atris 3.37.1 → 3.40.0

package/lib/fleet.js

@@ -24,16 +24,19 @@ const {
 } = require('./brief-ledger');
 const { RUNNER_PROFILE_DEFS, buildRunnerCommand } = require('./runner-command');
 const { resolveDefaultVerifier } = require('./default-verifier');
-const { rankEngines } = require('./router-brain');
+const { rankEnginesDetailed } = require('./router-brain');
 const {
   buildOneLapValidatorPrompt,
   parseOneLapValidatorVerdict,
 } = require('./one-lap-validator');
 const { listWorktrees } = require('../commands/worktree');
+const { isConductorStatusLine } = require('./conductor-artifacts');
+const { matchLessons } = require('./lesson-preflight');
+const { matchTaste } = require('./taste-lessons');
 
 // Lanes a fleet may never staff on its own: the human keeps irreversible
 // calls. Mirrors the autoland denied lanes.
-const DENIED_TAGS = ['billing', 'deploy', 'security', 'customer', 'external', 'feedback'];
+const DENIED_TAGS = ['billing', 'money', 'payments', 'deploy', 'security', 'customer', 'external', 'feedback'];
 
 // ---------------------------------------------------------------------------
 // T1 — dispatch primitive
@@ -93,6 +96,30 @@ function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
     '',
     'Final report (plain text): files changed, test command + result, commit sha (or say the commit failed and why).'
   );
+  const lessonFiles = [
+    ...(Array.isArray(task.files) ? task.files : []),
+    ...(Array.isArray(task.metadata && task.metadata.files) ? task.metadata.files : []),
+    ...fileSurface(task),
+  ];
+  const briefText = lines.join('\n');
+  const preflightRoot = worktreePath || process.cwd();
+  const lessons = matchLessons({
+    briefText,
+    files: lessonFiles,
+    root: preflightRoot,
+  });
+  if (lessons.length) {
+    lines.push('', '## lessons that apply', ...lessons.map((lesson) => `- ${lesson.text}`));
+  }
+  const requestedTasteScope = String(
+    task.scope || (task.metadata && task.metadata.scope) || task.tag || 'any'
+  ).toLowerCase();
+  const taste = matchTaste({ briefText, scope: requestedTasteScope, root: preflightRoot });
+  if (taste.length) {
+    lines.push('', "## the owner's taste", ...taste.map((entry) => (
+      `- The operator's verdict is ${entry.verdict} for "${entry.subject}". The reason is: ${entry.why}`
+    )));
+  }
   return lines.join('\n');
 }
 
@@ -317,6 +344,20 @@ function dispatchResultExitCode(result) {
   return 0;
 }
 
+// A child killed by a signal comes back either with spawnSync's `signal` field
+// set (plain spawn) or a 128+N exit status (the sealed supervisor re-exits 143
+// on SIGTERM). Either way stdout/report and stderr are empty, so name the
+// signal instead of letting the leg read as a silent no-op (CLI-1190: on
+// WEB-455 2026-07-25 the claude engine exited 143/SIGTERM with an empty report
+// and the restaff receipt looked like nothing had happened).
+const SIGNAL_EXIT_NAMES = Object.freeze({ 129: 'SIGHUP', 130: 'SIGINT', 137: 'SIGKILL', 143: 'SIGTERM' });
+function dispatchResultSignal(result) {
+  if (!result || typeof result !== 'object') return null;
+  if (result.signal) return String(result.signal);
+  const code = dispatchResultExitCode(result);
+  return SIGNAL_EXIT_NAMES[code] || null;
+}
+
 function dispatchTaskId(task) {
   return task && (task.display_id || task.task_id || task.id) ? String(task.display_id || task.task_id || task.id) : '';
 }
@@ -364,6 +405,8 @@ function detectDeadEngineDispatch(result) {
   const output = dispatchResultOutput(result).toLowerCase();
   const pattern = DEAD_ENGINE_OUTPUT_PATTERNS.find((p) => output.includes(p));
   if (pattern) return { reason: 'usage_limit', pattern };
+  const signal = dispatchResultSignal(result);
+  if (signal) return { reason: 'signalled', signal, exitCode };
   return { reason: 'nonzero_exit', exitCode };
 }
 
@@ -379,13 +422,18 @@ function installedFleetEngines(root) {
   return normalizeInstalledEngines(roster(root).filter((e) => e.installed));
 }
 
