atris 3.64.0 → 3.66.0

package/lib/engine-registry.js

@@ -137,13 +137,20 @@ function engineFailureHealthStatus(result) {
   return engineStallReason(result) ? 'error' : null;
 }
 
+// hosted: the engine runs on Atris's own servers and bills the person's atris
+// tokens. With no roster pick the router never puts a hosted engine ahead of
+// a tool installed here; atris-fast is the last resort for search and review
+// (not build, see hostedFallbacks), and only for someone logged in to atris.
+// role_order: the engine's place for one job when it differs from its
+// fallback_order. Haiku searches first wherever the claude CLI is installed.
 const ENGINE_SEED_META = Object.freeze({
-  'atris-fast': Object.freeze({ tier: 'fast', roles: Object.freeze(['navigator']), models: Object.freeze(['atris fast']), duty: 'learning', fallback_order: 10 }),
+  'atris-fast': Object.freeze({ tier: 'fast', roles: Object.freeze(['navigator']), models: Object.freeze(['atris fast']), duty: 'learning', fallback_order: 10, hosted: true }),
   // roster_only_roles: jobs a roster pick may give this engine, but the router
-  // never hands it on its own. Claude and haiku can own search when picked;
-  // with no pick, search stays with atris-fast, then composer. Codex can own
-  // review when picked; it stays out of roles, so every review list built
-  // from roles (the router, one lap, wish audit, the chart) is unchanged.
+  // never hands it on its own. Claude can own search when picked; with no
+  // pick, search goes to haiku, then other installed tools, then atris-fast.
+  // Codex can own review when picked; it stays out of roles, so every review
+  // list built from roles (the router, one lap, wish audit, the chart) is
+  // unchanged.
   codex: Object.freeze({ tier: 'pro', roles: Object.freeze(['executor']), roster_only_roles: Object.freeze(['validator']), models: Object.freeze(['codex']), fallback_order: 10 }),
   claude: Object.freeze({ tier: 'max', roles: Object.freeze(['validator', 'executor', 'navigator']), roster_only_roles: Object.freeze(['navigator']), models: Object.freeze(['opus 5.5', 'opus 5', 'fable', 'haiku']), fallback_order: 20 }),
   cursor: Object.freeze({ tier: 'pro', roles: Object.freeze(['executor']), models: Object.freeze(['composer 2.5', 'grok 4.6', 'kimi 3']), fallback_order: 30 }),
@@ -151,8 +158,8 @@ const ENGINE_SEED_META = Object.freeze({
   devin: Object.freeze({ tier: 'max', roles: Object.freeze(['executor']), roster_only_roles: Object.freeze(['navigator']), models: Object.freeze(['built-in router']), duty: 'errands', fallback_order: 40 }),
   grok: Object.freeze({ tier: 'pro', roles: Object.freeze(['executor']), models: Object.freeze(['grok 4.7 fast', 'grok 4.7']), fallback_order: 45 }),
   fable: Object.freeze({ tier: 'max', roles: Object.freeze(['validator', 'executor']), models: Object.freeze(['opus 5.5', 'opus 5', 'fable', 'haiku']), duty: 'leader', fallback_order: 50 }),
-  composer: Object.freeze({ tier: 'fast', roles: Object.freeze(['navigator', 'executor']), models: Object.freeze(['composer 2.5']), fallback_order: 60 }),
-  haiku: Object.freeze({ tier: 'fast', roles: Object.freeze(['validator', 'navigator']), roster_only_roles: Object.freeze(['navigator']), models: Object.freeze(['haiku']), fallback_order: 70 }),
+  composer: Object.freeze({ tier: 'fast', roles: Object.freeze(['navigator', 'executor']), models: Object.freeze(['composer 2.5']), fallback_order: 60, hosted: true }),
+  haiku: Object.freeze({ tier: 'fast', roles: Object.freeze(['validator', 'navigator']), role_order: Object.freeze({ navigator: 5 }), models: Object.freeze(['haiku']), fallback_order: 70 }),
   agy: Object.freeze({
     tier: 'pro',
     roles: Object.freeze(['executor']),
@@ -203,6 +210,16 @@ function binInstalled(bin) {
   return probe.status === 0 && Boolean(String(probe.stdout || '').trim());
 }
 
