atris 3.37.1 → 3.40.0

package/commands/mission.js

@@ -5,6 +5,7 @@ const path = require('path');
 const crypto = require('crypto');
 const readline = require('readline');
 const { spawn, spawnSync } = require('child_process');
+const { hasFlag, readFlag, readIntFlag } = require('../lib/arg-parser');
 const {
   appendBriefRecord,
   stampBriefOutcome,
@@ -78,6 +79,16 @@ const {
   resolveDefaultVerifier,
 } = require('../lib/default-verifier');
 const { redirectToWorkspaceRoot } = require('../lib/mission-root');
+const { readJson, writeJson } = require('../lib/json-file');
+const {
+  normalizeHumanAsks,
+  openHumanAsks,
+} = require('../lib/mission-human-asks');
+const {
+  inspectMissionProtectedDiff,
+  prepareMissionGitGuard,
+  unreadableMissionGuard,
+} = require('../lib/mission-protected-lane');
 
 const VALID_STATUSES = new Set(['planning', 'running', 'ready', 'paused', 'blocked', 'stopped', 'complete']);
 const TERMINAL_STATUSES = new Set(['stopped', 'complete']);
@@ -313,28 +324,6 @@ function readMissionRouteProposal(args, asJson) {
   };
 }
 
-function hasFlag(args, name) {
-  return args.includes(name);
-}
-
-function unquote(value) {
-  const text = String(value);
-  if ((text.startsWith('"') && text.endsWith('"')) || (text.startsWith("'") && text.endsWith("'"))) {
-    return text.slice(1, -1);
-  }
-  return text;
-}
-
-function readFlag(args, name, fallback = '') {
-  const prefix = `${name}=`;
-  for (let i = 0; i < args.length; i += 1) {
-    const arg = String(args[i]);
-    if (arg === name && args[i + 1] && !String(args[i + 1]).startsWith('--')) return unquote(args[i + 1]);
-    if (arg.startsWith(prefix)) return unquote(arg.slice(prefix.length));
-  }
-  return fallback;
-}
-
 const MISSION_NATIVE_RUNNER_NAMES = Object.freeze(['manual', 'claude', 'atris2', 'codex_goal', 'caller_session', 'current_agent', 'drill']);
 const MISSION_NATIVE_RUNNER_SET = new Set(MISSION_NATIVE_RUNNER_NAMES);
 const MISSION_AUTO_RUNNER = 'auto';
@@ -508,11 +497,11 @@ function readRepeatedFlag(args, name) {
   for (let i = 0; i < args.length; i += 1) {
     const arg = String(args[i]);
     if (arg === name && args[i + 1] && !String(args[i + 1]).startsWith('--')) {
-      values.push(unquote(args[i + 1]));
+      values.push(readFlag([name, args[i + 1]], name, ''));
       i += 1;
       continue;
     }
-    if (arg.startsWith(prefix)) values.push(unquote(arg.slice(prefix.length)));
+    if (arg.startsWith(prefix)) values.push(readFlag([arg], name, ''));
   }
   return values.filter(Boolean);
 }
@@ -734,8 +723,7 @@ function loadTaskDb(asJson = false) {
 function writeMissionTaskProjection(taskDb, db, workspaceRoot) {
   const projection = taskDb.taskProjection(db, { workspaceRoot, limit: 500 });
   const outPath = path.join(workspaceRoot, '.atris', 'state', 'tasks.projection.json');
-  fs.mkdirSync(path.dirname(outPath), { recursive: true });
-  fs.writeFileSync(outPath, JSON.stringify(projection, null, 2) + '\n', 'utf8');
+  writeJson(outPath, projection);
   return { projection, outPath };
 }
 
@@ -834,16 +822,13 @@ function statePaths(root = process.cwd()) {
 
 function readBusinessBinding(root = process.cwd()) {
   const file = path.join(root, '.atris', 'business.json');
-  try {
-    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
-    return {
-      business_id: parsed.business_id || '',
-      workspace_id: parsed.workspace_id || '',
-      slug: parsed.slug || '',
-    };
-  } catch {
-    return null;
-  }
+  const parsed = readJson(file);
+  if (parsed == null) return null;
+  return {
+    business_id: parsed.business_id || '',
+    workspace_id: parsed.workspace_id || '',
+    slug: parsed.slug || '',
+  };
 }
 
 function businessIdForAtris2Mission(mission, cwd = process.cwd()) {
@@ -930,9 +915,11 @@ function terminalNextAction(status) {
 
 function normalizeMissionState(mission) {
   if (!mission) return mission;
-  let normalized = mission;
-  const nextAction = terminalNextAction(mission.status);
-  if (nextAction && mission.next_action !== nextAction) {
+  let normalized = Array.isArray(mission.human_asks)
+    ? { ...mission, human_asks: normalizeHumanAsks(mission.human_asks) }
+    : mission;
+  const nextAction = terminalNextAction(normalized.status);
+  if (nextAction && normalized.next_action !== nextAction) {
     normalized = { ...normalized, next_action: nextAction };
   }
   const effectiveVerifier = effectiveMissionVerifier(normalized);
@@ -1519,9 +1506,10 @@ function renderMemberNowMarkdown(owner, missions, root = process.cwd()) {
     if (mission.stop_condition) lines.push(`- stop: ${mission.stop_condition}`);
     if (budgetContinuation || mission.next_action) lines.push(`- next: ${budgetContinuation || mission.next_action}`);
     if (mission.receipt_path) lines.push(`- proof: ${missionStatusProofText(mission)}`);
-    if (mission.human_asks?.length) {
+    const humanAsks = openHumanAsks(mission.human_asks);
+    if (humanAsks.length) {
       lines.push('- human asks:');
-      for (const ask of mission.human_asks) lines.push(`  - ${ask}`);
+      for (const ask of humanAsks) lines.push(`  - ${ask.text}`);
     }
     lines.push('');
   }
@@ -1697,6 +1685,16 @@ function missionLastStepSummary(ticks = []) {
   return '';
 }
 
+function verifierElapsedSeconds(verifierResult) {
+  const ms = Number(verifierResult && verifierResult.elapsed_ms);
+  return Number.isFinite(ms) ? Math.round(ms / 1000) : 0;
+}
+
+function verifierTimeoutSeconds(verifierResult) {
+  const ms = Number(verifierResult && verifierResult.timeout_ms);
+  return Number.isFinite(ms) ? Math.round(ms / 1000) : 0;
+}
+
 function missionVerifierCheckedText(verifierResult, mission) {
   if (!verifierResult) return 'UNVERIFIED: tick recorded but nothing was checked; treat this increment as unproven.';
   if (verifierResult.mode === 'engine-unavailable') {
@@ -1708,6 +1706,9 @@ function missionVerifierCheckedText(verifierResult, mission) {
       : 'VERIFY FAILED: the engine verify pass did not end with VERDICT: PASS.';
   }
   const command = verifierResult.command || mission.verifier || 'configured verifier';
+  if (!verifierResult.passed && verifierResult.timed_out) {
+    return `VERIFY TIMED OUT: the check ran past its ${verifierTimeoutSeconds(verifierResult)}s window (took ${verifierElapsedSeconds(verifierResult)}s); the code is not failing, the suite is slow. Rerun with more room.`;
+  }
   if (verifierResult.passed) {
     if (/^git\s+diff\s+--check\b/i.test(command)) return 'I ran the diff cleanliness check.';
     if (/\bnode\s+--test\b/i.test(command)) return 'I ran the behavior checks.';
@@ -1716,7 +1717,7 @@ function missionVerifierCheckedText(verifierResult, mission) {
     if (/(?:node\s+\S*atris\.js|\batris)\s+drill\b/i.test(command)) return 'I ran the no-model end-to-end workflow drill.';
     return `Verifier passed: ${command}.`;
   }
-  if (/^git\s+diff\s+--check\b/i.test(command)) return 'VERIFY FAILED: diff cleanliness check failed.';
+  if (/^git\s+diff\s+--check\b/i.test(command)) return 'VERIFY FAILED: diff cleanliness check failed. Trailing whitespace in markdown is auto-fixable: npm run audit:markdown-whitespace -- --fix';
   if (/\bnode\s+--test\b/i.test(command)) return 'VERIFY FAILED: behavior checks failed.';
   return `VERIFY FAILED: ${command}.`;
 }
@@ -1732,9 +1733,13 @@ function missionVerifierHighLevelTestText(verifierResult, mission) {
       : 'The verify engine did not provide a passing changed-surface verdict.';
   }
   const command = verifierResult.command || mission.verifier || 'configured verifier';
+  if (!verifierResult.passed && verifierResult.timed_out) {
+    return `Verifier command timed out after ${verifierElapsedSeconds(verifierResult)}s against a ${verifierTimeoutSeconds(verifierResult)}s window: ${command}. No pass/fail verdict was reached; the suite outran the window rather than the code failing.`;
+  }
   const outcome = verifierResult.passed ? 'passed' : 'failed';
   if (/^git\s+diff\s+--check\b/i.test(command)) {
-    return `Diff cleanliness check ${outcome}: no whitespace or patch-format issues in the changed files.`;
+    if (verifierResult.passed) return `Diff cleanliness check passed: no whitespace or patch-format issues in the changed files.`;
+    return `Diff cleanliness check ${outcome}: whitespace or patch-format issues in the changed files. Trailing whitespace in markdown is auto-fixable: npm run audit:markdown-whitespace -- --fix`;
   }
   if (/\bnode\s+--test\b/i.test(command) && /\btest\/mission-status\.test\.js\b/i.test(command)) {
     return `Mission behavior checks ${outcome}: mission start, tick, completion, timeline landing, goal-chain, next-mission, and human-accept boundaries were exercised.`;
@@ -1964,12 +1969,22 @@ function shouldMissionRunTrustedRoom(rawObjective, args = []) {
   return missionRunTrustedRoomSignals(rawObjective);
 }
 
+const MISSION_BARE_COMMAND_WORDS = new Set(['go', 'keep', 'going', 'do', 'it', 'start', 'run', 'continue']);
+
+function missionObjectiveIsJunk(value) {
+  const objective = String(value || '').trim();
+  if (!objective || objective.startsWith('-')) return true;
+  if (/[\u0000-\u001f\u007f-\u009f\ufffd]/u.test(objective)) return true;
+  if (objective.replace(/\s/g, '').length < 8) return true;
+  const words = objective.toLowerCase().match(/[a-z]+/g) || [];
+  return words.length > 0
+    && objective.replace(/[^a-z]+/gi, '').length > 0
+    && words.every((word) => MISSION_BARE_COMMAND_WORDS.has(word));
+}
+
 function missionRunConcreteTitle(value) {
   const title = String(value || '').replace(/\s+/g, ' ').trim();
-  if (!title) return '';
-  if (/^(go|go go|go go go|keep going|do it|start|run|continue)$/i.test(title)) return '';
-  if (title.length < 8) return '';
-  return title;
+  return missionObjectiveIsJunk(title) ? '' : title;
 }
 
 function selectMissionRunUsefulTarget(rawObjective, root = process.cwd()) {
@@ -2207,6 +2222,9 @@ function missionFullBudgetRemainingSeconds(mission, nowMs = Date.now()) {
 }
 
 function missionBudgetContinuationText(mission, nowMs = Date.now()) {
+  // Paused/stopped/blocked missions are not running: never sell remaining time
+  // as a live commitment (CLI-1192: paused overnight loops read as healthy).
+  if (!GOAL_LOOP_STATUSES.has(String(mission?.status || ''))) return null;
   const remaining = missionFullBudgetRemainingSeconds(mission, nowMs);
   if (remaining <= 0) return null;
   const budget = String(mission?.budget_contract?.budget_label || 'promised time').trim();
@@ -2218,10 +2236,15 @@ function missionBudgetContinuationText(mission, nowMs = Date.now()) {
 }
 
 function missionHumanStatusText(mission, nowMs = Date.now()) {
+  const rawStatus = String(mission?.status || 'unknown');
+  if (rawStatus === 'paused') {
+    const reason = String(mission?.stop_reason || mission?.pause_reason || '').trim();
+    return gateForHuman(reason ? `paused: ${reason}` : 'paused').text;
+  }
   const continuation = missionBudgetContinuationText(mission, nowMs);
   const status = continuation
     ? `working for the full ${String(mission?.budget_contract?.budget_label || 'promised time').trim()}`
-    : String(mission?.status || 'unknown');
+    : rawStatus;
   return gateForHuman(status).text;
 }
 