-function rankFleetEngines(engines, root = process.cwd()) {
-  return rankEngines(normalizeInstalledEngines(engines), {
+function rankFleetEnginesDetailed(engines, root = process.cwd(), options = {}) {
+  return rankEnginesDetailed(normalizeInstalledEngines(engines), {
     root,
     taskType: 'executor',
+    lowStakes: options.lowStakes === true,
   });
 }
 
+function rankFleetEngines(engines, root = process.cwd()) {
+  return rankFleetEnginesDetailed(engines, root).candidates;
+}
+
 function nextInstalledFleetEngine(current, { root = process.cwd(), installedEngines = null } = {}) {
   const engines = installedEngines ? normalizeInstalledEngines(installedEngines) : installedFleetEngines(root);
   const currentName = String(current || '').trim();
@@ -406,12 +454,21 @@ function normalizeDispatchResult(result, engineName) {
 }
 
 function failedDispatchLeg(result, engineName) {
-  return {
+  const report = String(result && result.report || '').slice(-2000);
+  const signal = dispatchResultSignal(result);
+  const leg = {
     engine: String(result && result.engine || engineName || ''),
     exitCode: dispatchResultExitCode(result),
     stderr: String(result && result.stderr || '').slice(-2000),
-    report: String(result && result.report || '').slice(-2000),
+    report,
   };
+  if (signal) {
+    // Record that the predecessor was killed; a signalled leg has no report of
+    // its own, so name the signal in place of the empty string (CLI-1190).
+    leg.signal = signal;
+    if (!report) leg.report = `(no report: killed by ${signal})`;
+  }
+  return leg;
 }
 
 async function dispatchEntryWithRestaff({
@@ -535,6 +592,7 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
     brief_id: capturedBriefId || null,
     command,
     exitCode: result.status,
+    signal: result.signal || null,
     report: String(result.stdout || '').slice(-8000),
     stderr: String(result.stderr || '').slice(-2000),
   };
@@ -543,27 +601,30 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
 // ---------------------------------------------------------------------------
 // T2 — staffing
 
+const {
+  taskTagTokens,
+  isDecisionHoldTag,
+  isDecisionTask,
+  DECISION_REFUSE_REASON,
+} = require('./task-decision');
+
 function taskTags(task) {
-  const fromTags = Array.isArray(task.tags) ? task.tags : [];
-  const fromTag = task && task.tag ? [task.tag] : [];
   // Tags added after creation live in metadata.tags (`atris task tag`); a
   // fleet that only read task.tags/title hashtags would ignore an owner-hold
   // flag stamped on a live task and keep restaffing it (CLI-879).
-  const fromMeta = task && task.metadata && Array.isArray(task.metadata.tags) ? task.metadata.tags : [];
-  const fromTitle = (String(task.title || '').match(/#([a-z0-9-]+)/gi) || []).map((t) => t.slice(1));
-  return [...fromTag, ...fromTags, ...fromMeta, ...fromTitle].map((t) => String(t).toLowerCase());
+  return taskTagTokens(task);
 }
 
 // A task flagged for a human decision is never fleet-staffable, whatever its
-// lane. Mirrors the sweep's needs-human hold so both loops agree.
+// lane. Mirrors the sweep's needs-human hold so both loops agree. Also honors
+// the clearer `decision` tag so policy questions stay off autonomous lanes.
 function isHumanHoldTag(tag) {
-  const normalized = String(tag).trim().toLowerCase().replace(/_/g, '-');
-  return normalized === 'needs-human' || normalized === 'needshuman';
+  return isDecisionHoldTag(tag);
 }
 
 function isSafeLane(task) {
+  if (isDecisionTask(task)) return false;
   const tags = taskTags(task);
-  if (tags.some(isHumanHoldTag)) return false;
   return !tags.some((t) => DENIED_TAGS.includes(t));
 }
 