+// A saved not_installed is checked again on the real clock (never a test's
+// routing clock) once its last check, or the run that found it missing, is
+// a minute old. One `command -v` per missing tool per minute, no network.
+const MISSING_RECHECK_MS = 60000;
+
+function missingCheckDue(health) {
+  const stamp = Date.parse((health && (health.checked_at || health.last_failure_ts)) || '');
+  return !Number.isFinite(stamp) || stamp + MISSING_RECHECK_MS <= Date.now();
+}
+
 function canonicalEngineName(name) {
   const trimmed = String(name || '').trim();
   if (!trimmed) return '';
@@ -256,17 +273,30 @@ function normalizeEngineEntry(id, saved = {}, now) {
   // Policy over probes: a saved health status is the routing truth, verbatim.
   // Only an engine the registry has never seen gets one seeding probe; after
   // that, installed-state changes flow through `atris engine doctor` (or
-  // `atris engine health`), never through the resolve path.
+  // `atris engine health`), never through the resolve path. One exception:
+  // a missing tool is looked for again once its check is a minute old, so a
+  // tool installed next week is picked up with no repair step.
   let status;
   let installed;
+  let checkedAt = '';
   if (ENGINE_HEALTH_STATUSES.includes(savedStatus)) {
     status = savedStatus;
     installed = typeof saved.installed === 'boolean' ? saved.installed : status !== 'not_installed';
+    if (status === 'not_installed') {
+      checkedAt = String(savedHealth.checked_at || '');
+      if (missingCheckDue(savedHealth)) {
+        installed = binInstalled(def.bin);
+        status = installed ? 'ready' : 'not_installed';
+        checkedAt = new Date().toISOString();
+      }
+    }
   } else {
     installed = binInstalled(def.bin);
     status = installed ? 'ready' : 'not_installed';
+    if (!installed) checkedAt = new Date().toISOString();
   }
   let health = { status };
+  if (status === 'not_installed' && checkedAt) health.checked_at = checkedAt;
   if (status !== 'ready' && savedHealth.last_failure_ts) health.last_failure_ts = String(savedHealth.last_failure_ts);
   if (status === 'cooling') {
     // A cooldown that has passed reads as ready, so the engine comes back
@@ -559,7 +589,12 @@ function rosterPickExpired(pick, now = new Date()) {
 // read normalizes again, so older saved picks and hand edits work too.
 const CLAUDE_FAMILY_ENGINES = Object.freeze(['claude', 'fable', 'haiku']);
 const CLAUDE_MODEL_ALIASES = Object.freeze(['opus', 'sonnet', 'haiku', 'fable', 'opusplan', 'default']);
-const CLAUDE_MODEL_DATED_IDS = Object.freeze({ 'claude-haiku-4-5': 'claude-haiku-4-5-20251001' });
+// A retired model runs as its replacement, so a saved pick keeps working
+// after the upgrade. Retiring the next one is one line here.
+const RETIRED_CLAUDE_MODELS = Object.freeze({
+  'claude-haiku-4-5': 'claude-haiku-5-5',
+  'claude-haiku-4-5-20251001': 'claude-haiku-5-5',
+});
 const CLAUDE_MODEL_SPELLING = /^(opus|sonnet|haiku|fable)[\s_-]*(\d+)(?:[\s._-]+(\d+))?$/;
 const CLAUDE_LONG_CONTEXT = /\s*\[1m\]$/;
 
@@ -574,6 +609,30 @@ function normalizeGrokModel(raw) {
   throw new Error(`grok does not know the model "${raw}". use grok 4.7 fast, grok 4.7, or a full grok- id`);
 }
 
