atris 3.57.3 → 3.58.5

package/lib/engine-ask.js

@@ -24,13 +24,13 @@ const DEFAULT_ASK_CONCURRENCY = 3;
 const DEFAULT_ASK_TIMEOUT_MS = 120000;
 const MAX_ASK_CONCURRENCY = 4;
 const MAX_ASK_JOBS = 8;
-const MAX_ASK_TIMEOUT_MS = 10 * 60 * 1000;
-const DEFAULT_FABLE_ASK_TIMEOUT_MS = MAX_ASK_TIMEOUT_MS;
+const DEFAULT_FABLE_ASK_TIMEOUT_MS = 10 * 60 * 1000;
+const MAX_ASK_TIMEOUT_MS = 60 * 60 * 1000;
 const MAX_ASK_PROMPT_BYTES = 16 * 1024;
 const MAX_ASK_TOTAL_PROMPT_BYTES = 64 * 1024;
 const MAX_ASK_OUTPUT_BYTES = 1024 * 1024;
 const ASK_STOP_GRACE_MS = 250;
-const ASK_MODEL_ENGINES = new Set(['claude', 'fable', 'haiku', 'codex', 'cursor', 'devin', 'grok', 'agy']);
+const ASK_MODEL_ENGINES = new Set(['claude', 'fable', 'haiku', 'codex', 'cursor', 'devin', 'grok', 'agy', 'opencode', 'commandcode']);
 const READ_ONLY_PREAMBLE = [
   'This is a read-only request.',
   'Do not modify files, create worktrees, start background agents, or run commands with side effects.',
@@ -49,6 +49,9 @@ function askUsage() {
     `  --timeout <sec>    per-engine timeout, 1-${MAX_ASK_TIMEOUT_MS / 1000} (default ${DEFAULT_ASK_TIMEOUT_MS / 1000}; Fable ${DEFAULT_FABLE_ASK_TIMEOUT_MS / 1000})`,
     '  --json             print the receipt as json',
     '',
+    'long jobs: set --timeout explicitly; agy receives the same print deadline.',
+    'watch a running receipt from another shell: atris engine watch latest',
+    '',
     `jobs files contain up to ${MAX_ASK_JOBS} objects: [{"engine":"codex","model":"optional","prompt":"question","label":"optional"}]`,
   ].join('\n');
 }
@@ -202,7 +205,9 @@ function resolveAskModel(engine, modelName = '') {
   return RUNNER_PROFILE_DEFS[engine]?.model || DEFAULT_CLAUDE_RUNNER_MODEL;
 }
 
-function buildReadOnlyEngineInvocation(engineName, prompt, modelName = '') {
+function buildReadOnlyEngineInvocation(engineName, prompt, modelName = '', {
+  timeoutMs = DEFAULT_ASK_TIMEOUT_MS,
+} = {}) {
   const engine = canonicalEngineName(engineName);
   const profile = RUNNER_PROFILE_DEFS[engine];
   if (!profile) throw new Error(`unknown engine "${engineName}"`);
@@ -222,7 +227,6 @@ function buildReadOnlyEngineInvocation(engineName, prompt, modelName = '') {
         '--model', model || profile.model || DEFAULT_CLAUDE_RUNNER_MODEL,
         '--tools', 'Read,Glob,Grep,WebSearch,WebFetch',
         '--permission-mode', 'plan',
-        '--safe-mode',
         '--no-session-persistence',
       ],
     };
@@ -259,9 +263,28 @@ function buildReadOnlyEngineInvocation(engineName, prompt, modelName = '') {
     return {
       engine,
       bin: profile.bin,
-      args: ['--mode', 'plan', '--sandbox', '--dangerously-skip-permissions', ...(model ? ['--model', model] : []), '-p', request],
+      args: [
+        '--mode', 'plan',
+        '--sandbox',
+        '--dangerously-skip-permissions',
+        '--print-timeout', `${Math.max(1, Math.ceil(timeoutMs / 1000))}s`,
+        ...(model ? ['--model', model] : []),
+        '-p', request,
+      ],
     };
   }
+  if (engine === 'commandcode') {
+    // Headless print mode blocks file edits and shell commands by default,
+    // so plain -p is already read-only; no sandbox flags needed. Default is
+    // no --model: the run rides this machine's configured Command Code
+    // default, with an explicit ask --model still honored.
+    return { engine, bin: profile.bin, args: ['-p', request, ...(model ? ['--model', model] : [])] };
+  }
+  if (engine === 'opencode') {
+    // `run` with a message is headless print mode; the built-in plan agent
+    // keeps the ask read-only (verified live 2026-08-21, ~7s per lookup).
+    return { engine, bin: profile.bin, args: ['--agent', 'plan', ...(model ? ['-m', model] : []), request] };
+  }
   throw new Error(`engine ask has no read-only command for ${engine}`);
 }
 