@@ -617,10 +678,41 @@ function assignEngines(staffed, engines) {
 // Land one arrival: rebase onto latest base first; a conflict pauses the
 // landing (never auto-resolve) and reports which files collided so the
 // conductor or a human can take it. `git` is injectable for tests.
+// Ship failures print the cause first (MODULE_NOT_FOUND, command name) and a
+// long node stack after. Tail-only clips hide the cause; keep a head+tail.
+function clipHeadTail(text, { head = 400, tail = 300 } = {}) {
+  const s = String(text || '');
+  if (s.length <= head + tail) return s;
+  return `${s.slice(0, head)}\n...\n${s.slice(-tail)}`;
+}
+
 // Fleet landings always target master. Without the explicit --target, ship
 // falls back to the launcher branch's atris-base — a flight launched from a
 // feature-branch checkout would merge PRs into that branch while the receipt
 // and land board define "landed" as in-master (PRs #207/#208, 2026-07-04).
+// A ship failure must name its real cause. MODULE_NOT_FOUND from the spawned
+// CLI is usually transient: the fleet ships by spawning node against this
+// live checkout, and a concurrent rebase/pull can make a require vanish for a
+// moment. So the ship retries once on that signature, and the failure detail
+// always surfaces the missing-module line from either stream instead of
+// letting head/tail clipping truncate it away (cost measured live: CLI-1185
+// receipts kept only a loader stack tail and the module name was lost).
+function shipWithRetry(cli, args, cwd) {
+  let shipped = cli(args, cwd);
+  if (shipped.status !== 0 && /MODULE_NOT_FOUND|Cannot find module/.test(`${shipped.stderr}${shipped.stdout}`)) {
+    shipped = cli(args, cwd);
+    shipped.retried_module_not_found = true;
+  }
+  return shipped;
+}
+
+function shipFailureDetail(shipped, { head = 400, tail = 300 } = {}) {
+  const combined = `${shipped.stderr || ''}\n${shipped.stdout || ''}`;
+  const moduleLine = combined.match(/Cannot find module '[^']+'[^\n]*/);
+  const cause = moduleLine ? `${moduleLine[0]}${shipped.retried_module_not_found ? ' (persisted after one retry)' : ''}\n` : '';
+  return `${cause}${clipHeadTail(combined.trim(), { head, tail })}`;
+}
+
 function fleetShipArgs(entry, check) {
   return [
     'worktree', 'ship',
@@ -631,19 +723,113 @@ function fleetShipArgs(entry, check) {
   ];
 }
 