@@ -2941,12 +2964,8 @@ function handledContinuationTargetKeys(root, moves) {
 
 function readTaskProjectionForMission(root = process.cwd()) {
   const file = path.join(root, '.atris', 'state', 'tasks.projection.json');
-  try {
-    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
-    return Array.isArray(parsed?.tasks) ? parsed.tasks : [];
-  } catch {
-    return [];
-  }
+  const parsed = readJson(file);
+  return Array.isArray(parsed?.tasks) ? parsed.tasks : [];
 }
 
 function taskTags(task) {
@@ -3328,8 +3347,7 @@ function readRecentTasteLogs(root, owner, limit = 3) {
 
 function readTasteReviewHistory(root, limit = 4) {
   const file = path.join(root, '.atris', 'state', 'tasks.projection.json');
-  let projection = null;
-  try { projection = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { projection = null; }
+  const projection = readJson(file);
   const tasks = Array.isArray(projection?.tasks) ? projection.tasks : [];
   const accepted = [];
   const revised = [];
@@ -3852,16 +3870,15 @@ function findActiveTwinMission(objective, owner, root = process.cwd()) {
 function startMission(args, options = {}) {
   const asJson = wantsJson(args);
   const firstArg = String(args[0] || '').trim().toLowerCase();
-  if (hasFlag(args, '--help') || hasFlag(args, '-h') || firstArg === 'help') {
+  if (args.length === 1 && (firstArg === '--help' || firstArg === '-h' || firstArg === 'help')) {
     console.log('Usage: atris mission start "<objective>" --owner <member> --verify "..." [--destination "..."] [--no-verify] [--always-on] [--budget quick|long|deep] [--runner manual|claude|atris2|codex_goal|auto]');
     console.log('Run `atris mission --help` for the full option list.');
     process.exit(0);
   }
   let mission = applyMissionStartPatch(missionFromArgs(args), options.missionPatch);
-  // A flag-looking or empty objective is a typo, not a mission.
   const rawObjective = String(mission.objective || '').trim();
-  if (!rawObjective || rawObjective.startsWith('-')) {
-    exitMissionError(`mission start needs a quoted objective (got ${rawObjective ? `"${rawObjective}"` : 'nothing'}). Usage: atris mission start "<objective>" --owner <member>`, 1, asJson);
+  if (missionObjectiveIsJunk(rawObjective)) {
+    exitMissionError(`mission start refused junk objective: ${rawObjective ? `"${rawObjective}"` : 'nothing'}`, 1, asJson);
   }
   // Pasting a mission id where an objective goes is an id mismatch, not a new
   // mission: recover the existing record or explain where it actually lives.
@@ -4251,6 +4268,11 @@ async function startMissionFromRunObjective(objective, args) {
 
 function attachMissionTask(args) {
   const asJson = wantsJson(args);
+  if (hasFlag(args, '--help') || hasFlag(args, '-h') || String(args[0] || '').trim() === 'help') {
+    console.log('Usage: atris mission attach-task <id> [--json]');
+    console.log('Run `atris mission --help` for the full option list.');
+    process.exit(0);
+  }
   const ref = stripKnownFlags(args, [], ['--json'])[0] || '';
   if (!ref) {
     exitMissionError('Usage: atris mission attach-task <id> [--json]', 1, asJson);
@@ -4695,11 +4717,7 @@ function statusMission(args) {
 function readMissionReceipt(receiptPath, root = process.cwd()) {
   if (!receiptPath) return null;
   const file = path.isAbsolute(receiptPath) ? receiptPath : path.join(root, receiptPath);
-  try {
-    return JSON.parse(fs.readFileSync(file, 'utf8'));
-  } catch {
-    return null;
-  }
+  return readJson(file);
 }
 
 function firstUsefulLine(text, fallback = '') {
@@ -4824,12 +4842,7 @@ function missionVerificationDebt(mission, root = process.cwd()) {
   let unchecked = 0;
   const seen = new Set();
   for (const file of files) {
-    let receipt = null;
-    try {
-      receipt = JSON.parse(fs.readFileSync(file, 'utf8'));
-    } catch {
-      continue;
-    }
+    const receipt = readJson(file);
     if (!receipt || receipt.mission_id !== mission.id) continue;
     for (const tick of missionReceiptTicks(receipt)) {
       if (!tick || tick.status !== 'ran') continue;
@@ -4866,12 +4879,7 @@ function missionReportTimeline(mission, root = process.cwd(), limit = 6) {
   const items = [];
   const seen = new Set();
   for (const file of files) {
-    let receipt = null;
-    try {
-      receipt = JSON.parse(fs.readFileSync(file, 'utf8'));
-    } catch {
-      continue;
-    }
+    const receipt = readJson(file);
     if (!receipt || receipt.mission_id !== mission.id) continue;
     const receiptPath = path.relative(root, file);
     for (const tick of missionReceiptTicks(receipt)) {
@@ -4914,12 +4922,7 @@ function missionLandingTimeline(mission, root = process.cwd(), limit = 12, { kin
   const items = [];
   const seen = new Set();
   for (const file of files) {
-    let receipt = null;
-    try {
-      receipt = JSON.parse(fs.readFileSync(file, 'utf8'));
-    } catch {
-      continue;
-    }
+    const receipt = readJson(file);
     if (!receipt || receipt.mission_id !== mission.id) continue;
     const receiptKind = receipt.result && receipt.result.kind ? String(receipt.result.kind) : (receipt.kind ? String(receipt.kind) : '');
     if (kindFilter && receiptKind !== kindFilter) continue;
@@ -5148,12 +5151,24 @@ function missionReportFor(mission, root = process.cwd()) {
   const timeline = missionReportTimeline(mission, root);
   const verificationDebt = missionVerificationDebt(mission, root);
   const workerCheckedIn = Boolean(explicitWorkerReceipt) || timeline.length > 0;
+  const driver = missionDriverHealth(mission, root);
+  const driverAlive = Boolean(driver && driver.alive);
   const workerReceiptPath = mission.worker_receipt_path || (receipt && verifierReceiptPath) || null;
   const verifierPassed = mission.verifier_result && mission.verifier_result.passed === true;
   const pendingBudgetContinuation = missionBudgetContinuationText(mission);
   const budgetContinuation = workerCheckedIn ? pendingBudgetContinuation : null;
-  const operatorOutcome = !workerCheckedIn && pendingBudgetContinuation
+  const awaitingFirstWorker = !workerCheckedIn && Boolean(pendingBudgetContinuation);
+  // An active status implies a worker is running. With no receipt AND no live
+  // driver, that claim is a lie: report that no worker is running and name the
+  // command that starts one instead of saying the mission is in progress.
+  const noLiveWorker = !workerCheckedIn
+    && !driverAlive
+    && !pendingBudgetContinuation
+    && GOAL_LOOP_STATUSES.has(String(mission.status || ''));
+  const operatorOutcome = awaitingFirstWorker
     ? 'No worker has checked in yet.'
+    : noLiveWorker
+    ? 'No worker is running; nothing has produced a receipt yet.'
     : budgetContinuation
     ? 'The last verifier passed; full-budget work is continuing.'
     : mission.operator_outcome
@@ -5162,8 +5177,10 @@ function missionReportFor(mission, root = process.cwd()) {
     id: mission.id,
     objective: mission.objective,
     status: mission.status,
-    human_status: !workerCheckedIn && pendingBudgetContinuation
+    human_status: awaitingFirstWorker
       ? 'waiting for the first worker check-in'
+      : noLiveWorker
+      ? 'no live worker (nothing is running)'
       : missionHumanStatusText(mission),
     budget_continuation: budgetContinuation,
     operator_outcome: operatorOutcome,
@@ -5175,9 +5192,10 @@ function missionReportFor(mission, root = process.cwd()) {
     verifier_receipt_path: verifierReceiptPath,
     proof_text: mission.receipt_path ? missionStatusProofText(mission) : null,
     operator_next: budgetContinuation
-      || (!workerCheckedIn && pendingBudgetContinuation ? 'Wait for the first worker check-in.' : null)
+      || (awaitingFirstWorker ? 'Wait for the first worker check-in.' : null)
       || mission.operator_next
       || mission.next_action
+      || (noLiveWorker ? `Start a worker: atris mission run ${mission.id}` : null)
       || 'Review the mission state.',
   };
 }
@@ -5254,14 +5272,11 @@ function timelineMission(args) {
   const sinceFilter = readFlag(args, '--since', '') || null;
   const ref = stripKnownFlags(args, ['--limit', '--output', '--out', '--kind', '--since'], ['--json', '--write', '--all', '--prune-preview'])[0] || '';
   const limit = all ? Number.MAX_SAFE_INTEGER : readPositiveIntegerFlag(args, '--limit', 12, { json: asJson });
-  const missions = listMissions();
-  const mission = ref
-    ? resolveMission(ref)
-    : (missions.find((row) => !TERMINAL_STATUSES.has(row.status)) || missions[0] || null);
-  if (ref && !mission) {
+  const data = loadTimelineData(ref, { limit, kindFilter, sinceFilter, write, prunePreviewRequested, outputPath });
+  if (ref && !data.mission) {
     exitMissingMission(ref, 1, asJson);
   }
-  if (!mission) {
+  if (!data.mission) {
     printJsonOrText(
       {
         ok: true,
@@ -5275,8 +5290,40 @@ function timelineMission(args) {
     );
     return;
   }
+  const { payload, lines } = groupTimeline(data, { all, kindFilter, sinceFilter });
+  renderTimeline(payload, lines, asJson);
+}
+
+function loadTimelineData(ref, { limit, kindFilter, sinceFilter, write, prunePreviewRequested, outputPath }) {
+  const missions = listMissions();
+  const mission = ref
+    ? resolveMission(ref)
+    : (missions.find((row) => !TERMINAL_STATUSES.has(row.status)) || missions[0] || null);
+  if (!mission) return { mission: null };
   const root = mission.worktree_root || process.cwd();
   const timelineResult = missionLandingTimeline(mission, root, limit, { kind: kindFilter, since: sinceFilter });
+  const generatedAt = stampIso();
+  let artifactPath = null;
+  let prunePreview = null;
+  if (write || prunePreviewRequested) {
+    try {
+      prunePreview = pruneRuns(root, { keepNewest: 200, keepDays: 14 });
+    } catch (error) {
+      prunePreview = { error: error.message || String(error) };
+    }
+  }
+  if (write) {
+    const outPath = outputPath
+      ? path.resolve(root, outputPath)
+      : defaultMissionTimelinePath(root, mission);
+    fs.mkdirSync(path.dirname(outPath), { recursive: true });
+    fs.writeFileSync(outPath, missionTimelineMarkdown(mission, timelineResult.items, { prunePreview, generatedAt, timelineMeta: timelineResult.meta }), 'utf8');
+    artifactPath = path.relative(root, outPath);
+  }
+  return { mission, timelineResult, generatedAt, prunePreview, artifactPath };
+}
+
+function groupTimeline({ mission, timelineResult, generatedAt, prunePreview, artifactPath }, { all, kindFilter, sinceFilter }) {
   const timeline = timelineResult.items;
   const currentLanding = missionTimelineCurrentLanding(timeline);
   const timelineItemDisplay = (item) => ({
@@ -5305,24 +5352,6 @@ function timelineMission(args) {
     ...timelineItemDisplay(item),
   }));
   const nextMove = missionTimelineNextMove(mission, currentLanding);
-  const generatedAt = stampIso();
-  let artifactPath = null;
-  let prunePreview = null;
-  if (write || prunePreviewRequested) {
-    try {
-      prunePreview = pruneRuns(root, { keepNewest: 200, keepDays: 14 });
-    } catch (error) {
-      prunePreview = { error: error.message || String(error) };
-    }
-  }
-  if (write) {
-    const outPath = outputPath
-      ? path.resolve(root, outputPath)
-      : defaultMissionTimelinePath(root, mission);
-    fs.mkdirSync(path.dirname(outPath), { recursive: true });
-    fs.writeFileSync(outPath, missionTimelineMarkdown(mission, timeline, { prunePreview, generatedAt, timelineMeta: timelineResult.meta }), 'utf8');
-    artifactPath = path.relative(root, outPath);
-  }
   const pruneSummary = missionTimelinePruneSummaryObject(prunePreview);
   const pruneDisplay = {
     label: 'Prune preview',
@@ -5587,6 +5616,10 @@ function timelineMission(args) {
   if (artifactPath) lines.push(`Saved: ${artifactPath}`);
   const pruneLine = missionTimelinePruneSummaryLine(prunePreview);
   if (pruneLine) lines.push(pruneLine);
+  return { payload, lines };
+}
+
+function renderTimeline(payload, lines, asJson) {
   printJsonOrText(payload, lines, asJson);
 }
 