+// The model to run for a claude id: its replacement when it is retired,
+// else the id as given. Keeps a "[1m]" tail.
+function currentClaudeModel(value) {
+  const raw = String(value || '').trim();
+  const suffix = CLAUDE_LONG_CONTEXT.test(raw) ? '[1m]' : '';
+  const base = raw.replace(CLAUDE_LONG_CONTEXT, '').trim();
+  const next = RETIRED_CLAUDE_MODELS[base.toLowerCase()];
+  return next ? `${next}${suffix}` : raw;
+}
+
+// The retired models a roster file's text still names, by id or spelled
+// out, each once, so the roster can say they were upgraded.
+function retiredModelsNamed(text) {
+  const found = [];
+  for (const id of Object.keys(RETIRED_CLAUDE_MODELS)) {
+    const [, family, major, minor] = /^claude-([a-z]+)-(\d+)-(\d+)/.exec(id) || [];
+    if (!family) continue;
+    const spelled = new RegExp(`\\b(?:claude[\\s_-]*)?${family}[\\s_-]*${major}[\\s._-]+${minor}(?![\\d.])`, 'i');
+    const base = `claude-${family}-${major}-${minor}`;
+    if (spelled.test(String(text || '')) && !found.includes(base)) found.push(base);
+  }
+  return found;
+}
+
 function normalizeRosterModel(engineId, value) {
   const raw = String(value || '').trim();
   if (!raw) return '';
@@ -588,10 +647,10 @@ function normalizeRosterModel(engineId, value) {
   const match = CLAUDE_MODEL_SPELLING.exec(lower.replace(/^claude[\s_-]*/, ''));
   if (match) {
     const id = `claude-${match[1]}-${match[2]}${match[3] ? `-${match[3]}` : ''}`;
-    return `${CLAUDE_MODEL_DATED_IDS[id] || id}${suffix}`;
+    return currentClaudeModel(`${id}${suffix}`);
   }
-  if (lower.startsWith('claude-')) return `${base}${suffix}`;
-  throw new Error(`${engineId} does not know the model "${raw}". use opus, sonnet, haiku, fable, opusplan, default, a version like opus 5.5, sonnet 5, haiku 4.5, or fable 5.1, or a full claude- id; add [1m] for the long context window`);
+  if (lower.startsWith('claude-')) return currentClaudeModel(`${base}${suffix}`);
+  throw new Error(`${engineId} does not know the model "${raw}". use opus, sonnet, haiku, fable, opusplan, default, a version like opus 5.5, sonnet 5, haiku 5.5, or fable 5.1, or a full claude- id; add [1m] for the long context window`);
 }
 
 // A saved pick's model, normalized the same way assign does. null means the
@@ -923,16 +982,25 @@ function rosterPickFromValue(value, role, options = {}) {
   let namedModel = false;
   let namedEffort = false;
   let prep = '';
+  let verified = '';
   for (const raw of extras) {
-    // "max: 20 min" and "until: 2026-10-24" read like "max 20 min".
-    const part = raw.replace(/^(max|until)\s*:\s*/i, '$1 ');
+    // "max: 20 min", "until: 2026-10-24", and "verified: 2026-09-30" read
+    // like "max 20 min".
+    const part = raw.replace(/^(max|until|verified)\s*:\s*/i, '$1 ');
     const backupMatch = /^backup\s+(.+)$/i.exec(part);
     const untilMatch = /^until\s+(.+)$/i.exec(part);
     const maxMatch = /^max\b/i.test(part) && !/^max$/i.test(part);
     const modelMatch = /^model\s*(?::\s*|\s+)(.+)$/i.exec(part);
     const effortMatch = /^effort\s*(?::\s*|\s+)(.+)$/i.exec(part);
     const prepMatch = /^prep\s*(?::\s*|\s+)(.+)$/i.exec(part);
-    if (prepMatch && !prep) {
+    const verifiedMatch = /^verified\s+(.+)$/i.exec(part);
+    if (verifiedMatch && !verified) {
+      // "verified 2026-09-30": the day a person last saw this model answer.
+      // The roster flags a pin whose newest proof is over 30 days old.
+      const words = verifiedMatch[1].trim();
+      verified = parseRosterUntilWords(words);
+      if (!verified) throw new Error(`"verified ${words}" is not a date; use verified 2026-09-30`);
+    } else if (prepMatch && !prep) {
       // "prep: search": that job's lead reads the task first and hands this
       // worker a trimmed brief. Whether it names this same job is checked
       // where the job is known.
@@ -988,6 +1056,7 @@ function rosterPickFromValue(value, role, options = {}) {
     until,
     ...(until ? {} : { never_expires: true }),
     ...(untilYearless ? { until_needs_year: untilYearless } : {}),
+    ...(verified ? { verified } : {}),
   };
 }
 