+// A fleet build worktree is ephemeral. If any process inside one runs
+// `npm link` (which repoints the global `atris` package symlink at that
+// worktree), then removing the worktree at teardown leaves the global `atris`
+// binary a dangling symlink, and everything resolving `atris` through PATH —
+// interactive shells, any tooling that shells out to the bare command — dies
+// with 'command not found'. Measured scope, not assumed: crons that invoke
+// `node <checkout>/bin/atris.js` by absolute path are UNAFFECTED; an autoland
+// tick ran fine four minutes before the repair. The failure is silent and
+// reads like a shell/PATH problem, not a worktree-cleanup one (found live
+// 2026-07-26, CLI-1193; same shape as the cron PATH wedge that cost 20 days
+// of autoland).
+// Recovery was one line: repoint the global link at the real checkout. So
+// teardown does exactly that on its own: if the global `atris` link points
+// into one of this flight's worktrees, repoint it at the primary checkout and
+// verify the CLI still runs before the flight reports success.
+function defaultReadGlobalCliLink() {
+  const rootResult = spawnSync('npm', ['root', '-g'], { encoding: 'utf8' });
+  if (rootResult.status !== 0) return null;
+  const globalRoot = String(rootResult.stdout || '').trim();
+  if (!globalRoot) return null;
+  const pkgPath = path.join(globalRoot, 'atris');
+  let stat;
+  try {
+    stat = fs.lstatSync(pkgPath);
+  } catch {
+    return null; // atris is not installed globally at all
+  }
+  if (!stat.isSymbolicLink()) return { path: pkgPath, target: null }; // real install, not a link
+  return { path: pkgPath, target: path.resolve(path.dirname(pkgPath), fs.readlinkSync(pkgPath)) };
+}
+
+function defaultRepointGlobalCliLink(primaryCheckout) {
+  // `npm link` from the real checkout re-creates the global symlink pointing at it.
+  return spawnSync('npm', ['link'], { cwd: primaryCheckout, encoding: 'utf8' });
+}
+
+function defaultVerifyCliRuns() {
+  const result = spawnSync('atris', ['--version'], { encoding: 'utf8' });
+  return { ok: result.status === 0, status: result.status, stdout: String(result.stdout || '').trim() };
+}
+
+function guardGlobalCliLink({
+  root = process.cwd(),
+  worktreePaths = [],
+  readGlobalLink = defaultReadGlobalCliLink,
+  repointLink = defaultRepointGlobalCliLink,
+  verifyCli = defaultVerifyCliRuns,
+} = {}) {
+  const link = readGlobalLink();
+  if (!link || !link.target) return { ok: true, changed: false, reason: 'not_linked' };
+  const resolvedTarget = realpathOrResolve(link.target);
+  const worktrees = worktreePaths.filter(Boolean).map((wt) => realpathOrResolve(wt));
+  // Match the raw string so a worktree already removed by ship still matches
+  // (its path is gone from disk but the dangling link still names it).
+  const insideWorktree = worktrees.some((wt) => resolvedTarget === wt || resolvedTarget.startsWith(`${wt}${path.sep}`));
+  if (!insideWorktree) return { ok: true, changed: false, reason: 'healthy', target: link.target };
+  let primaryPath = root;
+  try {
+    primaryPath = listWorktrees(root)[0]?.path || root;
+  } catch {
+    primaryPath = root;
+  }
+  const primary = realpathOrResolve(primaryPath);
+  const repoint = repointLink(primary);
+  const verify = verifyCli();
+  return {
+    ok: Boolean(verify && verify.ok),
+    changed: true,
+    reason: 'linked_into_worktree',
+    was: link.target,
+    restoredTo: primary,
+    repoint: { status: repoint ? repoint.status : null },
+    verify,
+  };
+}
+
+// One-line " (path, path)" suffix naming the files behind a paused landing —
+// unmerged files for a rebase_conflict, uncommitted paths for a dirty_worktree.
+function pausedPathsSuffix(landed) {
+  const paths = (landed && landed.conflicts) || (landed && landed.dirty) || [];
+  return paths.length ? ` (${paths.join(', ')})` : '';
+}
+
 function landArrival({ worktreePath, git = null }) {
   const run = git || ((args) => spawnSync('git', args, { cwd: worktreePath, encoding: 'utf8' }));
   const fetch = run(['fetch', 'origin']);
   if (fetch.status !== 0) return { ok: false, stage: 'fetch', detail: String(fetch.stderr || '').trim() };
   const rebase = run(['rebase', 'origin/master']);
   if (rebase.status !== 0) {
-    const conflicted = run(['diff', '--name-only', '--diff-filter=U']);
+    const conflicts = String(run(['diff', '--name-only', '--diff-filter=U']).stdout || '')
+      .trim().split('\n').filter(Boolean);
     run(['rebase', '--abort']);
-    return {
-      ok: false,
-      stage: 'rebase_conflict',
-      conflicts: String(conflicted.stdout || '').trim().split('\n').filter(Boolean),
-    };
+    // git rebase refuses outright when the worktree has uncommitted changes:
+    // it stops before a single conflict can occur, so the unmerged-file list is
+    // empty. Reporting an empty list as rebase_conflict sends the operator
+    // chasing a merge problem that does not exist while intact work sits
+    // uncommitted in the worktree (CLI-1190; hit live on WEB-455 2026-07-25
+    // after a killed engine left modified/untracked files behind). An empty
+    // conflicts list is never a conflict: name the dirty paths instead.
+    if (!conflicts.length) {
+      const dirty = String(run(['status', '--porcelain']).stdout || '')
+        .split('\n')
+        .map((line) => line.slice(3).trim())
+        .filter(Boolean);
+      return { ok: false, stage: 'dirty_worktree', dirty };
+    }
+    return { ok: false, stage: 'rebase_conflict', conflicts };
   }
   return { ok: true, stage: 'rebased' };
 }
@@ -651,11 +837,15 @@ function landArrival({ worktreePath, git = null }) {
 module.exports = {
   DENIED_TAGS,
   DEAD_ENGINE_OUTPUT_PATTERNS,
+  reviewOnlyEngineEnvironment,
+  shipWithRetry,
+  shipFailureDetail,
   get FLEET_CAPABLE() { return FLEET_CAPABLE; },
   get runFleetFlight() { return runFleetFlight; },
   get focusedCheck() { return focusedCheck; },
   get dispatchCheck() { return dispatchCheck; },
   get runDispatchFlight() { return runDispatchFlight; },
+  get prepareReviewSandbox() { return prepareReviewSandbox; },
   YOLO_ENGINE_FLAGS,
   DISPATCH_SELF_LAND_TARGET,
   parseDoneCheck,
@@ -665,19 +855,22 @@ module.exports = {
   buildEngineCommand,
   isSafeLane,
   taskTags,
-  detectDeadEngineDispatch,
-  rankFleetEngines,
   nextInstalledFleetEngine,
+  rankFleetEnginesDetailed,
   dispatchToEngine,
   taskTags,
   isHumanHoldTag,
+  isDecisionTask,
+  DECISION_REFUSE_REASON,
   isSafeLane,
-  fileSurface,
-  surfacesOverlap,
   staffFlight,
   assignEngines,
   landArrival,
+  detectDeadEngineDispatch,
+  failedDispatchLeg,
   fleetShipArgs,
+  clipHeadTail,
+  guardGlobalCliLink,
   defaultSelfLandCheck,
 };
 