@@ -5756,8 +5789,8 @@ function watchMission(args) {
     return;
   }
   const ref = stripKnownFlags(args, ['--interval', '--idle-every'], [])[0] || '';
-  const intervalSeconds = Math.max(1, parseInt(readFlag(args, '--interval', '2'), 10) || 2);
-  const idleEverySeconds = Math.max(1, parseInt(readFlag(args, '--idle-every', '30'), 10) || 30);
+  const intervalSeconds = Math.max(1, readIntFlag(args, '--interval', 2) || 2);
+  const idleEverySeconds = Math.max(1, readIntFlag(args, '--idle-every', 30) || 30);
   const loadTargets = () => {
     if (ref) {
       const mission = resolveMission(ref);
@@ -5857,19 +5890,29 @@ function runVerifier(command, root = process.cwd()) {
   if (!command) return null;
   const resolvedCommand = resolveVerifierCommand(command);
   const { envWithNodeDir } = require('../lib/spawn-env');
+  const timeoutMs = missionVerifierTimeoutMs();
+  const startedAt = Date.now();
   const result = spawnSync(resolvedCommand, {
     cwd: root,
     shell: true,
     encoding: 'utf8',
-    timeout: missionVerifierTimeoutMs(),
+    timeout: timeoutMs,
     env: envWithNodeDir(process.env),
   });
+  const elapsedMs = Date.now() - startedAt;
+  // A verifier that blows its window is not a failing check: the code may be
+  // fine and the suite merely slow (or starved by a concurrent flight). Report
+  // it as a distinct timed-out state so operators do not read slow as broken.
+  const timedOut = result.error ? result.error.code === 'ETIMEDOUT' : false;
   return {
     command,
     resolved_command: resolvedCommand === command ? null : resolvedCommand,
     status: result.status,
     signal: result.signal || null,
     passed: result.status === 0,
+    timed_out: timedOut,
+    elapsed_ms: elapsedMs,
+    timeout_ms: timeoutMs,
     stdout: String(result.stdout || '').slice(-4000),
     stderr: String(result.stderr || '').slice(-4000),
   };
@@ -5952,8 +5995,14 @@ function gitWorktreeSnapshot(root = process.cwd()) {
   }
   const entries = String(status.stdout || '').split(/\r?\n/).filter(Boolean).sort();
   const digest = crypto.createHash('sha1').update(entries.join('\n')).digest('hex');
+  const head = spawnSync('git', ['rev-parse', '--verify', 'HEAD'], {
+    cwd: root,
+    encoding: 'utf8',
+    timeout: 5000,
+  });
   return {
     available: true,
+    head: head.status === 0 ? String(head.stdout || '').trim() : null,
     dirty_count: entries.length,
     dirty_hash: digest,
     dirty_sample: entries.slice(0, 25),
@@ -5961,6 +6010,47 @@ function gitWorktreeSnapshot(root = process.cwd()) {
   };
 }
 
+function missionProtectedTags(mission, root = process.cwd()) {
+  const tags = [
+    mission?.tag,
+    mission?.lane,
+    ...(Array.isArray(mission?.tags) ? mission.tags : []),
+  ].filter(Boolean);
+  const taskRefs = new Set([
+    mission?.task_id,
+    mission?.task_ref,
+    ...(Array.isArray(mission?.task_ids) ? mission.task_ids : []),
+  ].filter(Boolean).map(String));
+  if (!taskRefs.size) return tags;
+  const projection = readJson(path.join(root, '.atris', 'state', 'tasks.projection.json'));
+  for (const task of Array.isArray(projection?.tasks) ? projection.tasks : []) {
+    if (!task || ![task.id, task.display_id, task.legacy_ref].some((ref) => taskRefs.has(String(ref || '')))) continue;
+    if (task.tag) tags.push(task.tag);
+    if (Array.isArray(task.tags)) tags.push(...task.tags);
+  }
+  return tags;
+}
+
+function inspectMissionTickProtectedDiff(mission, before, root = process.cwd()) {
+  const after = gitWorktreeSnapshot(root);
+  if (before?.reason === 'not-git-worktree' && after?.reason === 'not-git-worktree') {
+    return {
+      ok: true,
+      allowed: true,
+      status: 'clear',
+      reason: 'no git worktree exists, so this tick cannot commit or land',
+      unreadable: false,
+      surfaces: [],
+      matches: [],
+    };
+  }
+  return inspectMissionProtectedDiff({
+    root,
+    baseRef: before?.head || '',
+    tags: missionProtectedTags(mission, root),
+  });
+}
+
 // Porcelain v1 entries are "XY path" or "XY old -> new"; baselines compare by
 // post-rename path so a status-letter change alone never counts as new dirt.
 function porcelainEntryPath(line) {
@@ -6001,18 +6091,13 @@ function captureMissionWorktreeBaseline(mission, root = process.cwd()) {
     dirty_hash: snapshot.dirty_hash,
     paths: Array.from(paths).sort(),
   };
-  fs.mkdirSync(path.dirname(baselineFile), { recursive: true });
-  fs.writeFileSync(baselineFile, JSON.stringify(baseline, null, 2) + '\n', 'utf8');
+  writeJson(baselineFile, baseline);
   return baseline;
 }
 
 function loadMissionWorktreeBaseline(missionId, root = process.cwd()) {
-  try {
-    const baseline = JSON.parse(fs.readFileSync(missionBaselinePath(missionId, root), 'utf8'));
-    return Array.isArray(baseline?.paths) ? baseline : null;
-  } catch {
-    return null;
-  }
+  const baseline = readJson(missionBaselinePath(missionId, root));
+  return Array.isArray(baseline?.paths) ? baseline : null;
 }
 
 // Closed missions no longer tick, so the sidecar is dead weight; prune it and
@@ -6091,6 +6176,12 @@ const MISSION_RUN_DEFAULTS = {
   backoff: { initialMs: 30_000, maxMs: 10 * 60_000, factor: 2, jitter: 0.3 },
 };
 
+// Clamp a remaining-wall timeout to [1, capMs]. Used by spawn plumbing so a
+// nearly-expired wall cannot schedule a zero or multi-hour child wait.
+function clampTimeoutMs(remainingMs, capMs = MISSION_RUN_DEFAULTS.claudeTimeoutMs) {
+  return Math.min(capMs, Math.max(1, Math.floor(remainingMs)));
+}
+
 // Claude sessions accumulate context across resumed ticks; an always-on
 // mission would grow without bound. Continuity lives on disk (receipts, logs,
 // now.md), so a healthy session is disposable: rotate to a fresh one every N
@@ -6100,6 +6191,25 @@ const CLAUDE_SESSION_CONTEXT_ROTATE_TICKS = Math.max(
   Number(process.env.ATRIS_CLAUDE_SESSION_ROTATE_TICKS) || 8,
 );
 
+// A mission that sits in a protected lane must not tick unattended: the
+// worker lands its own diffs, so the only safe moment to stop a wrong one is
+// before the tick fires. Same tag-plus-text routing the task lane uses
+// (CLI-1189). An operator override is explicit: protected_lane_ack in the
+// mission metadata, set by a human, or ATRIS_ALLOW_PROTECTED_MISSION=1.
+function missionProtectedLaneHold(mission) {
+  if (process.env.ATRIS_ALLOW_PROTECTED_MISSION === '1') return null;
+  if (mission?.metadata?.protected_lane_ack) return null;
+  const { DENIED_TAGS } = require('../lib/fleet');
+  const { declaredProtectedLane, sniffedProtectedLane } = require('../lib/auto-accept-certified');
+  const lane = String(mission?.lane || '').toLowerCase();
+  if (DENIED_TAGS.includes(lane)) return { pause_reason: `protected-lane-${lane}` };
+  const probe = { title: mission?.objective, objective: mission?.stop_condition, metadata: mission?.metadata || {} };
+  if (declaredProtectedLane(probe)) return { pause_reason: 'protected-lane-declared' };
+  const sniffed = sniffedProtectedLane(probe);
+  if (sniffed) return { pause_reason: `protected-lane-${sniffed.lane}` };
+  return null;
+}
+
 function runnerUsesCallerSession(runner) {
   return new Set(['codex_goal', 'caller_session', 'current_agent']).has(String(runner || '').trim().toLowerCase());
 }
@@ -6222,8 +6332,7 @@ function missionHeartbeatLines(mission, now = new Date()) {
 }
 
 function missionHasHumanAsks(mission) {
-  return Array.isArray(mission?.human_asks)
-    && mission.human_asks.some((ask) => String(ask || '').trim());
+  return openHumanAsks(mission?.human_asks).length > 0;
 }
 
 function missionTaskHumanAcceptWaiting(mission) {
@@ -6264,7 +6373,14 @@ function missionSortTime(mission) {
 }
 
 function selectDueMission(root = process.cwd(), now = new Date(), options = {}) {
-  const candidates = listMissions(root)
+  const missions = listMissions(root);
+  for (const mission of missions) {
+    if (!missionIsRunnable(mission) || !missionObjectiveIsJunk(mission.objective)) continue;
+    stopMissionRecord(mission, 'junk_objective_gate', root, { writeStopReceipt: false });
+    console.error(`auto-stopped junk mission: "${String(mission.objective || '')}"`);
+  }
+  const candidates = missions
+    .filter((mission) => !missionObjectiveIsJunk(mission.objective))
     .filter((mission) => missionSelectableForLoop(mission, now))
     .filter((mission) => !options.headlessOnly || !runnerUsesCallerSession(mission.runner))
     .filter((mission) => !missionTaskHumanAcceptWaiting(mission))
@@ -6303,7 +6419,10 @@ function missionSelectableForCodexGoal(mission, now = new Date()) {
 function selectCodexGoalMission(root = process.cwd(), options = {}, now = new Date()) {
   const requestedId = String(options.missionId || '').trim();
   const candidates = listMissions(root)
-    .filter((mission) => runnerUsesCallerSession(mission.runner))
+    // caller_session/current_agent missions run in this process, but they do
+    // not own the native Codex goal handshake. Keep selection aligned with
+    // ackMissionGoal(), which intentionally accepts only codex_goal runners.
+    .filter((mission) => isCodexGoalMission(mission))
     .filter((mission) => missionSelectableForCodexGoal(mission, now));
   if (requestedId) {
     const exact = candidates.find((mission) => missionMatchesRef(mission, requestedId));
@@ -6318,10 +6437,6 @@ function selectCodexGoalMission(root = process.cwd(), options = {}, now = new Da
     const bRank = missionGoalSelectionRank(b);
     if (aRank !== bRank) return aRank - bRank;
 