@@ -1030,6 +1099,7 @@ function rosterWorkerFromValue(value, role, options = {}) {
     until: pick.until,
     ...(pick.never_expires ? { never_expires: true } : {}),
     ...(pick.until_needs_year ? { until_needs_year: pick.until_needs_year } : {}),
+    ...(pick.verified ? { verified: pick.verified } : {}),
   };
 }
 
@@ -1078,6 +1148,7 @@ function pickWorkers(pick) {
     ...(pick.prep ? { prep: pick.prep } : {}),
     until: pick.until,
     ...(pick.never_expires ? { never_expires: true } : {}),
+    ...(pick.verified ? { verified: pick.verified } : {}),
     ...(pick.line ? { line: pick.line } : {}),
   }];
   if (pick.backup) {
@@ -1383,6 +1454,7 @@ function workerLineText(worker) {
   if (Number(worker.max_seconds) > 0) parts.push(`max: ${rosterMaxText(worker.max_seconds).replace(/^max /, '')}`);
   if (worker.prep) parts.push(`prep: ${rosterJobLabel(worker.prep)}`);
   if (worker.until) parts.push(`until ${worker.until}`);
+  if (worker.verified) parts.push(`verified ${worker.verified}`);
   return `- ${parts.join(', ')}`;
 }
 