@@ -293,6 +316,33 @@ function cancelledAskResult(job, extra = {}) {
   };
 }
 
+function normalizeAskResult(engine, result = {}) {
+  const output = `${String(result.stdout || '')}\n${String(result.stderr || '')}`;
+  if (engine === 'agy' && !result.cancelled && /timeout waiting for response/i.test(output)) {
+    return { ...result, ok: false, reason: 'timeout', timed_out: true };
+  }
+  return result;
+}
+
+function osAccountName() {
+  try {
+    return String(os.userInfo().username || '').trim();
+  } catch {
+    return '';
+  }
+}
+
+// Claude Code looks up macOS Keychain with process.env.USER, not whoami.
+// Host apps sometimes pass a display name, so pin USER and LOGNAME to the OS account.
+function buildAskSpawnEnv(sourceEnv = process.env) {
+  const env = { ...sourceEnv };
+  const username = osAccountName();
+  if (!username) return env;
+  env.USER = username;
+  env.LOGNAME = username;
+  return env;
+}
+
 function runAskProcess(invocation, {
   cwd = process.cwd(),
   timeoutMs = DEFAULT_ASK_TIMEOUT_MS,
@@ -387,7 +437,7 @@ function runAskProcess(invocation, {
     try {
       child = spawnProcess(invocation.bin, invocation.args, {
         cwd,
-        env: process.env,
+        env: buildAskSpawnEnv(),
         detached: process.platform !== 'win32',
         stdio: ['ignore', 'pipe', 'pipe'],
       });
@@ -430,7 +480,7 @@ async function runEngineAskJobs(jobs, {
   const answers = new Array(jobs.length);
   let nextIndex = 0;
   const execute = executeAskJob || (async (job) => {
-    const invocation = buildReadOnlyEngineInvocation(job.engine, job.prompt, job.model);
+    const invocation = buildReadOnlyEngineInvocation(job.engine, job.prompt, job.model, { timeoutMs });
     return runAskProcess(invocation, { cwd: invocation.cwd || root, timeoutMs, signal, onOutputChunk });
   });
   const workerCount = Math.min(concurrency, jobs.length);
@@ -447,7 +497,8 @@ async function runEngineAskJobs(jobs, {
       }
       try {
         assertAskModelSupported(job.engine, job.model);
-        answers[index] = { ...job, ...(await execute(job, { root, timeoutMs, index, signal, onOutputChunk })) };
+        const result = await execute(job, { root, timeoutMs, index, signal, onOutputChunk });
+        answers[index] = { ...job, ...normalizeAskResult(job.engine, result) };
       } catch (error) {
         answers[index] = {
           ...job,
@@ -568,12 +619,17 @@ async function runEngineAskCommand(args, root = process.cwd(), deps = {}) {
     started_at: startedAt,
     at: startedAt,
     read_only: true,
+    timeout_ms: parsed.timeoutMs,
   };
   const receiptPath = (deps.createReceipt || createEngineAskReceipt)(root, runningReceipt);
   const relativeReceiptPath = path.relative(root, receiptPath) || receiptPath;
   const liveLogPath = (deps.createLiveLog || createEngineLiveLog)(receiptPath);
   runningReceipt.live_log = path.relative(root, liveLogPath) || liveLogPath;
   (deps.updateReceipt || atomicWriteEngineAskReceipt)(receiptPath, runningReceipt);
+  if (!parsed.json) {
+    console.log(`engine ask started: ${relativeReceiptPath}`);
+    console.log(`watch: atris engine watch ${path.basename(receiptPath, '.json')}`);
+  }
   const appendLiveLog = deps.appendLiveLog
     || ((filePath, chunk) => appendEngineLiveLogChunk(filePath, chunk));
   let interruptedSignal = '';
@@ -671,6 +727,7 @@ module.exports = {
   MAX_ASK_PROMPT_BYTES,
   parseEngineAskArgs,
   buildReadOnlyEngineInvocation,
+  buildAskSpawnEnv,
   runAskProcess,
   runEngineAskJobs,
   runEngineAskCommand,