-    const aCaller = runnerUsesCallerSession(a.runner) ? 1 : 0;
-    const bCaller = runnerUsesCallerSession(b.runner) ? 1 : 0;
-    if (aCaller !== bCaller) return bCaller - aCaller;
-
     const aVerifier = effectiveMissionVerifier(a) ? 1 : 0;
     const bVerifier = effectiveMissionVerifier(b) ? 1 : 0;
     if (aVerifier !== bVerifier) return bVerifier - aVerifier;
@@ -6614,19 +6729,13 @@ function writeDirectRunCodexGoalRequest(mission, root = process.cwd()) {
     requested_at: stampIso(),
   };
   const paths = statePaths(root);
-  fs.mkdirSync(path.dirname(paths.codexGoalRequestJson), { recursive: true });
-  fs.writeFileSync(paths.codexGoalRequestJson, JSON.stringify(request, null, 2) + '\n', 'utf8');
+  writeJson(paths.codexGoalRequestJson, request);
   return request;
 }
 
 function readDirectRunCodexGoalRequest(root = process.cwd(), now = new Date()) {
   const file = statePaths(root).codexGoalRequestJson;
-  let request = null;
-  try {
-    request = JSON.parse(fs.readFileSync(file, 'utf8'));
-  } catch {
-    return null;
-  }
+  const request = readJson(file);
   const missionId = String(request?.mission_id || '').trim();
   if (!missionId) return null;
   const mission = resolveMission(missionId, root);
@@ -6637,13 +6746,9 @@ function readDirectRunCodexGoalRequest(root = process.cwd(), now = new Date()) {
 
 function clearDirectRunCodexGoalRequestForMission(missionId, root = process.cwd()) {
   const file = statePaths(root).codexGoalRequestJson;
-  let request = null;
-  try {
-    request = JSON.parse(fs.readFileSync(file, 'utf8'));
-  } catch {
-    return false;
-  }
-  if (String(request?.mission_id || '') !== String(missionId || '')) return false;
+  const request = readJson(file);
+  if (!request) return false;
+  if (String(request.mission_id || '') !== String(missionId || '')) return false;
   try {
     fs.rmSync(file, { force: true });
     return true;
@@ -6961,8 +7066,7 @@ function writeCodexGoalState(payload, root = process.cwd()) {
     updated_at: stampIso(),
     ...payload,
   };
-  fs.mkdirSync(path.dirname(paths.codexGoalJson), { recursive: true });
-  fs.writeFileSync(paths.codexGoalJson, JSON.stringify(state, null, 2) + '\n', 'utf8');
+  writeJson(paths.codexGoalJson, state);
 
   const lines = [
     '# Codex Goal Controller',
@@ -7233,8 +7337,7 @@ function writeAtrisGoalState(payload, root = process.cwd()) {
     updated_at: stampIso(),
     ...payload,
   };
-  fs.mkdirSync(path.dirname(paths.atrisGoalJson), { recursive: true });
-  fs.writeFileSync(paths.atrisGoalJson, JSON.stringify(state, null, 2) + '\n', 'utf8');
+  writeJson(paths.atrisGoalJson, state);
 
   const lines = [
     '# Atris Goal Controller',
@@ -7476,8 +7579,37 @@ function missionJudgmentTopic(mission) {
   return plain.split(/\s+/).filter(Boolean).slice(0, 14).join(' ');
 }
 
+// Words that leave a title hanging mid-thought when they land at the end:
+// articles, prepositions, conjunctions, subordinators, and auxiliary/linking
+// verbs. A hard 8-word slice of an objective often stops on one of these
+// ("...runner away from", "...say work is"), which reads as a truncation bug.
+const DANGLING_TAIL_WORDS = new Set([
+  'a', 'an', 'the',
+  'of', 'to', 'in', 'on', 'at', 'for', 'from', 'with', 'by', 'into', 'onto',
+  'over', 'under', 'about', 'after', 'before', 'between', 'through', 'during',
+  'without', 'within', 'away', 'up', 'off', 'out',
+  'and', 'or', 'but', 'nor', 'so', 'yet', 'when', 'while', 'if', 'that',
+  'which', 'because', 'although', 'though', 'since', 'whether', 'as',
+  'is', 'are', 'was', 'were', 'be', 'been', 'being', 'am', 'has', 'have',
+  'had', 'do', 'does', 'did', 'will', 'would', 'shall', 'should', 'can',
+  'could', 'may', 'might', 'must',
+]);
+
+// Drop trailing function words so the title ends where a thought ends, never
+// on a preposition or auxiliary. Falls back to the raw slice if trimming would
+// empty the title.
+function trimDanglingTail(words) {
+  const trimmed = [...words];
+  while (trimmed.length > 1 && DANGLING_TAIL_WORDS.has(trimmed[trimmed.length - 1].toLowerCase())) {
+    trimmed.pop();
+  }
+  return trimmed.length ? trimmed : words;
+}
+
 function missionJudgmentTitle(mission) {
-  const words = missionJudgmentTopic(mission).split(/\s+/).filter(Boolean).slice(0, 8);
+  const words = trimDanglingTail(
+    missionJudgmentTopic(mission).split(/\s+/).filter(Boolean).slice(0, 8),
+  );
   const title = words.join(' ') || 'Mission needs a new direction';
   return title.charAt(0).toUpperCase() + title.slice(1);
 }
@@ -7642,12 +7774,11 @@ function missionDriverPaths(mission, root = process.cwd()) {
 }
 
 function readMissionDriverState(stateFile) {
-  try { return JSON.parse(fs.readFileSync(stateFile, 'utf8')) || {}; } catch { return {}; }
+  return readJson(stateFile, {}) || {};
 }
 
 function writeMissionDriverState(stateFile, state) {
-  fs.mkdirSync(path.dirname(stateFile), { recursive: true });
-  fs.writeFileSync(stateFile, JSON.stringify(state, null, 2) + '\n', 'utf8');
+  writeJson(stateFile, state);
 }
 
 function missionDriverError(error) {
@@ -7740,10 +7871,8 @@ function installDetachedMissionDriverLifecycle(mission, root = process.cwd()) {
 
 function missionDriverHealth(mission, root = process.cwd()) {
   const paths = missionDriverPaths(mission, root);
-  let driverState = null;
-  let lockState = null;
-  try { driverState = JSON.parse(fs.readFileSync(paths.stateFile, 'utf8')); } catch {}
-  try { lockState = JSON.parse(fs.readFileSync(paths.lockFile, 'utf8')); } catch {}
+  const driverState = readJson(paths.stateFile);
+  const lockState = readJson(paths.lockFile);
   const candidates = [
     driverState ? { ...driverState, source: 'driver_state' } : null,
     lockState ? { ...lockState, source: 'mission_lock' } : null,
@@ -7778,8 +7907,7 @@ function acquireMissionLock(missionId, root = process.cwd(), options = {}) {
       return { ok: true, lockFile, fd, missionId, driverPid: process.pid, startedAt, recordLength: record.length };
     } catch (e) {
       if (e.code === 'EEXIST') {
-        let info = {};
-        try { info = JSON.parse(fs.readFileSync(lockFile, 'utf8') || '{}'); } catch {}
+        const info = readJson(lockFile, {}) || {};
         const holderPid = Number(info.pid);
         const holderKnown = Number.isInteger(holderPid) && holderPid > 0;
         // A lock is created empty (openSync 'wx') and its pid record is written a
@@ -7876,6 +8004,14 @@ function spawnMissionDriver(mission, root = process.cwd()) {
       log_path: logPath,
     }, null, 2) + '\n', 'utf8');
     child.unref();
+    // A returned pid is not proof the engine is running: spawn can hand back a
+    // pid for a child that never execs or exits immediately. Verify the process
+    // is actually alive before claiming a live worker, and drop the misleading
+    // driver-state file when it is not.
+    if (!child.pid || !missionLockOwnerIsAlive(child.pid)) {
+      try { fs.rmSync(paths.stateFile, { force: true }); } catch {}
+      return { ok: false, error: 'mission driver exited before it could start', pid: child.pid || null };
+    }
     return {
       ok: true,
       pid: child.pid,
@@ -7949,7 +8085,13 @@ function detachMissionRun(args, mission, root = process.cwd(), asJson = false) {
 
 function probeClaudeBinary() {
   const runnerBin = resolveClaudeRunnerBin();
-  if (resolveClaudeRunnerCommandTemplate()) {
+  const commandTemplate = resolveClaudeRunnerCommandTemplate();
+  if (commandTemplate) {
+    // A command template fully replaces the claude invocation (GLM/OpenAI/
+    // local runners). The runner bin only matters when the template actually
+    // references {bin}; requiring `claude` on PATH otherwise defeats the
+    // template's purpose and breaks generic runners on claude-less machines.
+    if (!commandTemplate.includes('{bin}')) return { ok: true };
     const probe = spawnSync('sh', ['-c', `command -v ${shellQuote(runnerBin)}`], { encoding: 'utf8', timeout: 8000 });
     if (probe.status !== 0) return { ok: false, error: `${runnerBin} CLI not found` };
     return { ok: true };
@@ -8046,8 +8188,9 @@ function buildTickPrompt(mission, tickIndex, maxTicks, frozen, pings = []) {
   if (mission.task_ids?.length) {
     lines.push('', `## Task ids`, mission.task_ids.map((t) => `- ${t}`).join('\n'));
   }
-  if (mission.human_asks?.length) {
-    lines.push('', `## Human asks (don't act on these — surface them)`, mission.human_asks.map((t) => `- ${t}`).join('\n'));
+  const humanAsks = openHumanAsks(mission.human_asks);
+  if (humanAsks.length) {
+    lines.push('', `## Human asks (don't act on these — surface them)`, humanAsks.map((ask) => `- ${ask.text}`).join('\n'));
   }
   return lines.join('\n');
 }
@@ -8072,6 +8215,9 @@ function detectUnavailableModel(text) {
 // need a resume; a model-unavailable pause is a config error a bare resume won't fix,
 // so name the dead id and the two knobs that change it.
 function missionPauseNextAction(pauseReason, missionId, deadModel = null, lastErrorReason = null) {
+  if (pauseReason === 'protected-lane-review') {
+    return `review the protected diff and its receipt before resuming: atris mission run ${missionId}`;
+  }
   if (pauseReason === 'too-deep') {
     return 'stopped: helpers were spawning helpers too many levels deep';
   }
@@ -8260,13 +8406,31 @@ function spawnGenericRunnerTick(mission, opts) {
       resolve({ ok: false, error: e.message, sessionIds: [], aborted: false, timedOut: false, authExpired: false, brief_id: briefId });
       return;
     }
+    let gitGuard;
+    try {
+      gitGuard = prepareMissionGitGuard({ root: cwd, tags: missionProtectedTags(mission, cwd) });
+    } catch (error) {
+      resolve({
+        ok: false,
+        reason: 'protected-diff-unreadable',
+        error: error.message || String(error),
+        protected_lane_guard: unreadableMissionGuard(error),
+        sessionIds: [],
+        aborted: false,
+        timedOut: false,
+        authExpired: false,
+        brief_id: briefId,
+      });
+      return;
+    }
 