@@ -1890,38 +1962,48 @@ function resolveEngineForRoleRanked(role, root = process.cwd(), options = {}) {
   const engines = registry.engines
     .filter((engine) => engine.roles.includes(normalizedRole))
     .filter((engine) => !routerSkipsRole(engine, normalizedRole))
+    .filter((engine) => !engineHosted(engine))
     .filter((engine) => engineReadyAt(engine, options.now))
+    .map((engine) => withRoleOrder(engine, normalizedRole))
     .sort((a, b) => {
       const byOrder = Number(a.fallback_order) - Number(b.fallback_order);
       return byOrder || String(a.id).localeCompare(String(b.id));
     });
   // Ranking reads the router's history off disk (task receipts, mission
   // events, dispatch receipts). A valid roster pick decides without it, so
-  // rank only when something asks for the full ranked list.
+  // rank only when something asks for the full ranked list. Hosted engines
+  // join after the ranking, so no track record can lift one over a tool
+  // installed here.
   let rankedCache = null;
   const rank = () => {
     if (!rankedCache) {
-      rankedCache = routerBrain.rankEnginesDetailed(engines, {
+      const ranked = routerBrain.rankEnginesDetailed(engines, {
         root,
         taskType: options.taskType || options.task_type || normalizedRole,
         lowStakes: options.lowStakes,
         stakes: options.stakes,
       });
+      rankedCache = { ...ranked, candidates: [...ranked.candidates, ...hostedFallbacks(registry, normalizedRole, options)] };
     }
     return rankedCache;
   };
   const choice = rosterChoice(normalizedRole, withProjectRoster(registry, root, options), options);
+  const label = rosterJobLabel(options.job ? rosterJobKey(options.job) || normalizedRole : normalizedRole);
   if (choice) {
     // The job's own workers go first, in order, then the router's list.
     const after = choice.walk.slice(choice.lead_index + 1).filter((step) => !step.skip).map((step) => step.raw);
     const lead = [choice.engine, ...after].filter((engine, index, list) => list.findIndex((other) => other.id === engine.id) === index);
     const leadIds = new Set(lead.map((engine) => engine.id));
+    const first = choice.walk[0];
+    const missing = choice.lead_index > 0 && first.skip === 'not ready' && engineMissing(registry, first.worker.engine)
+      ? first.worker.engine : '';
     const result = {
       engine: choice.engine,
       reason: choice.reason,
       source: choice.source,
       job: choice.job,
       team: choice.team,
+      notice: showSwitchNotice(switchNotice({ label: choice.job, role: normalizedRole, missing, engine: choice.engine }), options),
     };
     let rankedList = null;
     Object.defineProperty(result, 'ranked', {
@@ -1938,7 +2020,122 @@ function resolveEngineForRoleRanked(role, root = process.cwd(), options = {}) {
     return result;
   }
   const ranked = rank();
-  return { engine: ranked.candidates[0] || null, reason: routerPickExplanation(ranked), source: 'router', team: [], ranked: ranked.candidates };
+  const engine = ranked.candidates[0] || null;
+  const reason = engine && engineHosted(engine) && !engines.length
+    ? `router picked ${engine.id} because no tool installed here can take ${normalizedRole} work.`
+    : routerPickExplanation(ranked);
+  const notice = switchNotice({
+    label,
+    role: normalizedRole,
+    missing: missingPickedTool(normalizedRole, withProjectRoster(registry, root, options), options),
+    engine,
+    registry,
+    canLogIn: !atrisLoggedIn(options),
+  });
+  return { engine, reason, source: 'router', team: [], ranked: ranked.candidates, notice: showSwitchNotice(notice, options) };
+}
+
+// --- When a job runs somewhere other than its pick -----------------------
+
+function engineHosted(engine) {
+  const seed = engine && ENGINE_SEED_META[engine.id];
+  return Boolean(seed && seed.hosted);
+}
+
+// The engine with its place for this one job, when its seed names one.
+function withRoleOrder(engine, role) {
+  const seed = ENGINE_SEED_META[engine.id];
+  const order = seed && seed.role_order ? seed.role_order[role] : undefined;
+  return Number.isInteger(order) ? { ...engine, fallback_order: order } : engine;
+}
+
+// True when this machine is logged in to atris: an ATRIS_TOKEN, or the token
+// `atris login` saves. One file read, no process and no network, so routing
+// stays probe-free. options.loggedIn decides in tests.