package/lib/engine-registry.js

@@ -7,6 +7,7 @@ const {
   RUNNER_PROFILE_DEFS,
   RUNNER_PROFILE_ALIASES,
   RUNNER_PROFILE_NAMES,
+  HIDDEN_PROFILE_NAMES,
 } = require('./runner-command');
 const { rankEnginesDetailed, routerPickExplanation } = require('./router-brain');
 
@@ -53,6 +54,7 @@ const ENGINE_SEED_META = Object.freeze({
     tier: 'pro',
     roles: Object.freeze(['executor']),
     models: Object.freeze([
+      'gemini-3.8-flash-high',
       'gemini-3.7-flash-high',
       'gemini-3.1-pro-high',
       'claude-sonnet-4-6',
@@ -62,6 +64,15 @@ const ENGINE_SEED_META = Object.freeze({
     duty: 'errands',
     fallback_order: 90,
   }),
+  opencode: Object.freeze({ tier: 'pro', roles: Object.freeze(['executor']), models: Object.freeze(['opencode/big-pickle', 'opencode/claude-opus-4-8', 'opencode/gpt-5.2']), fallback_order: 95 }),
+  commandcode: Object.freeze({
+    tier: 'max',
+    roles: Object.freeze(['validator', 'executor']),
+    // No pinned model: the engine rides this machine's Command Code default.
+    models: Object.freeze(['machine default']),
+    duty: 'errands',
+    fallback_order: 98,
+  }),
 });
 
 function engineRegistryFile(root = process.cwd()) {
@@ -176,7 +187,9 @@ function seededRegistry(root = process.cwd(), preloadedRaw = null) {
   return {
     schema: ENGINE_REGISTRY_SCHEMA,
     updated_at: new Date().toISOString(),
-    engines: RUNNER_PROFILE_NAMES.map((id) => normalizeEngineEntry(id, savedById.get(id) || {})),
+    // Hidden profiles are registered engines too: they seed, route, and take
+    // health policy exactly like visible ones.
+    engines: Object.keys(RUNNER_PROFILE_DEFS).map((id) => normalizeEngineEntry(id, savedById.get(id) || {})),
   };
 }
 
@@ -192,7 +205,7 @@ function writeEngineRegistry(root, registry) {
 
 function setEngineOverrides(name, overrides = {}, root = process.cwd()) {
   const id = canonicalEngineName(name);
-  const knownIds = RUNNER_PROFILE_NAMES.filter((engineId) => ENGINE_SEED_META[engineId]);
+  const knownIds = Object.keys(RUNNER_PROFILE_DEFS).filter((engineId) => ENGINE_SEED_META[engineId]);
   if (!id || !knownIds.includes(id)) {
     throw new Error(`Unknown engine "${name}". Known engines: ${knownIds.join(', ')}`);
   }

package/lib/file-ops.js

@@ -83,7 +83,7 @@ function createLogFile(logFile, dateFormatted) {
   const backlogBody = carryBacklog ? `${carryBacklog}\n\n` : '';
   const inboxBody = carryInbox ? `${carryInbox}\n\n` : '';
 