     const startedAt = Date.now();
-    const proc = spawn('sh', ['-lc', cmd], {
+    const guardedCommand = `PATH=${shellQuote(gitGuard.pathPrefix)}:$PATH; export PATH; ${cmd}`;
+    const proc = spawn('sh', ['-lc', guardedCommand], {
       cwd,
       stdio: ['ignore', 'pipe', 'pipe'],
       detached: true,
-      env: { ...process.env, ATRIS_DISPATCH_DEPTH: String(dispatchDepth.depth + 1) },
+      env: { ...gitGuard.env, ATRIS_DISPATCH_DEPTH: String(dispatchDepth.depth + 1) },
     });
     updateMissionLockOwner(missionLock, proc.pid, { phase: 'tick' });
     let stdout = '';
@@ -8297,6 +8461,7 @@ function spawnGenericRunnerTick(mission, opts) {
     proc.on('close', (code) => {
       clearTimeout(timer);
       cleanupPrompt();
+      gitGuard.cleanup();
       if (signal) signal.removeEventListener?.('abort', onAbort);
       updateMissionLockOwner(missionLock, missionLock?.driverPid);
       const finalText = String(stdout || '').trim();
@@ -8325,6 +8490,7 @@ function spawnGenericRunnerTick(mission, opts) {
     proc.on('error', (e) => {
       clearTimeout(timer);
       cleanupPrompt();
+      gitGuard.cleanup();
       if (signal) signal.removeEventListener?.('abort', onAbort);
       updateMissionLockOwner(missionLock, missionLock?.driverPid);
       resolve({ ok: false, error: e.message, sessionIds: [], aborted, timedOut, authExpired: false, brief_id: briefId });
@@ -8373,6 +8539,22 @@ function spawnClaudeTick(mission, opts) {
   const dispatchDepth = missionDispatchDepth();
   if (dispatchDepth.tooDeep) return Promise.resolve(tooDeepRunnerResult(dispatchDepth));
   return new Promise((resolve) => {
+    let gitGuard;
+    try {
+      gitGuard = prepareMissionGitGuard({ root: cwd, tags: missionProtectedTags(mission, cwd) });
+    } catch (error) {
+      resolve({
+        ok: false,
+        reason: 'protected-diff-unreadable',
+        error: error.message || String(error),
+        protected_lane_guard: unreadableMissionGuard(error),
+        sessionIds: [],
+        aborted: false,
+        timedOut: false,
+        authExpired: false,
+      });
+      return;
+    }
     const args = [
       '-p', prompt,
       '--output-format', 'stream-json',
@@ -8392,7 +8574,7 @@ function spawnClaudeTick(mission, opts) {
       cwd,
       stdio: ['ignore', 'pipe', 'pipe'],
       detached: true,
-      env: { ...process.env, ATRIS_DISPATCH_DEPTH: String(dispatchDepth.depth + 1) },
+      env: { ...gitGuard.env, ATRIS_DISPATCH_DEPTH: String(dispatchDepth.depth + 1) },
     });
     updateMissionLockOwner(missionLock, proc.pid, { phase: 'tick' });
 
@@ -8455,6 +8637,7 @@ function spawnClaudeTick(mission, opts) {
 
     proc.on('close', (code) => {
       clearTimeout(timer);
+      gitGuard.cleanup();
       if (signal) signal.removeEventListener?.('abort', onAbort);
       updateMissionLockOwner(missionLock, missionLock?.driverPid);
       const ok = code === 0 && !isError && !timedOut && !aborted;
@@ -8484,6 +8667,7 @@ function spawnClaudeTick(mission, opts) {
 
     proc.on('error', (e) => {
       clearTimeout(timer);
+      gitGuard.cleanup();
       updateMissionLockOwner(missionLock, missionLock?.driverPid);
       resolve({ ok: false, error: e.message, sessionIds: [], aborted, timedOut, authExpired: false });
     });
@@ -8582,16 +8766,28 @@ function cappedClaudeReceiptText(text, limit = 4000) {
   return clean.slice(0, limit - 16).trimEnd() + '\n...[truncated]';
 }
 
-async function runMission(args) {
+async function parseAndValidateMissionRunPhase(args) {
   const asJson = wantsJson(args);
+  const context = {
+    args,
+    asJson,
+    cwd: process.cwd(),
+    handled: false,
+    returnValue: undefined,
+    lock: null,
+    error: null,
+  };
   if (hasFlag(args, '--help') || hasFlag(args, '-h')) {
     help();
-    return;
+    context.handled = true;
+    return context;
   }
   if (hasFlag(args, '--cloud')) {
     const result = await runCloudMissionCommand(args);
     process.exitCode = result.exitCode;
-    return result;
+    context.handled = true;
+    context.returnValue = result;
+    return context;
   }
   // --fleet: staff every idle capable engine on the board's claimable
   // safe-lane tasks, build in parallel worktrees, land serially. Humble flag,
@@ -8610,7 +8806,8 @@ async function runMission(args) {
     });
     if (asJson) console.log(JSON.stringify(flight, null, 2));
     process.exitCode = flight.paused && flight.paused.length > 0 ? 1 : 0;
-    return;
+    context.handled = true;
+    return context;
   }
   const dueMode = hasFlag(args, '--due');
   const headlessOnly = hasFlag(args, '--headless');
@@ -8646,22 +8843,70 @@ async function runMission(args) {
   const ref = input.ref;
   const runArgs = input.args;
 
+  Object.assign(context, {
+    dueMode,
+    headlessOnly,
+    selfDrive,
+    skipClaude,
+    verifyEach,
+    completeOnPass,
+    skipDrain,
+    createNext,
+    budgetTier,
+    maxTicksFlag,
+    maxTicks,
+    maxWallFlag,
+    explicitMaxWallSeconds,
+    runBudgetContract,
+    maxWallSeconds,
+    cadenceOverride,
+    runnerOverride,
+    modelOverride,
+    runtimeView,
+    input,
+    ref,
+    runArgs,
+  });
+  return context;
+}
+
+async function resolveMissionRunPhase(context) {
+  const {
+    args,
+    asJson,
+    cwd,
+    dueMode,
+    headlessOnly,
+    budgetTier,
+    maxTicksFlag,
+    maxWallFlag,
+    explicitMaxWallSeconds,
+    runBudgetContract,
+    runtimeView,
+    input,
+    ref,
+    runArgs,
+  } = context;
+  let { maxTicks, maxWallSeconds } = context;
+
   if (!dueMode && !ref) {
     if (asJson || !process.stdin.isTTY || !process.stderr.isTTY) {
       missionRunInputRequired(asJson, input.owner);
     }
     const prompted = await promptMissionRunInput(runArgs);
     await startMissionFromRunObjective(prompted.objective, prompted.args);
+    context.handled = true;
     return;
   }
 
-  let mission = dueMode && !ref ? selectDueMission(process.cwd(), new Date(), { headlessOnly }) : resolveMission(ref);
+  let mission = dueMode && !ref ? selectDueMission(cwd, new Date(), { headlessOnly }) : resolveMission(ref, cwd);
   if (!mission && dueMode && !ref) {
     printJsonOrText(
       { ok: true, action: 'run_skipped', reason: 'no_due_mission', mission: null },
       ['No due mission found.'],
       asJson,
     );
+    context.handled = true;
     return;
   }
   // BCK-1319: a bare single token that looks like an id/suffix/number (no
@@ -8675,6 +8920,7 @@ async function runMission(args) {
   }
   if (!mission && ref) {
     await startMissionFromRunObjective(ref, runArgs);
+    context.handled = true;
     return;
   }
   if (!mission) {
@@ -8688,7 +8934,8 @@ async function runMission(args) {
   } else if (!maxWallFlag && Number(mission.budget_contract?.requested_seconds) > 0) {
     maxWallSeconds = Math.max(60, Number(mission.budget_contract.requested_seconds));
   }
-  const detachedDriverLifecycle = installDetachedMissionDriverLifecycle(mission, process.cwd());
+  const detachedDriverLifecycle = installDetachedMissionDriverLifecycle(mission, cwd);
+  context.detachedDriverLifecycle = detachedDriverLifecycle;
   if (['complete', 'stopped'].includes(mission.status)) {
     detachedDriverLifecycle?.setExitReason(mission.status);
     if (asJson) {
@@ -8697,18 +8944,20 @@ async function runMission(args) {
         [],
         true,
       );
+      context.handled = true;
       return;
     }
     console.error(`Mission ${mission.id} is ${mission.status}; nothing to run.`);
     process.exit(0);
   }
   if (hasFlag(args, '--detach')) {
-    detachMissionRun(args, mission, process.cwd(), asJson);
+    detachMissionRun(args, mission, cwd, asJson);
+    context.handled = true;
     return;
   }
 
   const nativeGoalRunOptions = codexNativeGoalOptionsFromArgs(args);
-  const autoAck = maybeAutoAckCodexNativeGoal(mission, process.cwd(), nativeGoalRunOptions);
+  const autoAck = maybeAutoAckCodexNativeGoal(mission, cwd, nativeGoalRunOptions);
   if (autoAck) mission = autoAck.saved;
   maybeBlockUntilCodexNativeGoalStarted(runtimeView(mission), asJson, nativeGoalRunOptions);
 
@@ -8717,37 +8966,63 @@ async function runMission(args) {
   // (e.g. --engine cursor) never invokes claude. The in-lock probe below runs
   // after applyMissionRunnerProfile and checks the right binary.
 