+function atrisLoggedIn(options = {}) {
+  if (typeof options.loggedIn === 'boolean') return options.loggedIn;
+  if (String(process.env.ATRIS_TOKEN || '').trim()) return true;
+  try {
+    const saved = JSON.parse(fs.readFileSync(path.join(stateHome(), '.atris', 'credentials.json'), 'utf8'));
+    return Boolean(saved && saved.token);
+  } catch {
+    return false;
+  }
+}
+
+// The hosted engines that may take this job, after every installed tool:
+// atris-fast for search and review, composer for search. None without a
+// login, since a hosted run bills the person's atris tokens. None for build:
+// the hosted turn's file relay here is read-only (a 2026-10-07 probe asked
+// it to write a file and the relay refused every write), so a hosted build
+// would answer in chat and change nothing.
+function hostedFallbacks(registry, role, options = {}) {
+  if (role === 'executor' || !atrisLoggedIn(options)) return [];
+  return registry.engines
+    .filter((engine) => engineHosted(engine))
+    .filter((engine) => engine.id === 'atris-fast' || (engine.roles.includes(role) && !routerSkipsRole(engine, role)))
+    .filter((engine) => engineReadyAt(engine, options.now))
+    .sort((a, b) => Number(a.fallback_order) - Number(b.fallback_order));
+}
+
+function engineMissing(registry, engineId) {
+  const engine = registry.engines.find((entry) => entry.id === engineId);
+  return Boolean(engine && engine.health && engine.health.status === 'not_installed');
+}
+
+// The tool the first roster pick in line names for this job, when that tool
+// is not installed here. '' when no pick names a missing tool.
+function missingPickedTool(role, registry, options = {}) {
+  const machine = options.machineRosterPicks || readMachineRoster(options);
+  const session = options.sessionRosterPicks || readSessionRosterLayer(options).picks;
+  for (const key of rosterJobKeysFor(role, options)) {
+    for (const value of [session && session[key], registry.roster && registry.roster[key], machine && machine[key]]) {
+      const pick = rosterPickObject(value);
+      if (!pick || pickRoleForKey(key, pick) !== role) continue;
+      const [first] = pickWorkers(pick);
+      if (!first || first.error || rosterPickExpired(first, options.now)) continue;
+      return engineMissing(registry, first.engine) ? first.engine : '';
+    }
+  }
+  return '';
+}
+
+function noticeToolName(engineId) {
+  if (engineId === 'atris-fast') return 'atris 2.5 fast';
+  if (CLAUDE_FAMILY_ENGINES.includes(engineId) && engineId !== 'haiku') return 'claude code';
+  return engineId;
+}
+
+// One plain line when a job runs somewhere other than its pick because the
+// picked tool is missing, or lands on a hosted engine. '' when nothing
+// switched. With no pick, search's own pick is haiku on claude code.
+function switchNotice({ label, role, missing = '', engine = null, registry = null, canLogIn = false }) {
+  const missingName = missing ? (CLAUDE_FAMILY_ENGINES.includes(missing) ? 'claude code' : noticeToolName(missing)) : '';
+  if (!engine) {
+    if (!registry) return '';
+    const what = missingName ? `${missingName} is not installed and no other tool here can take it` : 'no tool here can take it';
+    if (role === 'executor') return `${label}: ${what}. install claude code or codex; atris 2.5 fast cannot edit files yet.`;
+    return `${label}: ${what}. install claude code${canLogIn ? ', or run atris login so atris 2.5 fast can take it' : ''}.`;
+  }
+  const hosted = engineHosted(engine);
+  const tokens = hosted ? ' (uses your atris tokens)' : '';
+  if (missingName) return `${label}: ${missingName} is not installed, so ${noticeToolName(engine.id)} took it${tokens}.`;
+  if (!hosted || !registry) return '';
+  const why = role === 'navigator' && engineMissing(registry, 'claude') ? 'claude code is not installed' : 'no tool here can take it';
+  return `${label}: ${why}, so ${noticeToolName(engine.id)} took it${tokens}.`;
+}
+
+// Each notice prints once per run, on stderr, however many times a job
+// resolves. ATRIS_SWITCH_NOTICE=0 silences it.
+const SHOWN_NOTICES = new Set();
+
+function showSwitchNotice(notice, options = {}) {
+  if (!notice) return '';
+  if (options.quiet !== true && process.env.ATRIS_SWITCH_NOTICE !== '0' && !SHOWN_NOTICES.has(notice)) {
+    SHOWN_NOTICES.add(notice);
+    console.error(notice);
+  }
+  return notice;
 }
 