@@ -913,7 +1106,9 @@ function reviewOnlyEngineEnvironment(worktreePath, options = {}) {
     STRIPE_SECRET_KEY: '',
     OPENAI_API_KEY: selectedSecret(['codex'], 'OPENAI_API_KEY'),
     CODEX_API_KEY: selectedSecret(['codex'], 'CODEX_API_KEY'),
-    ANTHROPIC_API_KEY: selectedSecret(['claude'], 'ANTHROPIC_API_KEY'),
+    // owner policy: claude work runs on the subscription login, never API
+    // billing, so the api key is stripped even when the parent env has one.
+    ANTHROPIC_API_KEY: '',
     CLAUDE_CODE_OAUTH_TOKEN: selectedSecret(['claude'], 'CLAUDE_CODE_OAUTH_TOKEN'),
     CURSOR_API_KEY: selectedSecret(['cursor'], 'CURSOR_API_KEY'),
     DEVIN_API_KEY: selectedSecret(['devin'], 'DEVIN_API_KEY'),
@@ -1042,6 +1237,15 @@ function prepareReviewSandbox({ root, taskId, engine }) {
     env: conductorGitEnvironment(),
     timeout: 30000,
   });
+  // `git` walks up to the nearest enclosing repository when `root` is not itself
+  // a git checkout. Without this guard, review-only dispatch would fetch and
+  // trust the origin/master of whatever repo happens to sit above `root`, and
+  // build against it. Refuse unless `root` is its own git top level.
+  const toplevel = runConductorGit(['rev-parse', '--show-toplevel']);
+  if (toplevel.status !== 0
+    || realpathOrResolve(String(toplevel.stdout || '').trim()) !== realpathOrResolve(root)) {
+    return { ok: false, detail: 'review-only dispatch requires the workspace to be its own git repository' };
+  }
   const fetched = runConductorGit(['fetch', 'origin', 'master']);
   const original = runConductorGit(['remote', 'get-url', 'origin']);
   const base = run(['rev-parse', '--verify', 'origin/master^{commit}']);
@@ -1213,9 +1417,8 @@ function reviewCandidateSnapshot(boundary, expected = null) {
   const repeatedCommit = String(secondHead.stdout || '').trim();
   const treeOid = String(tree.stdout || '').trim();
   if (commit !== repeatedCommit) return fail('the executor changed HEAD while its candidate was being frozen');
-  const conductorEntry = /^\?\? \.atris\/(?:agent-worktree\.json|state\/briefs\.jsonl)$/;
   const dirty = String(status.stdout || '').trim().split(/\r?\n/).filter(Boolean)
-    .filter((line) => !conductorEntry.test(line));
+    .filter((line) => !isConductorStatusLine(line));
   if (dirty.length) return fail(`the executor left uncommitted changes: ${dirty.slice(0, 10).join(', ')}`);
   if (expected && (commit !== expected.commit || treeOid !== expected.tree)) {
     return fail('the sealed candidate changed after the executor exited', { commit, tree: treeOid });
@@ -1415,8 +1618,7 @@ function importReviewCommit(boundary, { cli, taskId, engine, expectedCommit = ''
   const status = runSandbox(['status', '--porcelain=v1', '--untracked-files=all']);
   if (status.status !== 0) return fail('review_import', status.stderr || 'could not inspect the sealed sandbox');
   const dirtyEntries = String(status.stdout || '').trim().split(/\r?\n/).filter(Boolean);
-  const conductorEntries = /^\?\? \.atris\/(?:agent-worktree\.json|fleet-prompt-[^/]+\.md|runtime-tmp(?:\/.*)?|state\/briefs\.jsonl)$/;
-  const uncommitted = dirtyEntries.filter((line) => !conductorEntries.test(line));
+  const uncommitted = dirtyEntries.filter((line) => !isConductorStatusLine(line));
   if (uncommitted.length) return fail('uncommitted_change', `the sealed executor must commit every requested change before Review: ${uncommitted.join(', ')}`);
   const headOid = expectedCommit;
   if (headOid === boundary.baseOid) return fail('no_change', 'the executor produced no committed change');
@@ -1543,9 +1745,12 @@ function inspectReviewChange(worktreePath, baseRef = 'origin/master') {
       detail: String(status.stderr || 'could not inspect worktree changes').trim(),
     };
   }
-  const conductorEntry = /^\?\? \.atris\/(?:agent-worktree\.json|state\/briefs\.jsonl)$/;
+  // Conductor plumbing is not engine output. Counting it as a change is what let a
+  // flight report "landed" for an engine that said "nothing to commit": the fleet's
+  // own prompt file registered as dirt, has_change went true, and the no_change
+  // pause never fired.
   const dirty = String(status.stdout || '').trim().split('\n').filter(Boolean)
-    .filter((line) => !conductorEntry.test(line));
+    .filter((line) => !isConductorStatusLine(line));
   const hasCommittedDiff = committed.status === 1;
   return {
     has_change: hasCommittedDiff || dirty.length > 0,
@@ -1932,18 +2137,29 @@ async function runFleetFlight({
   ownCli = null,
   dispatcher = null,
   lander = null,
+  rebase = null,
   checkoutBase = 'origin/master',
+  guardCliLink = guardGlobalCliLink,
 } = {}) {
   const cli = ownCli || defaultOwnCli(root);
-  const roster = engines || (() => {
+  // Staff first, rank second: every task staffFlight returns already cleared
+  // the safe-lane filter (not a decision row, no denied tags), so the rank
+  // that pairs engines to those tasks is low stakes and the stretch zone
+  // rule may trade the strongest engine for the cheapest learnable one.
+  // Protected or denied work never reaches staffFlight's output, so it never
+  // gets the flag; when nothing is staffed there is no task to rank for and
+  // the flag stays off.
+  const staffedTasks = staffFlight(readProjectionTasks(root), { slots });
+  const rosterDetail = engines ? null : (() => {
     const { roster: fullRoster } = require('../commands/engine');
     const installed = fullRoster(root)
       .filter((e) => e.installed && FLEET_CAPABLE.includes(e.name))
       .map((e) => e.name);
-    return rankFleetEngines(installed, root);
+    return rankFleetEnginesDetailed(installed, root, { lowStakes: staffedTasks.length > 0 });
   })();
+  const roster = engines || rosterDetail.candidates;
 