-  const lock = acquireMissionLock(mission.id);
+  const lock = acquireMissionLock(mission.id, cwd);
   if (!lock.ok) {
     exitMissionError(`another driver is already running mission ${mission.id} (pid ${lock.holder?.pid || '?'})`, 3, asJson);
   }
 
-  // Everything past lock acquisition runs inside try/finally so the lock + signal handlers
-  // always get cleaned up — including saveMission failures during pending-session setup.
-  let pauseReason = null;
-  let sessionId = null;
-  let pendingSessionId = null;
-  let ranTicks = 0;
-  const ticks = [];
-  let onSig = null;
-  let restoreRunnerProfile = null;
-  let blocker = null;
+  Object.assign(context, {
+    mission,
+    maxTicks,
+    maxWallSeconds,
+    nativeGoalRunOptions,
+    lock,
+    pauseReason: null,
+    sessionId: null,
+    pendingSessionId: null,
+    ranTicks: 0,
+    ticks: [],
+    onSig: null,
+    restoreRunnerProfile: null,
+    blocker: null,
+  });
+}
 
-  try {
-    const cwd = process.cwd();
+async function executeMissionRunTicksPhase(context) {
+    const {
+      asJson,
+      cwd,
+      explicitMaxWallSeconds,
+      runBudgetContract,
+      runtimeView,
+      runnerOverride,
+      skipClaude,
+      verifyEach,
+      completeOnPass,
+      skipDrain,
+      maxTicksFlag,
+      budgetTier,
+      cadenceOverride,
+      detachedDriverLifecycle,
+      lock,
+      nativeGoalRunOptions,
+    } = context;
+    let { mission, maxTicks, maxWallSeconds, pauseReason, sessionId, pendingSessionId, ranTicks } = context;
+    const ticks = context.ticks;
     const controller = new AbortController();
-    onSig = (signal) => {
+    context.controller = controller;
+    context.onSig = (signal) => {
       detachedDriverLifecycle?.setExitReason(`signal-${String(signal || 'abort').toLowerCase()}`);
       controller.abort();
     };
-    process.on('SIGINT', onSig);
-    process.on('SIGTERM', onSig);
+    process.on('SIGINT', context.onSig);
+    process.on('SIGTERM', context.onSig);
 
     // Re-read inside the lock. The initial resolveMission ran pre-lock, so a concurrent
     // `mission tick` could have written between resolveMission and acquireMissionLock.
     // Derive sessionId, pendingSessionId, and the frozen contract from the fresh record
     // so a fast tick's writes can't be silently overwritten by this run loop.
-    mission = resolveMission(mission.id) || mission;
+    mission = resolveMission(mission.id, cwd) || mission;
     if (explicitMaxWallSeconds && runBudgetContract) {
       mission = saveMission({
         ...mission,
@@ -8762,10 +9037,12 @@ async function runMission(args) {
     if (['complete', 'stopped'].includes(mission.status)) {
       detachedDriverLifecycle?.setExitReason(mission.status);
       console.error(`Mission ${mission.id} is ${mission.status}; nothing to run.`);
+      context.handled = true;
       return;
     }
     if (returnIfCodexNativeGoalNotStarted(runtimeMission, asJson, nativeGoalRunOptions)) {
       detachedDriverLifecycle?.setExitReason('native-goal-not-started');
+      context.handled = true;
       return;
     }
     if (mission.status === 'paused') {
@@ -8782,7 +9059,7 @@ async function runMission(args) {
     sessionId = mission.claude_session_id || null;
     pendingSessionId = mission.pending_session_id || null;
     const autoRunner = String(runtimeMission.runner || '').trim().toLowerCase() === MISSION_AUTO_RUNNER;
-    restoreRunnerProfile = autoRunner ? () => {} : applyMissionRunnerProfile(runtimeMission.runner);
+    context.restoreRunnerProfile = autoRunner ? () => {} : applyMissionRunnerProfile(runtimeMission.runner);
     const callerSessionRunner = runnerUsesCallerSession(runtimeMission.runner);
     const runnerName = String(runtimeMission.runner || '').trim().toLowerCase();
     const atris2Runner = runnerName === 'atris2';
@@ -8826,6 +9103,10 @@ async function runMission(args) {
     const startedAt = Date.now();
     let backoffAttempt = 0;
     let lastRateLimit = null;
+    // A usage-wall cooldown belongs to the engine that hit it, not the whole run.
+    // Tracking which engine set it lets an auto-runner swap to another ready engine
+    // and keep working instead of waiting the wall out (or pausing for a human).
+    let rateLimitedEngineId = null;
     let continuationGoal = null;
 
     const sessionLabel = skipWorker
@@ -8845,7 +9126,7 @@ async function runMission(args) {
         // Re-read before measuring the wall. Detached full-budget drivers use
         // the mission contract as their wall so process startup drift cannot
         // shorten the promised work window.
-        mission = resolveMission(mission.id) || mission;
+        mission = resolveMission(mission.id, cwd) || mission;
         runtimeMission = runtimeView(mission);
         const contractualRemaining = detachedDriverLifecycle && mission.always_on && missionSpendsFullBudget(mission)
           ? missionFullBudgetRemainingSeconds(mission)
@@ -8862,6 +9143,8 @@ async function runMission(args) {
       if (['complete', 'stopped', 'paused'].includes(mission.status)) { pauseReason = mission.status; break; }
       if (effectiveMissionVerifier(mission) !== storedVerifier) { pauseReason = 'verifier-mutated'; break; }
       if ((mission.lane || 'workspace') !== frozen.lane) { pauseReason = 'lane-mutated'; break; }
+      const protectedHold = missionProtectedLaneHold(mission);
+      if (protectedHold) { pauseReason = protectedHold.pause_reason; break; }
 
       const tickIdx = Number(mission.last_tick_index || 0) + 1;
       const tickStart = stampIso();
@@ -8885,6 +9168,18 @@ async function runMission(args) {
         result.engine_fallback_reason = tickSelection.engine_fallback_reason;
       }
 
+      // Usage-wall engine swap: when a prior tick's engine hit a rate-limit wall and
+      // the auto runner has already resolved this tick to a *different* ready engine
+      // (the walled one is now credit_out and excluded from resolution), the run-wide
+      // cooldown no longer applies. Clear it so the fresh engine runs now instead of
+      // the loop sleeping through — or pausing on `rate-limit-exceeded-wall` for — a
+      // wall this engine never hit.
+      if (lastRateLimit && rateLimitedEngineId && tickEngineId && tickEngineId !== rateLimitedEngineId) {
+        result.engine_swapped_from = rateLimitedEngineId;
+        lastRateLimit = null;
+        rateLimitedEngineId = null;
+      }
+
       // Active-hours gate
       if (engineBackedTick && !tickEngineId) {
         result = { ...result, status: 'errored', reason: 'no-ready-engine' };
@@ -8916,55 +9211,76 @@ async function runMission(args) {
           drill: drillResult,
         };
       } else if (tickAtris2Runner) {
-        const pingDrain = consumeMissionPings(mission, cwd);
-        mission = pingDrain.mission;
-        runtimeMission = runtimeView(mission);
-        const prompt = buildTickPrompt(tickRuntimeMission, tickIdx, effectiveMaxTicks, frozen, pingDrain.pings);
-        const { runAtris2Turn } = require('./probe');
-        const businessId = businessIdForAtris2Mission(tickRuntimeMission, cwd);
-        const tickController = new AbortController();
-        let wallExpired = false;
-        const abortTick = () => tickController.abort();
-        controller.signal.addEventListener('abort', abortTick, { once: true });
-        const tickTimer = setTimeout(() => {
-          wallExpired = true;
-          tickController.abort();
-        }, Math.max(1, Math.floor(remainingWall * 1000)));
-        let turn;
+        let atris2GitGuard = null;
         try {
-          turn = await runAtris2Turn({
-            prompt,
-            model: tickRuntimeMission.model || 'atris:fast',
-            business: businessId,
-            maxTurns: 16,
-            signal: tickController.signal,
-            // CLI-231: mission ticks execute relayed ops in the mission's own
-            // workspace, not the hosted ai-computer filesystem.
-            localCwd: cwd,
-          });
-        } finally {
-          clearTimeout(tickTimer);
-          controller.signal.removeEventListener('abort', abortTick);
+          atris2GitGuard = prepareMissionGitGuard({ root: cwd, tags: missionProtectedTags(mission, cwd) });
+        } catch (error) {
+          result = {
+            ...result,
+            status: 'ran',
+            reason: 'protected-diff-unreadable',
+            ran: true,
+            atris2: {
+              ok: false,
+              error: error.message || String(error),
+              protected_lane_guard: unreadableMissionGuard(error),
+            },
+          };
         }
-        result.atris2 = {
-          ok: turn.ok,
-          engine: turn.engine,
-          model: tickRuntimeMission.model || 'atris:fast',
-          tools_run: turn.tools_run,
-          unsupported: turn.unsupported,
-          duration_ms: turn.duration_ms,
-          error: turn.error,
-          backend_unavailable: isTransientAtris2BackendError(turn.error) || undefined,
-          receipt_text: String(turn.text || '').slice(0, 4000),
-        };
-        if (controller.signal.aborted) { pauseReason = 'aborted-during-atris2'; break; }
-        if (turn.error === 'not-logged-in') { pauseReason = 'auth-required'; break; }
-        if (wallExpired) {
-          result = { ...result, status: 'errored', reason: 'wall-exceeded-during-tick' };
-        } else if (!turn.ok || !String(turn.text || '').trim()) {
-          result = { ...result, status: 'errored', reason: atris2TurnErrorReason(turn.error) };
-        } else {
-          result = { ...result, status: 'ran', reason: 'tick-ok', ran: true };
+        if (atris2GitGuard) {
+          const pingDrain = consumeMissionPings(mission, cwd);
+          mission = pingDrain.mission;
+          runtimeMission = runtimeView(mission);
+          const prompt = buildTickPrompt(tickRuntimeMission, tickIdx, effectiveMaxTicks, frozen, pingDrain.pings);
+          const { runAtris2Turn } = require('./probe');
+          const businessId = businessIdForAtris2Mission(tickRuntimeMission, cwd);
+          const tickController = new AbortController();
+          let wallExpired = false;
+          const abortTick = () => tickController.abort();
+          controller.signal.addEventListener('abort', abortTick, { once: true });
+          const tickTimer = setTimeout(() => {
+            wallExpired = true;
+            tickController.abort();
+          }, Math.max(1, Math.floor(remainingWall * 1000)));
+          let turn;
+          try {
+            turn = await runAtris2Turn({
+              prompt,
+              model: tickRuntimeMission.model || 'atris:fast',
+              business: businessId,
+              maxTurns: 16,
+              signal: tickController.signal,
+              // CLI-231: mission ticks execute relayed ops in the mission's own
+              // workspace, not the hosted ai-computer filesystem.
+              localCwd: cwd,
+              localEnv: atris2GitGuard.env,
+              localPathPrefix: atris2GitGuard.pathPrefix,
+            });
+          } finally {
+            atris2GitGuard.cleanup();
+            clearTimeout(tickTimer);
+            controller.signal.removeEventListener('abort', abortTick);
+          }
+          result.atris2 = {
+            ok: turn.ok,
+            engine: turn.engine,
+            model: tickRuntimeMission.model || 'atris:fast',
+            tools_run: turn.tools_run,
+            unsupported: turn.unsupported,
+            duration_ms: turn.duration_ms,
+            error: turn.error,
+            backend_unavailable: isTransientAtris2BackendError(turn.error) || undefined,
+            receipt_text: String(turn.text || '').slice(0, 4000),
+          };
+          if (controller.signal.aborted) { pauseReason = 'aborted-during-atris2'; break; }
+          if (turn.error === 'not-logged-in') { pauseReason = 'auth-required'; break; }
+          if (wallExpired) {
+            result = { ...result, status: 'errored', reason: 'wall-exceeded-during-tick' };
+          } else if (!turn.ok || !String(turn.text || '').trim()) {
+            result = { ...result, status: 'errored', reason: atris2TurnErrorReason(turn.error) };
+          } else {
+            result = { ...result, status: 'ran', reason: 'tick-ok', ran: true };
+          }
         }
       } else {
         let sessionMode = sessionId ? 'resume' : 'set';
@@ -8979,9 +9295,9 @@ async function runMission(args) {
         const runClaudeSession = () => spawnClaudeTick(tickRuntimeMission, {
           sessionMode, sessionId: useId, cwd, signal: controller.signal,
           missionLock: lock,
-          timeoutMs: Math.min(
+          timeoutMs: clampTimeoutMs(
+            (maxWallSeconds - ((Date.now() - startedAt) / 1000)) * 1000,
             MISSION_RUN_DEFAULTS.claudeTimeoutMs,
-            Math.max(1, Math.floor((maxWallSeconds - ((Date.now() - startedAt) / 1000)) * 1000)),
           ),
           prompt,
           model: resolveClaudeRunnerModel(tickRuntimeMission),
@@ -9006,6 +9322,7 @@ async function runMission(args) {
         result.claude = {
           ok: claudeResult.ok,
           reason: claudeResult.reason,
+          protected_lane_guard: claudeResult.protected_lane_guard || null,
           brief_id: claudeResult.brief_id || null,
           summary: claudeResult.summary,
           receipt_text: claudeResult.receipt_text,
@@ -9026,6 +9343,7 @@ async function runMission(args) {
           // treating an allowed resetsAt as one pauses every timed run after
           // tick 1 with rate-limit-exceeded-wall.
           lastRateLimit = claudeResult.rate_limit_info.status === 'allowed' ? null : claudeResult.rate_limit_info;
+          rateLimitedEngineId = lastRateLimit ? tickEngineId : null;
         }
         if (claudeResult.aborted) { pauseReason = 'aborted-during-claude'; break; }
         if (claudeResult.authExpired) { pauseReason = 'auth-required'; break; }
@@ -9086,26 +9404,22 @@ async function runMission(args) {
         if (engineHealth) result.engine_health = engineHealth.health;
       }
 