-  const initialContent = `# Log — ${dateFormatted}\n\n## Handoff\n\n---\n\n## Completed ✅\n\n---\n\n## In Progress 🔄\n\n${inProgressBody}---\n\n## Backlog\n\n${backlogBody}---\n\n## Notes\n\n---\n\n## Inbox\n\n${inboxBody}\n`;
+  const initialContent = `# Log, ${dateFormatted}\n\n## Handoff\n\n---\n\n## Completed ✅\n\n---\n\n## In Progress 🔄\n\n${inProgressBody}---\n\n## Backlog\n\n${backlogBody}---\n\n## Notes\n\n---\n\n## Inbox\n\n${inboxBody}\n`;
   fs.writeFileSync(logFile, initialContent);
 }
 

package/lib/fleet.js

@@ -4,11 +4,11 @@
 // --fleet`), the full loop inside: staff every idle engine on claimable
 // safe-lane tasks, one mission per task, one worktree per engine, land
 // arrivals serially. Proven by hand on 2026-07-02 (PRs #191-193, three
-// engines) before any of this code existed — each function here is one thing
+// engines) before any of this code existed, each function here is one thing
 // the orchestrator did manually that day.
 //
 // INVARIANT: the fleet has NO state file. Flight state IS missions +
-// worktrees + receipts. Kill a flight mid-run and nothing is orphaned — it
+// worktrees + receipts. Kill a flight mid-run and nothing is orphaned, it
 // is just missions in flight, resumable the normal way.
 
 const fs = require('fs');
@@ -48,7 +48,7 @@ const { appendEngineLiveLogChunk, createEngineLiveLog, engineTerminalReason } =
 const DENIED_TAGS = ['billing', 'money', 'payments', 'deploy', 'security', 'customer', 'external', 'feedback'];
 
 // ---------------------------------------------------------------------------
-// T1 — dispatch primitive
+// T1: dispatch primitive
 
 // A task's own text is its spec: the board convention writes "Done: ..." and
 // "Check: ..." into the title/description. Extract both so the dispatch
@@ -68,10 +68,10 @@ function parseDoneCheck(text) {
 // hypothesis-driven unsticking, smallest diff.
 const METHOD_KERNEL = [
   'Read this whole brief before acting; locate every file you will touch before editing any of them.',
-  'Never pipe a verify or test command through tail/head/grep — run it bare and read the real exit code.',
+  'Never pipe a verify or test command through tail/head/grep, run it bare and read the real exit code.',
   'Done requires a receipt: paste the exact verify command and its final output lines in your report.',
   'Before deleting or renaming any function or call site, grep the whole repo for its callers; a caller outside your change means the contract stays intact.',
-  'Stuck? Never run the same failing command a third time — write 3 one-line hypotheses, then run the cheapest test that discriminates between them.',
+  'Stuck? Never run the same failing command a third time, write 3 one-line hypotheses, then run the cheapest test that discriminates between them.',
   'Smallest diff that satisfies Done wins; prefer deleting code over adding it.',
 ];
 
@@ -99,7 +99,7 @@ function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
     '',
     ATRIS_BUILD_PROCESS_PREAMBLE,
     '',
-    `You are working task ${ref} in this repo checkout (an isolated git worktree${worktreePath ? ` at ${worktreePath}` : ''} — commit here, NEVER push).`,
+    `You are working task ${ref} in this repo checkout (an isolated git worktree${worktreePath ? ` at ${worktreePath}` : ''}, commit here, NEVER push).`,
     '',
     `Task: ${title}`,
     '',
@@ -145,10 +145,10 @@ function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
 }
 