-  const staffed = assignEngines(staffFlight(readProjectionTasks(root), { slots }), roster);
+  const staffed = assignEngines(staffedTasks, roster);
   // The receipt path is decided BEFORE landings so each task's ready-proof
   // can cite it — the proof policy certifies receipt-backed proofs agent-side.
   const receiptPath = path.join(root, 'atris', 'runs', `fleet-${nowStamp()}.json`);
@@ -1953,10 +2169,14 @@ async function runFleetFlight({
     slots,
     roster,
     staffed: staffed.map((s) => ({ task: s.task.display_id, title: String(s.task.title || '').slice(0, 140), engine: s.engine, surface: s.surface })),
+    stretch_zone_pick: rosterDetail && rosterDetail.stretch_zone_pick ? rosterDetail.stretch_zone_pick : null,
     results: [],
     landed: [],
     paused: [],
   };
+  if (flight.stretch_zone_pick) {
+    flight.stretch_zone_note = `low-stakes staffing picked ${flight.stretch_zone_pick} from the stretch zone: the cheapest engine with a learnable track record won this lane.`;
+  }
 
   log('');
   log(`  fleet — ${roster.length} engine${roster.length === 1 ? '' : 's'} ready, ${staffed.length} task${staffed.length === 1 ? '' : 's'} staffed`);
@@ -2021,13 +2241,14 @@ async function runFleetFlight({
   });
 
   // Land serially: rebase-before-ship, conflict pauses (never auto-resolve).
+  const rebaseArrival = rebase || landArrival;
   const land = lander || (({ entry }) => {
-    const rebased = landArrival({ worktreePath: entry.worktreePath });
+    const rebased = rebaseArrival({ worktreePath: entry.worktreePath });
     if (!rebased.ok) return rebased;
     const check = focusedCheck(entry.task) || 'git log -1 --oneline';
-    const shipped = cli(fleetShipArgs(entry, check), entry.worktreePath);
+    const shipped = shipWithRetry(cli, fleetShipArgs(entry, check), entry.worktreePath);
     if (shipped.status !== 0 || !/done: worktree shipped/.test(shipped.stdout)) {
-      return { ok: false, stage: 'ship', detail: (shipped.stderr || shipped.stdout).slice(-300) };
+      return { ok: false, stage: 'ship', detail: shipFailureDetail(shipped, { head: 400, tail: 300 }) };
     }
     return { ok: true, stage: 'shipped' };
   });
@@ -2064,10 +2285,22 @@ async function runFleetFlight({
     } else {
       flight.paused.push({ task: entry.task.display_id, engine: activeEngine, ...(result.restaffed ? { restaffed: result.restaffed } : {}), ...landed });
       stampDispatchBrief(root, result.brief_id, 'partial', `paused ${entry.task.display_id} at ${landed.stage || 'landing'}`);
-      log(`    ${activeEngine.padEnd(8)} ⏸ paused ${entry.task.display_id} at ${landed.stage}${landed.conflicts ? ` (${landed.conflicts.join(', ')})` : ''} — worktree kept`);
+      log(`    ${activeEngine.padEnd(8)} ⏸ paused ${entry.task.display_id} at ${landed.stage}${pausedPathsSuffix(landed)} — worktree kept`);
     }
   }
 
