaskCommand(args) {
     case 'fail':   return cmdDone([...rest, '--failed']);
     case 'archive': return cmdArchive(rest);
     case 'clear-done': return cmdClearDone(rest);
+    case 'reap-mission-blockers':
+    case 'reap-blockers':
+      return cmdReapMissionBlockers(rest);
     case 'relabel-archived': return cmdRelabelArchived(rest);
     case 'review': return cmdReview(rest);
     case 'reviews':
@@ -12241,7 +12640,7 @@ const MUTATING_TASK_COMMANDS = new Set([
   'continue-work', 'continue', 'chat', 'note', 'say', 'retitle', 'tag', 'tags', 'step',
   'ready', 'result', 'accept', 'landing', 'land-review', 'auto-accept-certified',
   'auto-accept', 'sweep', 'audit', 'certify-verified', 'accept-group', 'revise',
-  'done', 'finish', 'fail', 'archive', 'clear-done', 'relabel-archived', 'review', 'import',
+  'done', 'finish', 'fail', 'archive', 'clear-done', 'reap-mission-blockers', 'reap-blockers', 'relabel-archived', 'review', 'import',
   'setup', 'review-lane-act', 'review-act', 'act-review', 'review-lane-loop',
   'review-loop', 'loop-review', 'review-lane-run', 'review-run', 'run-review',
 ]);
@@ -12257,6 +12656,7 @@ async function run(args) {
 
 module.exports = {
   run,
+  createTaskApiServer,
   taskDayGroups,
   taskDayTextGroups,
   taskDayTitle,
@@ -12265,4 +12665,8 @@ module.exports = {
   delegateTask,
   AGENT_ENV_MARKERS,
   autoRenderTodoFromDb,
+  projectionMissions,
+  projectionWishes,
+  taskBoardViewModel,
+  taskBoardTemplate,
 };