 // Shell command that runs one engine on one prompt file, from the worktree.
-// Rides the same profile definitions the whole CLI uses — no fleet-only
+// Rides the same profile definitions the whole CLI uses, no fleet-only
 // spawn shapes.
 // Build work needs file tools: allowedTools reaches the default claude-shaped
-// spawn; template engines (cursor/codex/devin) ignore it — their CLIs manage
+// spawn; template engines (cursor/codex/devin) ignore it, their CLIs manage
 // their own permissions.
 const FLEET_ALLOWED_TOOLS = 'Bash,Read,Edit,Write,Grep,Glob';
 const VALIDATOR_ALLOWED_TOOLS = 'Bash,Read,Grep,Glob';
@@ -864,7 +864,7 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
 }
 
 // ---------------------------------------------------------------------------
-// T2 — staffing
+// T2: staffing
 
 const {
   taskTagTokens,
@@ -894,7 +894,7 @@ function isSafeLane(task) {
 }
 
 // Rough file-surface guess from a task's text: paths and bare `commands/x.js`
-// style mentions. Used only to keep concurrent picks disjoint — the merge
+// style mentions. Used only to keep concurrent picks disjoint, the merge
 // conflict on 2026-07-02 (two engines in commands/mission.js) is the tax this
 // avoids.
 function fileSurface(task) {
@@ -938,7 +938,7 @@ function assignEngines(staffed, engines) {
 }
 
 // ---------------------------------------------------------------------------
-// T3 — serial landing lane
+// T3: serial landing lane
 
 // Land one arrival: rebase onto latest base first; a conflict pauses the
 // landing (never auto-resolve) and reports which files collided so the
@@ -971,7 +971,7 @@ function dispatchResultToTerminal(entry = {}, result = {}) {
 }
 
 // Fleet landings always target master. Without the explicit --target, ship
-// falls back to the launcher branch's atris-base — a flight launched from a
+// falls back to the launcher branch's atris-base, a flight launched from a
 // feature-branch checkout would merge PRs into that branch while the receipt
 // and land board define "landed" as in-master (PRs #207/#208, 2026-07-04).
 // A ship failure must name its real cause. MODULE_NOT_FOUND from the spawned
@@ -1010,8 +1010,8 @@ function fleetShipArgs(entry, check) {
 // A fleet build worktree is ephemeral. If any process inside one runs
 // `npm link` (which repoints the global `atris` package symlink at that
 // worktree), then removing the worktree at teardown leaves the global `atris`
-// binary a dangling symlink, and everything resolving `atris` through PATH —
-// interactive shells, any tooling that shells out to the bare command — dies
+// binary a dangling symlink, and everything resolving `atris` through PATH:
+// interactive shells, any tooling that shells out to the bare command, dies
 // with 'command not found'. Measured scope, not assumed: crons that invoke
 // `node <checkout>/bin/atris.js` by absolute path are UNAFFECTED; an autoland
 // tick ran fine four minutes before the repair. The failure is silent and
@@ -1083,7 +1083,7 @@ function guardGlobalCliLink({
   };
 }
 
-// One-line " (path, path)" suffix naming the files behind a paused landing —
+// One-line " (path, path)" suffix naming the files behind a paused landing,
 // unmerged files for a rebase_conflict, uncommitted paths for a dirty_worktree.
 function pausedPathsSuffix(landed) {
   const paths = (landed && landed.conflicts) || (landed && landed.dirty) || [];
@@ -1166,10 +1166,10 @@ module.exports = {
 };
 
 // ---------------------------------------------------------------------------
-// T4 — the conductor: one flight, watchable, receipted
+// T4, the conductor: one flight, watchable, receipted
 
 // Engines that can edit a repo headlessly. atris-fast (ax) is a chat lane,
-// not a repo worker — it keeps owning normal mission ticks, not fleet builds.
+// not a repo worker, it keeps owning normal mission ticks, not fleet builds.
 const FLEET_CAPABLE = ['claude', 'codex', 'cursor', 'devin', 'grok'];
 const DISPATCH_CAPABLE = [...FLEET_CAPABLE, 'fable', 'commandcode'];
 