+  // Teardown guard: a build worktree may have run `npm link` and hijacked the
+  // global `atris`. Before reporting success, make sure this flight did not
+  // leave the global CLI pointed into one of its own worktrees.
+  const flightWorktrees = prepared.map((entry) => entry.worktreePath).filter(Boolean);
+  const cliLink = guardCliLink({ root, worktreePaths: flightWorktrees });
+  flight.cli_link = cliLink;
+  if (cliLink.changed) {
+    log(cliLink.ok
+      ? `  restored global atris link (was ${cliLink.reason}); repointed at ${path.relative(root, cliLink.restoredTo) || cliLink.restoredTo} and the cli runs`
+      : `  alert: global atris link was ${cliLink.reason}; repoint attempted at ${cliLink.restoredTo} but the cli still fails, so every cron/loop/mission is down`);
+  }
+
   fs.mkdirSync(path.dirname(receiptPath), { recursive: true });
   flight.receipt = receiptPath;
   fs.writeFileSync(flight.receipt, `${JSON.stringify(flight, null, 2)}\n`);
@@ -2351,9 +2584,9 @@ async function runDispatchFlight({
         change,
       };
     }
-    const shipped = cli(fleetShipArgs({ task: entry.task, engine: entry.engine || engine }, check), entry.worktreePath);
+    const shipped = shipWithRetry(cli, fleetShipArgs({ task: entry.task, engine: entry.engine || engine }, check), entry.worktreePath);
     if (shipped.status !== 0 || !/done: worktree shipped/.test(shipped.stdout)) {
-      return { ok: false, stage: 'ship', detail: (shipped.stderr || shipped.stdout).slice(-500) };
+      return { ok: false, stage: 'ship', detail: shipFailureDetail(shipped, { head: 400, tail: 500 }) };
     }
     return {
       ok: true,
@@ -2736,7 +2969,7 @@ async function runDispatchFlight({
         ...landed,
       });
       stampDispatchBrief(root, result.brief_id, 'partial', `paused ${entry.taskId} at ${landed.stage || 'landing'}`);
-      log(`    ⏸ paused ${entry.taskId} at ${landed.stage}${landed.conflicts ? ` (${landed.conflicts.join(', ')})` : ''} — worktree kept`);
+      log(`    ⏸ paused ${entry.taskId} at ${landed.stage}${pausedPathsSuffix(landed)} — worktree kept`);
     }
   }
 

package/lib/functional-owner.js

@@ -179,11 +179,8 @@ function resolveFunctionalOwner({ requestedOwner, title, tag, note, goal, root,
 }
 
 module.exports = {
-  ENGINE_OWNER_IDS,
   FUNCTIONAL_MEMBER_TOPICS,
   normalizeOwnerSlug,
-  isEngineOwner,
   listWorkspaceMemberSlugs,
-  proposedMemberSlugFromTask,
   resolveFunctionalOwner,
 };

package/lib/git-spawn.js

@@ -0,0 +1,15 @@
+'use strict';
+
+const { spawnSync } = require('child_process');
+
+// One synchronous git runner for commands that shell out to git.
+// check: true throws on a non-zero exit; check: false hands back the raw result.
+function runGit(args, { cwd = process.cwd(), check = true, maxBuffer } = {}) {
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8', ...(maxBuffer ? { maxBuffer } : {}) });
+  if (check && result.status !== 0) {
+    throw new Error(`git ${args.join(' ')} failed: ${(result.stderr || result.stdout || '').trim()}`);
+  }
+  return result;
+}
+
+module.exports = { runGit };