-      // An explicit verifier is safe and useful in no-worker mode. The
-      // fallback engine verifier is itself worker activity, so --no-claude
-      // and caller-session ticks must not launch it behind the operator's
-      // back. Leaving verifier_passed unset also lets the idle-stop breaker
-      // judge these ticks from the worktree signal instead of hanging here.
-      let verifierResult = null;
+      context.pauseReason = pauseReason;
+      context.currentTick = {
+        mission,
+        result,
+        tickWorktreeBefore,
+        tickRuntimeMission,
+        tickSkipWorker,
+        tickIdx,
+        frozen,
+      };
+      await verifyMissionRunTickPhase(context);
+      result = context.currentTick.result;
+      const verifierResult = context.currentTick.verifierResult;
+      pauseReason = context.pauseReason;
+      context.currentTick = null;
       let receiptPath = null;
-      if (result.status === 'ran' && verifyEach) {
-        if (frozen.verifier) {
-          verifierResult = runVerifier(frozen.verifier);
-        } else if (!tickSkipWorker) {
-          verifierResult = await runEngineVerifier(tickRuntimeMission, {
-            cwd,
-            signal: controller.signal,
-            tickIndex: tickIdx,
-          });
-        }
-        if (verifierResult) result.verifier_passed = verifierResult.passed;
-      }
-      stampMissionRunnerBrief(cwd, result.claude?.brief_id, result, verifierResult);
 
       // Review-lane drain: always-on loops sweep the agent-safe review actions
       // each tick so proof-backed work reaches certified on cadence with zero
@@ -9246,6 +9560,7 @@ async function runMission(args) {
         break;
       }
 
+      if (['mission-diff-unreadable', 'protected-lane-review'].includes(pauseReason)) break;
       if (callerSessionRunner && result.status === 'ran') break;
       if (newStatus === 'complete' || (newStatus === 'ready' && !mission.always_on && !fullBudgetMode)) break;
       // BCK-1324: two consecutive ticks that each self-report "ran" but leave no
@@ -9293,7 +9608,7 @@ async function runMission(args) {
         if (lastTick && lastTick.status !== 'ran' && !missionRunKeepsRetryingError(lastTick.reason)) pauseReason = 'max-ticks-reached';
       }
 
-      mission = resolveMission(mission.id) || mission;
+      mission = resolveMission(mission.id, cwd) || mission;
       const remainingBudgetSeconds = missionFullBudgetRemainingSeconds(mission);
       const explicitExit = ['complete', 'stopped', 'paused'].includes(String(mission.status || ''));
       const healthyCycleBoundary = !pauseReason || pauseReason === 'max-ticks-reached';
@@ -9325,6 +9640,97 @@ async function runMission(args) {
       cycleTickLimit = ticks.length + effectiveMaxTicks;
     }
 
+    Object.assign(context, {
+      mission,
+      pauseReason,
+      sessionId,
+      pendingSessionId,
+      ranTicks,
+      frozen,
+      runWorktreeBefore,
+      runWorktreeBaseline,
+      effectiveMaxTicks,
+      startedAt,
+      continuationGoal,
+      runtimeMission,
+    });
+}
+
+async function verifyMissionRunTickPhase(context) {
+  const { cwd, verifyEach, controller, currentTick } = context;
+  let { result } = currentTick;
+
+  // An explicit verifier is safe and useful in no-worker mode. The fallback
+  // engine verifier is worker activity, so no-worker ticks must not launch it.
+  const runnerGuard = result.claude?.protected_lane_guard || result.atris2?.protected_lane_guard || null;
+  if (result.status === 'ran' || runnerGuard) {
+    const protectedLaneGuard = runnerGuard?.allowed === false
+      ? runnerGuard
+      : inspectMissionTickProtectedDiff(currentTick.mission, currentTick.tickWorktreeBefore, cwd);
+    result.protected_lane_guard = protectedLaneGuard;
+    if (!protectedLaneGuard.allowed) {
+      const guardPauseReason = protectedLaneGuard.unreadable
+        ? 'mission-diff-unreadable'
+        : 'protected-lane-review';
+      result.status = protectedLaneGuard.status;
+      result.reason = guardPauseReason;
+      result.ran = false;
+      context.pauseReason = guardPauseReason;
+    }
+  }
+
+  let verifierResult = null;
+  if (result.status === 'ran' && verifyEach) {
+    if (currentTick.frozen.verifier) {
+      verifierResult = runVerifier(currentTick.frozen.verifier);
+    } else if (!currentTick.tickSkipWorker) {
+      verifierResult = await runEngineVerifier(currentTick.tickRuntimeMission, {
+        cwd,
+        signal: controller.signal,
+        tickIndex: currentTick.tickIdx,
+      });
+    }
+    if (verifierResult) result.verifier_passed = verifierResult.passed;
+  }
+  stampMissionRunnerBrief(cwd, result.claude?.brief_id, result, verifierResult);
+  currentTick.result = result;
+  currentTick.verifierResult = verifierResult;
+}
+
+function completeMissionRunPhase(context) {
+  const {
+    asJson,
+    cwd,
+    selfDrive,
+    createNext,
+    runtimeView,
+    runnerOverride,
+    runBudgetContract,
+    detachedDriverLifecycle,
+    lock,
+    frozen,
+    runWorktreeBefore,
+    runWorktreeBaseline,
+    effectiveMaxTicks,
+    startedAt,
+  } = context;
+  const ticks = context.ticks || [];
+  let {
+    mission,
+    pauseReason,
+    ranTicks,
+    sessionId,
+    blocker,
+    continuationGoal,
+  } = context;
+
+  try {
+    if (context.error) {
+      detachedDriverLifecycle?.finish('run-error', context.error);
+      return;
+    }
+    if (context.handled) return;
+
     // BCK-1324: no-progress is a clean, honest stop — the run did what it
     // could and correctly recognized there was nothing left to do. It is NOT
     // a failure/blocker: pausing it (resumable, retried by cron/self-drive)
@@ -9438,18 +9844,35 @@ async function runMission(args) {
     detachedDriverLifecycle?.finish('run-error', error);
     throw error;
   } finally {
-    if (onSig) {
-      try { process.removeListener('SIGINT', onSig); } catch {}
-      try { process.removeListener('SIGTERM', onSig); } catch {}
+    if (context.onSig) {
+      try { process.removeListener('SIGINT', context.onSig); } catch {}
+      try { process.removeListener('SIGTERM', context.onSig); } catch {}
     }
-    if (restoreRunnerProfile) {
-      try { restoreRunnerProfile(); } catch {}
+    if (context.restoreRunnerProfile) {
+      try { context.restoreRunnerProfile(); } catch {}
     }
     releaseMissionLock(lock);
     detachedDriverLifecycle?.finish();
   }
 }
 
+async function runMission(args) {
+  const context = await parseAndValidateMissionRunPhase(args);
+  if (context.handled) return context.returnValue;
+
+  try {
+    await resolveMissionRunPhase(context);
+    if (!context.handled) await executeMissionRunTicksPhase(context);
+  } catch (error) {
+    context.error = error;
+    throw error;
+  } finally {
+    if (context.lock) completeMissionRunPhase(context);
+  }
+
+  return context.returnValue;
+}
+
 function tickMission(args) {
   const asJson = wantsJson(args);
   if (hasFlag(args, '--help') || hasFlag(args, '-h') || String(args[0] || '').trim() === 'help') {
@@ -9516,6 +9939,7 @@ function tickMission(args) {
     const tickIdx = lastTickIndex + 1;
     const tickWorktreeBefore = gitWorktreeSnapshot(cwd);
     const worktreeBaseline = loadMissionWorktreeBaseline(mission.id, cwd);
+    const protectedLaneGuard = inspectMissionTickProtectedDiff(mission, tickWorktreeBefore, cwd);
 
     const effectiveVerifier = effectiveMissionVerifier(mission);
     const verifierCommand = verify
@@ -9524,7 +9948,7 @@ function tickMission(args) {
     if (verifierCommand) assertMissionVerifier(verifierCommand, asJson);
 
     let verifierResult = null;
-    if (verify && verifierCommand) {
+    if (protectedLaneGuard.allowed && verify && verifierCommand) {
       verifierResult = runVerifier(verifierCommand);
     }
     const tickWorktree = worktreeReceipt(tickWorktreeBefore, gitWorktreeSnapshot(cwd), { verifier: verifierCommand || effectiveVerifier, baseline: worktreeBaseline });
@@ -9532,17 +9956,21 @@ function tickMission(args) {
     // Same layer classification as the run-tick path; manual ticks carry their
     // receipt text in --summary.
     const layerInfo = extractLayerFromReceiptText(summary || '', tickWorktree?.new_since_baseline_sample);
+    const guardPauseReason = protectedLaneGuard.unreadable
+      ? 'mission-diff-unreadable'
+      : 'protected-lane-review';
     const tickRecord = {
-      status: 'ran',
-      reason: 'tick-recorded',
+      status: protectedLaneGuard.allowed ? 'ran' : protectedLaneGuard.status,
+      reason: protectedLaneGuard.allowed ? 'tick-recorded' : guardPauseReason,
       tick_index: tickIdx,
-      ran: true,
+      ran: protectedLaneGuard.allowed,
       started_at: tickStart,
       claude: { skipped: true, reason: 'orchestrator-is-caller-session' },
       summary: summary || null,
       layer: layerInfo.layer,
       layer_source: layerInfo.source,
       verifier_passed: verifierResult ? !!verifierResult.passed : null,
+      protected_lane_guard: protectedLaneGuard,
       finished_at: stampIso(),
       worktree: tickWorktree,
     };
@@ -9555,6 +9983,7 @@ function tickMission(args) {
         started_at: tickStart,
       },
       verifier_result: verifierResult,
+      protected_lane_guard: protectedLaneGuard,
       rate_limit_info: null,
       worktree: tickWorktree,
     });
@@ -9566,7 +9995,12 @@ function tickMission(args) {
 	        ? nextCandidateTickAction(mission)
 	        : 'attach task, verifier, or proof');
 	    const nextGoalChain = advanceMissionGoalChain(mission.goal_chain, summary, verifierResult);
-	    if (verifierResult?.passed && nextGoalChain && !nextGoalChain.pause_ready) {
+	    if (!protectedLaneGuard.allowed) {
+	      status = 'paused';
+	      nextAction = protectedLaneGuard.unreadable
+	        ? `repair the mission diff tooling failure, then rerun: atris mission run ${mission.id}`
+	        : `review the protected diff and receipt before resuming: atris mission run ${mission.id}`;
+	    } else if (verifierResult?.passed && nextGoalChain && !nextGoalChain.pause_ready) {
 	      status = 'running';
 	      nextAction = missionGoalChainNextAction(nextGoalChain);
     } else if (verifierResult?.passed) {
@@ -9591,10 +10025,10 @@ function tickMission(args) {
 	    }
 	    const clearsPauseState = !['paused', 'stopped'].includes(status);
 	    const nextMission = {
-	      ...mission,
-	      status,
-      paused_at: clearsPauseState ? null : mission.paused_at || null,
-      stop_reason: clearsPauseState ? null : mission.stop_reason || null,
+      ...mission,
+      status,
+      paused_at: clearsPauseState ? null : tickRecord.finished_at,
+      stop_reason: clearsPauseState ? null : tickRecord.reason,
       resumed_at: clearsPauseState && mission.status === 'paused' ? tickRecord.finished_at : mission.resumed_at || null,
       receipt_path: receiptPath,
       last_tick_at: tickRecord.finished_at,
@@ -9654,12 +10088,8 @@ function tickMission(args) {
 // (free text, command strings, missing paths) reads as null and falls back
 // to durable mission state.
 function readReceiptProof(proof, root = process.cwd()) {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(path.resolve(root, String(proof || '')), 'utf8'));
-    return parsed?.schema === 'atris.mission_receipt.v1' ? parsed : null;
-  } catch {
-    return null;
-  }
+  const parsed = readJson(path.resolve(root, String(proof || '')));
+  return parsed?.schema === 'atris.mission_receipt.v1' ? parsed : null;
 }
 