@@ -2326,6 +2326,33 @@ function defaultOwnCli(root) {
   };
 }
 
+// A merge and its task handoff are separate writes. Keep the merge on disk
+// before attempting the handoff, and never report success if that write fails.
+function recordLandedTaskReview(cli, args, { flight, landedRow, worktree, save }) {
+  landedRow.review_recorded = false;
+  save();
+  let result;
+  try { result = cli(args); } catch (error) {
+    result = { status: null, stderr: error.message };
+  }
+  if (!result || result.status !== 0) {
+    flight.paused.push({
+      task: landedRow.task,
+      engine: landedRow.engine,
+      stage: 'task_ready',
+      landed: true,
+      worktree,
+      detail: headTail(String(result && (result.stderr || result.stdout) || 'task ready failed')),
+      next_action: 'record fresh task proof with task ready; do not rebuild or merge again',
+    });
+    save();
+    return false;
+  }
+  landedRow.review_recorded = true;
+  save();
+  return true;
+}
+
 // Extract a runnable focused check from the task's Check: line; the wide
 // gates (npm test, CI) stay at the ship gate, not per-arrival.
 function focusedCheck(task) {
@@ -2539,7 +2566,7 @@ async function runFleetFlight({
 
   const staffed = assignEngines(staffedTasks, roster);
   // The receipt path is decided BEFORE landings so each task's ready-proof
-  // can cite it — the proof policy certifies receipt-backed proofs agent-side.
+  // can cite it, the proof policy certifies receipt-backed proofs agent-side.
   const receiptPath = path.join(root, 'atris', 'runs', `fleet-${nowStamp()}.json`);
   const flight = {
     at: new Date().toISOString(),
@@ -2557,7 +2584,7 @@ async function runFleetFlight({
   }
 
   log('');
-  log(`  fleet — ${roster.length} engine${roster.length === 1 ? '' : 's'} ready, ${staffed.length} task${staffed.length === 1 ? '' : 's'} staffed`);
+  log(`  fleet, ${roster.length} engine${roster.length === 1 ? '' : 's'} ready, ${staffed.length} task${staffed.length === 1 ? '' : 's'} staffed`);
   for (const s of staffed) log(`    ${s.engine.padEnd(8)} → ${s.task.display_id}  ${String(s.task.title || '').slice(0, 80)}`);
   log('');
 