 // The ordered team for one job: every worker that can run right now, lead
@@ -2163,6 +2360,7 @@ function engineDoctorReport(root = process.cwd()) {
     let health = engine.health && engine.health.status ? engine.health : { status: installed ? 'ready' : 'not_installed' };
     if (installed && health.status === 'not_installed') health = { status: 'ready' };
     if (!installed && health.status === 'ready') health = { status: 'not_installed' };
+    if (!installed && health.status === 'not_installed') health = { ...health, checked_at: new Date().toISOString() };
     return { ...engine, installed, health };
   });
   const next = { ...registry, updated_at: new Date().toISOString(), engines };
@@ -2187,6 +2385,9 @@ module.exports = {
   setRosterPick,
   confirmRoster,
   normalizeRosterModel,
+  currentClaudeModel,
+  retiredModelsNamed,
+  RETIRED_CLAUDE_MODELS,
   isClaudeFamilyModel,
   rosterModelLabel,
   parseRosterUntil,

package/lib/idle-review-sweep.js

@@ -0,0 +1,130 @@
+'use strict';
+
+// Finished work that can never land on its own should not wait forever.
+// Every hourly autoland tick: a review row idle past the grace period whose
+// check this machine cannot rerun from main is closed with a plain reason.
+// Landable rows are left for the landing pass, protected lanes (money,
+// deploys, security, customer, outward) are left for the human, and anything
+// still moving (touched inside the grace period) is left alone.
+
+const taskDb = require('./task-db');
+const { evaluateAutoAccept, protectedLaneOf, verifyRunnability } = require('./auto-accept-certified');
+const { plainLandingReason } = require('./voice-gate');
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const DEFAULT_IDLE_CLOSE_DAYS = 7;
+
+// Reasons that mean "no machine can ever check this from main as it stands".
+// A human or the builder can still reopen it with a check that runs.
+const UNVERIFIABLE_REASONS = new Set([
+  'verify_command_not_allowed',
+  'verify_only_on_agent_branch',
+  'verify_failed_on_main',
+  'verify_workdir_missing',
+  'verify_worktree_missing',
+  'strict_verify_missing',
+  'no_verify_command',
+]);
+
+function idleCloseMs(policy = {}) {
+  const days = Number(policy && policy.idle_close_days);
+  return (Number.isFinite(days) && days > 0 ? days : DEFAULT_IDLE_CLOSE_DAYS) * DAY_MS;
+}
+
+const CLOSE_WHY = {
+  verify_command_not_allowed: 'its check is a kind this machine may not run on its own',
+  verify_only_on_agent_branch: "its check runs a file that only exists on the agent's branch, never on main",
+  verify_failed_on_main: 'its check fails when rerun from the main project, so the work never reached main',
+  verify_workdir_missing: 'the folder its check ran in is gone',
+  verify_worktree_missing: 'the agent copy its check ran in is gone',
+  strict_verify_missing: 'it has no check to rerun',
+  no_verify_command: 'it has no check to rerun',
+};
+
+function closeReason(reason, days) {
+  const why = CLOSE_WHY[reason] || plainLandingReason(reason) || reason;
+  return `Closed after ${days} days waiting, because ${why}, so it could never land on its own. Reopen it with a check that runs from the main project if the work still matters.`;
+}
+
+function toMs(value) {
+  if (value === null || value === undefined || value === '') return 0;
+  const n = Number(value);
+  if (Number.isFinite(n)) return n;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : 0;
+}
+
+// Idle means nobody worked on it, not that no machine touched it: the hourly
+// re-check stamps updated_at on every row whose check runs, which would keep
+// a never-landable row "fresh" forever. Count only people and builders.
+function lastActivityAt(task, now = Date.now()) {
+  const metadata = task.metadata || {};
+  const at = Math.max(
+    toMs(task.created_at),
+    toMs(task.claimed_at),
+    toMs(metadata.agent_reviewed_at),
+    toMs(metadata.stage_updated_at),
+    toMs(metadata.planned_at),
+    toMs(metadata.human_revision_at),
+    toMs(metadata.backlogged_at),
+  );
+  return at > 0 ? at : now;
+}
+
+// Pure decision for one projection row. `liveReasons` carries the landing
+// pass's executed verdicts from this tick (verify_failed_on_main can only be
+// known by running the check), keyed by ref.
+function idleDecision(task, { root, policy = {}, now = Date.now(), liveReasons = new Map() } = {}) {
+  if (!task || task.status !== 'review') return { action: 'skip', why: 'not_review' };
+  const approval = String(task.review?.approval_status || task.metadata?.approval_status || 'pending');
+  if (approval !== 'pending' && approval !== 'agent_certified') return { action: 'skip', why: 'decided' };
+  const lane = protectedLaneOf(task);
+  if (lane) return { action: 'human', lane };
+  const idleMs = now - lastActivityAt(task, now);
+  if (!(idleMs > idleCloseMs(policy))) return { action: 'wait', why: 'still_in_grace' };
+  const ref = task.display_id || task.legacy_ref || task.id;
+  let reason = liveReasons.get(ref) || null;
+  if (!reason) {
+    const evaluation = evaluateAutoAccept(
+      { ...task, workspace_root: root },
+      { strictVerify: policy.strict_verify !== false, acceptAll: Boolean(policy.accept_all), executeVerify: false },
+    );
+    if (evaluation.eligible) return { action: 'land', why: 'landing_pass_takes_it' };
+    reason = verifyRunnability({ ...task, workspace_root: root }) || evaluation.reason;
+  }
+  if (!UNVERIFIABLE_REASONS.has(reason)) return { action: 'wait', why: reason };
+  return { action: 'close', reason, days: Math.floor(idleMs / DAY_MS) };
+}
+
+function sweepIdleReviews(root, { tasks, policy = {}, now = Date.now(), liveReasons = new Map(), dryRun = false, actor = 'autoland' } = {}) {
+  const closed = [];
+  const humanWaiting = [];
+  const due = [];
+  for (const task of tasks || []) {
+    const decision = idleDecision(task, { root, policy, now, liveReasons });
+    const ref = task.display_id || task.legacy_ref || task.id;
+    if (decision.action === 'human') humanWaiting.push({ ref, lane: decision.lane });
+    if (decision.action === 'close') due.push({ id: task.id, ref, title: task.title || '', reason: decision.reason, text: closeReason(decision.reason, decision.days) });
+  }
+  if (dryRun || !due.length) return { closed: dryRun ? due : closed, due: due.length, human_waiting: humanWaiting, dry_run: dryRun };
+
+  const db = taskDb.open();
+  db.exec('BEGIN IMMEDIATE');
+  try {
+    for (const item of due) {
+      const result = taskDb.archiveTask(db, { id: item.id, actor, reason: item.text, skipLogs: true });
+      if (result.archived) closed.push(item);
+    }
+    db.exec('COMMIT');
+  } catch (error) {
+    try { db.exec('ROLLBACK'); } catch { /* surface the original error */ }
+    throw error;
+  }
+  return { closed, due: due.length, human_waiting: humanWaiting, dry_run: false };
+}
+
+module.exports = {
+  idleDecision,
+  lastActivityAt,
+  sweepIdleReviews,
+};