package/lib/inspect-fields.js

@@ -168,7 +168,6 @@ module.exports = {
   missionAckInspectValue,
   missionPingsInspectValue,
   missionInspectFieldValues,
-  formatInspectFieldText,
   inspectTextLines,
   buildInspectPayload,
 };

package/lib/json-file.js

@@ -0,0 +1,37 @@
+// Shared JSON file read/write so every call site fails the same way.
+//
+// Bare `JSON.parse(fs.readFileSync(...))` drifted across commands: some sites
+// caught, some returned null, some returned {}. These two helpers keep the
+// tolerant shape in one place.
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Read and parse a JSON file, returning `fallback` when it is missing or corrupt.
+ * @param {string} filePath
+ * @param {*} [fallback=null]
+ * @returns {*}
+ */
+function readJson(filePath, fallback = null) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  } catch {
+    return fallback;
+  }
+}
+
+/**
+ * Write a value as pretty JSON with a trailing newline, creating parent dirs.
+ * @param {string} filePath
+ * @param {*} value
+ * @param {{ indent?: number }} [options]
+ * @returns {string} the path written
+ */
+function writeJson(filePath, value, { indent = 2 } = {}) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(value, null, indent) + '\n', 'utf8');
+  return filePath;
+}
+
+module.exports = { readJson, writeJson };

package/lib/known-commands.js

@@ -2,8 +2,8 @@
 
 const knownCommands = ['init', 'log', 'logs', 'wish', 'drill', 'dream', 'now', 'goal', 'wtf', 'orb', 'radar', 'stream', 'ctop', 'launchpad', 'status', 'analytics', 'visualize', 'brain', 'brainstorm', 'autopilot', 'run', '_start', 'plan', 'do', 'review', 'release',
                        'activate', '_activate', 'agent', 'team', 'chat', 'fast', 'ax', 'console', 'serve', 'login', 'logout', 'whoami', 'switch', 'use', 'accounts', '_resolve', '_profile-email', '_switch-session', 'shell-init', 'update', 'upgrade', 'version', 'help', 'next', 'atris',
-                       'clean', 'close', 'harvest', 'verify', 'search', 'scout', 'skill', 'member', 'codex-goal', 'app', 'apps', 'learn', 'lesson', 'plugin', 'experiments', 'bench', 'receipt', 'proof', 'openclaw', 'pull', 'push', 'watch', 'cloud', 'live', 'align', 'terminal', 'computer', 'diff', 'business', 'sync', 'youtube',
-                       'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'agents', 'probe', 'worktree', 'land', 'autoland', 'drive', 'aeo', 'slop', 'strings', 'write', 'security-review', 'secure', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'study', 'rainmaker', 'xp', 'play', 'gm', 'x', 'recap', 'report', 'signup', 'clarity', 'interview', 'meet', 'moves', 'unknowns', 'avail',
+                       'clean', 'close', 'harvest', 'verify', 'recover', 'search', 'scout', 'skill', 'member', 'codex-goal', 'app', 'apps', 'learn', 'lesson', 'taste', 'teach', 'plugin', 'experiments', 'bench', 'router', 'receipt', 'proof', 'openclaw', 'pull', 'push', 'watch', 'cloud', 'live', 'align', 'terminal', 'computer', 'diff', 'business', 'sync', 'youtube',
+                       'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'decide', 'agents', 'probe', 'worktree', 'land', 'autoland', 'drive', 'aeo', 'slop', 'voice', 'strings', 'write', 'security-review', 'secure', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'study', 'rainmaker', 'xp', 'play', 'gm', 'game', 'x', 'recap', 'report', 'signup', 'clarity', 'interview', 'meet', 'moves', 'unknowns', 'avail', 'sync-checkout',
                        'github', 'vercel', 'supabase', 'linear', 'stripe', 'gmail', 'calendar', 'twitter', 'slack', 'imessage', 'integrations', 'setup', 'clean-workspace', 'cw',
                        'fork', 'browse', 'publish', 'pack', 'sleep', 'wake', 'feedback', 'errors', 'wiki', 'code-review', 'cr', 'soul', 'fleet', 'fleet-report', 'loops', 'self-improve', 'compile', 'spaceship', 'truth', 'sign', 'engine', 'engines', 'feed', 'brief'];
 

package/lib/learnings.js

@@ -222,8 +222,6 @@ function exportMarkdown() {
 module.exports = {
   TYPES,
   SOURCES,
-  getLearningsPath,
-  ensureLearningsFile,
   effectiveConfidence,
   loadLearnings,
   addLearning,