@@ -2596,7 +2623,7 @@ async function runFleetFlight({
     if (!claimed || claimed.status !== 0) {
       const detail = String(claimed && (claimed.stderr || claimed.stdout) || 'claim failed').trim().slice(0, 300);
       flight.paused.push({ task: entry.task.display_id, engine: entry.engine, stage: 'claim', detail });
-      log(`    ${entry.engine.padEnd(8)} ⏸ paused ${entry.task.display_id} at claim${detail ? ` — ${detail}` : ''}`);
+      log(`    ${entry.engine.padEnd(8)} ⏸ paused ${entry.task.display_id} at claim${detail ? `, ${detail}` : ''}`);
       continue;
     }
     const started = cli(['worktree', 'start', '--agent', entry.engine, '--task', `fleet-${String(entry.task.display_id).toLowerCase()}`, ...startBaseArgs]);
@@ -2658,7 +2685,7 @@ async function runFleetFlight({
       if (result.deadEngine) paused.deadEngine = result.deadEngine;
       flight.paused.push(paused);
       stampDispatchBrief(root, result.brief_id, 'fail', `build failed for ${entry.task.display_id}`);
-      log(`    ${activeEngine.padEnd(8)} ✗ build failed ${entry.task.display_id} — worktree kept for takeover`);
+      log(`    ${activeEngine.padEnd(8)} ✗ build failed ${entry.task.display_id}, worktree kept for takeover`);
       continue;
     }
     log(`    ${activeEngine.padEnd(8)} landing ${entry.task.display_id}...`);
@@ -2668,19 +2695,24 @@ async function runFleetFlight({
       if (result.brief_id) landedRow.brief_id = result.brief_id;
       if (result.restaffed) landedRow.restaffed = result.restaffed;
       flight.landed.push(landedRow);
-      stampDispatchBrief(root, result.brief_id, 'pass', `landed ${entry.task.display_id} via fleet ship`);
       const restaffProof = result.restaffed ? ` Restaffed from ${result.restaffed.from} to ${result.restaffed.to} (${result.restaffed.reason}).` : '';
-      cli([
+      const reviewRecorded = recordLandedTaskReview(cli, [
         'task', 'ready', String(entry.task.display_id),
         '--proof', `Built by ${activeEngine} engine in fleet flight.${restaffProof} Landed via worktree ship gate (rebase-before-ship, verify re-run). Receipt saved at ${path.relative(root, receiptPath)}. Report tail: ${headTail(String(result.report || '').replace(/\n/g, ' '))}`,
         '--result', 'Operators can now review fleet-shipped work faster because the worktree was verified before landing.',
         '--as', `fleet-${activeEngine}`,
-      ]);
+      ], { flight, landedRow, worktree: entry.worktreePath, save: () => atomicWriteFlightReceipt(flight, receiptPath) });
+      if (!reviewRecorded) {
+        stampDispatchBrief(root, result.brief_id, 'partial', `landed ${entry.task.display_id}, but task ready failed`);
+        log('    the change landed, but saving its proof failed. repair the task record before starting more work.');
+        continue;
+      }
+      stampDispatchBrief(root, result.brief_id, 'pass', `landed ${entry.task.display_id} via fleet ship`);
       log(`    ${activeEngine.padEnd(8)} ✓ landed ${entry.task.display_id}`);
     } else {
       flight.paused.push({ task: entry.task.display_id, engine: activeEngine, ...(result.restaffed ? { restaffed: result.restaffed } : {}), ...landed });
       stampDispatchBrief(root, result.brief_id, 'partial', `paused ${entry.task.display_id} at ${landed.stage || 'landing'}`);
-      log(`    ${activeEngine.padEnd(8)} ⏸ paused ${entry.task.display_id} at ${landed.stage}${pausedPathsSuffix(landed)} — worktree kept`);
+      log(`    ${activeEngine.padEnd(8)} ⏸ paused ${entry.task.display_id} at ${landed.stage}${pausedPathsSuffix(landed)}, worktree kept`);
     }
   }
 
@@ -2714,7 +2746,7 @@ async function runFleetFlight({
 }
 
 // ---------------------------------------------------------------------------
-// T5 — one-command dispatch: `atris engine dispatch <task-id> --engine <name>`
+// T5, one-command dispatch: `atris engine dispatch <task-id> --engine <name>`
 
 // A claim taken before the engine starts must not stay held if the flight
 // refuses or errors first. Release through the same task plane the claim used.
@@ -2736,7 +2768,7 @@ function releaseUnstartedDispatchClaim(cli, { taskId, actor, detail }) {
 // claim so takeover stays attributed.
 function releasePausedClaimsWithoutWork(cli, { paused, worktreeByTask, actorByTask, baseRef = 'origin/master', log = () => {} }) {
   for (const row of paused || []) {
-    if (row.stage === 'claim' || row.stage === 'task_lookup') continue; // claim never held
+    if (row.stage === 'claim' || row.stage === 'task_lookup' || row.landed === true) continue; // no claim, or work already landed
     if (row.claim_released !== undefined) continue;
     const taskId = String(row.task || '');
     const actor = actorByTask.get(taskId);
@@ -2815,7 +2847,7 @@ async function runDispatchFlight({
   }
 
   const cli = ownCli || defaultOwnCli(root);
-  // Cut worktrees from — and check self-landing against — the workspace's real
+  // Cut worktrees from, and check self-landing against, the workspace's real
   // protected branch, not a hard-coded origin/master (CLI-1298).
   const landTarget = resolveDispatchLandTarget(root, checkoutBase);
   const verify = verifier || (trustedVerifier ? defaultTrustedVerifyRunner : defaultVerifyRunner);
@@ -2844,7 +2876,7 @@ async function runDispatchFlight({
   const liveLogPath = startLiveFlight(root, receiptPath, flight);
 
   log('');
-  log(`  dispatch — ${ids.length} task${ids.length === 1 ? '' : 's'} -> ${engine}`);
+  log(`  dispatch, ${ids.length} task${ids.length === 1 ? '' : 's'} -> ${engine}`);
   log('');
 