 function receiptShowsPass(receipt) {
@@ -9698,6 +10128,11 @@ function missionCompletionGate(mission, proof, root = process.cwd()) {
 
 function completeMission(args) {
   const asJson = wantsJson(args);
+  if (hasFlag(args, '--help') || hasFlag(args, '-h') || String(args[0] || '').trim() === 'help') {
+    console.log('Usage: atris mission complete <id> --proof "..."');
+    console.log('Run `atris mission --help` for the full option list.');
+    process.exit(0);
+  }
   const force = hasFlag(args, '--force');
   const proof = readFlag(args, '--proof', '');
   const ref = stripKnownFlags(args, ['--proof'], ['--json', '--force'])[0] || '';
@@ -9773,31 +10208,21 @@ function completeMission(args) {
   );
 }
 
-function stopMission(args) {
-  const asJson = wantsJson(args);
-  const reason = readFlag(args, '--reason', 'stopped by operator');
-  const pause = hasFlag(args, '--pause');
-  const ref = stripKnownFlags(args, ['--reason'], ['--json', '--pause'])[0] || '';
-  if (!ref) {
-    exitMissionError('Usage: atris mission stop <id> [--pause] [--reason "..."]', 1, asJson);
-  }
-  const mission = resolveMission(ref);
-  if (!mission) {
-    exitMissingMission(ref, 1, asJson);
-  }
+function stopMissionRecord(mission, reason, root = process.cwd(), options = {}) {
+  const pause = options.pause === true;
   const status = pause ? 'paused' : 'stopped';
   // Full stops abandon work, so leave evidence: snapshot the worktree against
   // the mission baseline (what did this mission leave dirty?) before pruning it.
   let receiptPath = null;
-  if (!pause) {
-    const snapshot = gitWorktreeSnapshot(process.cwd());
+  if (!pause && options.writeStopReceipt !== false) {
+    const snapshot = gitWorktreeSnapshot(root);
     const worktree = worktreeReceipt(snapshot, snapshot, {
       verifier: mission.verifier,
-      baseline: loadMissionWorktreeBaseline(mission.id, process.cwd()),
+      baseline: loadMissionWorktreeBaseline(mission.id, root),
     });
-    receiptPath = writeReceipt(mission, { kind: 'mission_stop', reason, worktree });
+    receiptPath = writeReceipt(mission, { kind: 'mission_stop', reason, worktree }, root);
   }
-  const baselineSummary = pause ? null : pruneMissionWorktreeBaseline(mission, process.cwd());
+  const baselineSummary = pause ? null : pruneMissionWorktreeBaseline(mission, root);
   const next = {
     ...mission,
     status,
@@ -9808,9 +10233,32 @@ function stopMission(args) {
     worktree_baseline: baselineSummary || mission.worktree_baseline || null,
     next_action: status === 'paused' ? `resume with: atris mission tick ${mission.id}` : 'mission stopped',
   };
-  const { mission: saved } = saveMission(next, process.cwd(), pause ? 'mission_paused' : 'mission_stopped', { reason, receipt_path: receiptPath });
-  const directGoalRequestCleared = pause ? false : clearDirectRunCodexGoalRequestForMission(saved.id, process.cwd());
-  const logPath = appendMemberLog(saved.owner, pause ? 'Mission paused' : 'Mission stopped', { mission: saved.objective, reason });
+  const { mission: saved } = saveMission(next, root, pause ? 'mission_paused' : 'mission_stopped', { reason, receipt_path: receiptPath });
+  const directGoalRequestCleared = pause ? false : clearDirectRunCodexGoalRequestForMission(saved.id, root);
+  const logPath = appendMemberLog(saved.owner, pause ? 'Mission paused' : 'Mission stopped', { mission: saved.objective, reason }, root);
+  return { saved, receiptPath, directGoalRequestCleared, logPath };
+}
+
+function stopMission(args) {
+  const asJson = wantsJson(args);
+  // Help is read-only: `mission stop <id> --help` must never resolve the id and
+  // stop the mission just to be asked for usage.
+  if (hasFlag(args, '--help') || hasFlag(args, '-h') || String(args[0] || '').trim() === 'help') {
+    console.log('Usage: atris mission stop <id> [--pause] [--reason "..."]');
+    console.log('Run `atris mission --help` for the full option list.');
+    process.exit(0);
+  }
+  const reason = readFlag(args, '--reason', 'stopped by operator');
+  const pause = hasFlag(args, '--pause');
+  const ref = stripKnownFlags(args, ['--reason'], ['--json', '--pause'])[0] || '';
+  if (!ref) {
+    exitMissionError('Usage: atris mission stop <id> [--pause] [--reason "..."]', 1, asJson);
+  }
+  const mission = resolveMission(ref);
+  if (!mission) {
+    exitMissingMission(ref, 1, asJson);
+  }
+  const { saved, receiptPath, directGoalRequestCleared, logPath } = stopMissionRecord(mission, reason, process.cwd(), { pause });
   printJsonOrText(
     { ok: true, action: pause ? 'mission_paused' : 'mission_stopped', mission: saved, receipt_path: receiptPath, log_path: logPath, direct_goal_request_cleared: directGoalRequestCleared },
     [
@@ -10343,12 +10791,7 @@ function layersMission(args) {
   }
   for (const file of files) {
     if (missionFilter && !file.includes(missionFilter)) continue;
-    let receipt;
-    try {
-      receipt = JSON.parse(fs.readFileSync(path.join(paths.runsDir, file), 'utf8'));
-    } catch {
-      continue;
-    }
+    const receipt = readJson(path.join(paths.runsDir, file));
     if (sinceMs != null) {
       const atMs = Date.parse(receipt && receipt.at);
       if (Number.isNaN(atMs) || atMs < sinceMs) continue;
@@ -10506,6 +10949,11 @@ function inspectMission(args) {
 // output so callers (member ping) can compose their own multi-lane report.
 function pingMission(args, opts = {}) {
   const asJson = args.includes('--json');
+  if (!opts.silent && (hasFlag(args, '--help') || hasFlag(args, '-h') || String(args[0] || '').trim() === 'help')) {
+    console.log('Usage: atris mission ping <id> "<note>" [--from <who>] [--json]');
+    console.log('Run `atris mission --help` for the full option list.');
+    process.exit(0);
+  }
   const rest = args.filter((a) => a !== '--json');
   let from = process.env.USER || 'operator';
   const fromIdx = rest.indexOf('--from');
@@ -10546,6 +10994,36 @@ function pingMission(args, opts = {}) {
   return saved;
 }
 
+function answerMissionHumanAsk(ref, askIndex, answer, note = '') {
+  const found = findMissionAcrossWorktrees(ref);
+  if (!found) throw new Error(`mission not found: ${ref}`);
+  const { mission, root } = found;
+  const humanAsks = normalizeHumanAsks(mission.human_asks);
+  const ask = humanAsks[askIndex];
+  if (!ask || !ask.text.trim()) throw new Error(`human ask not found at index ${askIndex}`);
+  if (ask.answered_at) throw new Error('human ask is already answered');
+  const normalizedAnswer = String(answer || '').toLowerCase();
+  if (!['yes', 'no'].includes(normalizedAnswer)) throw new Error('human ask answer must be yes or no');
+  const answeredAt = stampIso();
+  humanAsks[askIndex] = {
+    ...ask,
+    answered_at: answeredAt,
+    answer: normalizedAnswer,
+    note: String(note || '').trim(),
+  };
+  return saveMission(
+    { ...mission, human_asks: humanAsks },
+    root,
+    'mission_human_ask_answered',
+    {
+      ask_index: askIndex,
+      text: ask.text.slice(0, 200),
+      answer: normalizedAnswer,
+      note: String(note || '').trim(),
+    },
+  ).mission;
+}
+
 function missionCommand(args) {
   const subcommand = args[0] || 'status';
   const rest = args.slice(1);
@@ -10654,6 +11132,7 @@ function missionCommand(args) {
 }
 
 module.exports = {
+  missionProtectedLaneHold,
   missionCommand,
   startMission,
   spawnMissionDriver,
@@ -10670,10 +11149,12 @@ module.exports = {
   findActiveTwinMission,
   TWIN_ACTIVE_STATUSES,
   pingMission,
+  answerMissionHumanAsk,
   buildTickPrompt,
   extractCheckFeedback,
   loadMissionMap,
   renderMissionStatus,
+  missionObjectiveIsJunk,
   selectDueMission,
   selectAtrisGoalMission,
   selectCodexGoalMission,
@@ -10682,29 +11163,22 @@ module.exports = {
   cappedClaudeReceiptText,
   extractLayerFromReceiptText,
   classifyPathsByLayer,
-  collectMissionDoctorFindings,
   resolveClaudeRunnerModel,
   resolveClaudeRunnerBin,
   businessIdForAtris2Mission,
   detectUnavailableModel,
   missionPauseNextAction,
-  HUMAN_BLOCKING_PAUSE_REASONS,
   composeHumanBlockingPauseMessage,
   escalateHumanBlockingPause,
-  humanBlockingPauseReason,
   consecutiveSameReasonErrors,
   missionVerifierTimeoutMs,
   missionLandingStepSummary,
   missionLandingLines,
   missionVerifierCheckedText,
   missionVerifierHighLevelTestText,
-  missionTickVerification,
-  missionVerificationDebt,
-  missionVerificationDebtLine,
-  missionReportFor,
-  renderMemberNowMarkdown,
   buildEngineVerifyPrompt,
   engineVerifierResultFromRun,
+  runVerifier,
   missionFullBudgetRemainingSeconds,
   missionBudgetContinuationText,
   missionHumanStatusText,
@@ -10718,4 +11192,6 @@ module.exports = {
   missionJudgmentCard,
   missionShippedCard,
   appendMissionJudgmentCard,
+  acquireMissionLock,
+  releaseMissionLock,
 };