   // Same rule as the fleet: dispatch worktrees cut from the protected branch by
@@ -3100,7 +3132,7 @@ async function runDispatchFlight({
       if (result.deadEngine) paused.deadEngine = result.deadEngine;
       flight.paused.push(paused);
       stampDispatchBrief(root, result.brief_id, 'fail', `build failed for ${entry.taskId}`);
-      log(`    ✗ build failed ${entry.taskId} — worktree kept for takeover`);
+      log(`    ✗ build failed ${entry.taskId}, worktree kept for takeover`);
       continue;
     }
     if (enforceRemoteBoundary && (!candidate || candidate.ok !== true)) {
@@ -3445,16 +3477,20 @@ async function runDispatchFlight({
       if (result.brief_id) landedRow.brief_id = result.brief_id;
       if (result.restaffed) landedRow.restaffed = result.restaffed;
       flight.landed.push(landedRow);
-      stampDispatchBrief(root, result.brief_id, 'pass', `landed ${entry.taskId} via engine dispatch`);
-      cli([
+      const reviewRecorded = recordLandedTaskReview(cli, [
         'task', 'ready', entry.taskId,
         '--proof', `Built by ${activeEngine} engine via atris engine dispatch.${restaffProof} Landed via worktree ship gate (rebase-before-ship, verify re-run). The declared verifier passed (exit 0). Verify output: ${verifyTail || '(command produced no output, exit 0)'}. Receipt saved at ${path.relative(root, receiptPath)}.`,
         '--result', 'Operators can now review engine-built work faster because dispatch reran the verifier before landing.',
-        '--landing', 'The verified change is on master and ready for review.',
         '--checked', `${landed.check} passed before landing`,
         '--tested', 'The requested behavior passed its declared verifier.',
         '--as', readyActor,
-      ]);
+      ], { flight, landedRow, worktree: entry.worktreePath, save: () => writeDispatchReceipt(flight, receiptPath, { ids, reviewOnly, enforceRemoteBoundary }) });
+      if (!reviewRecorded) {
+        stampDispatchBrief(root, result.brief_id, 'partial', `landed ${entry.taskId}, but task ready failed`);
+        log('    the change landed, but saving its proof failed. repair the task record before starting more work.');
+        continue;
+      }
+      stampDispatchBrief(root, result.brief_id, 'pass', `landed ${entry.taskId} via engine dispatch`);
       log(`    ✓ landed ${entry.taskId}`);
     } else {
       flight.paused.push({
@@ -3465,7 +3501,7 @@ async function runDispatchFlight({
         ...landed,
       });
       stampDispatchBrief(root, result.brief_id, 'partial', `paused ${entry.taskId} at ${landed.stage || 'landing'}`);
-      log(`    ⏸ paused ${entry.taskId} at ${landed.stage}${pausedPathsSuffix(landed)} — worktree kept`);
+      log(`    ⏸ paused ${entry.taskId} at ${landed.stage}${pausedPathsSuffix(landed)}, worktree kept`);
     }
   }
 

package/lib/html-render.js

@@ -1,4 +1,4 @@
-// Atris HTML renderer — same content model as the deck engine, rendered to
+// Atris HTML renderer, same content model as the deck engine, rendered to
 // beautiful, anti-slop HTML made of semantic blocks. Pure: spec -> HTML string.
 //
 // Connects with the web apps: the `atris` theme matches atrisos-web tokens