package/lib/known-commands.js

@@ -4,8 +4,8 @@ const knownCommands = ['init', 'guide', 'doctor', 'doc-health', 'install', 'work
                        'activate', '_activate', 'agent', 'team', 'chat', 'fast', 'ax', 'console', 'serve', 'login', 'logout', 'whoami', 'switch', 'use', 'accounts', '_resolve', '_profile-email', '_switch-session', 'shell-init', 'update', 'upgrade', 'version', 'help', 'next', 'atris',
                        'clean', 'close', 'harvest', 'verify', 'recover', 'search', 'scout', 'skill', 'member', 'codex-goal', 'app', 'apps', 'learn', 'lesson', 'taste', 'teach', 'plugin', 'experiments', 'bench', 'router', 'tree', 'receipt', 'proof', 'openclaw', 'pull', 'push', 'watch', 'cloud', 'live', 'align', 'terminal', 'computer', 'diff', 'business', 'sync', 'youtube', 'x-search',
                        'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'decide', 'agents', 'probe', 'worktree', 'land', 'caretaker', 'autoland', 'drive', 'aeo', 'slop', 'voice', 'strings', 'write', 'security-review', 'secure', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'study', 'rainmaker', 'xp', 'play', 'gm', 'game', 'x', 'recap', 'report', 'signup', 'clarity', 'interview', 'meet', 'moves', 'unknowns', 'avail', 'sync-checkout',
-                       'ci', 'github', 'vercel', 'supabase', 'linear', 'stripe', 'balance', 'usage', 'api-key', 'topup', 'buy', 'transactions', 'design', 'mcp', 'gmail', 'calendar', 'twitter', 'slack', 'imessage', 'integrations', 'setup', 'clean-workspace', 'cw',
-                       'fork', 'browse', 'publish', 'pack', 'sleep', 'wake', 'feedback', 'errors', 'wiki', 'code-review', 'cr', 'soul', 'fleet', 'fleet-report', 'loops', 'self-improve', 'compile', 'spaceship', 'truth', 'sign', 'engine', 'engines', 'playbook', 'feed', 'brief', 'social', 'host', 'people', 'follow', 'unfollow', 'friends', 'msg', 'inbox', 'invite', 'join', 'rsi'];
+                       'ci', 'github', 'vercel', 'supabase', 'linear', 'stripe', 'balance', 'usage', 'api-key', 'topup', 'buy', 'transactions', 'hire', 'hires', 'mail', 'design', 'mcp', 'gmail', 'calendar', 'twitter', 'slack', 'imessage', 'integrations', 'setup', 'clean-workspace', 'cw',
+                       'fork', 'browse', 'publish', 'pack', 'sleep', 'wake', 'feedback', 'errors', 'wiki', 'code-review', 'cr', 'soul', 'fleet', 'fleet-report', 'loops', 'self-improve', 'compile', 'spaceship', 'truth', 'sign', 'engine', 'engines', 'link', 'playbook', 'feed', 'brief', 'social', 'host', 'people', 'follow', 'unfollow', 'friends', 'msg', 'inbox', 'invite', 'join', 'rsi'];
 
 // Damerau-Levenshtein edit distance between two short strings. Counts an
 // adjacent transposition (e.g. "taks" -> "task") as a single edit, since

package/lib/land-green.js

@@ -23,6 +23,9 @@ const { runGit } = require('./git-spawn');
 
 const DEFAULT_VERIFY = 'npm test';
 const DEFAULT_VERIFY_TIMEOUT_MS = 20 * 60 * 1000;
+// Stop the walk after this many consecutive branches that landed nothing, so
+// a queue of erroring branches does not burn a scratch checkout per branch.
+const DEFAULT_MAX_MISSES = 4;
 const FAILING_LINE = /^(?:✖|not ok)\s+(.+?)(?:\s+\(\d+(?:\.\d+)?ms\))?\s*$/;
 
 function gitOut(args, cwd) {
@@ -291,6 +294,7 @@ function landStaleGreenBranches(root, {
   ttlDays,
   base: baseOverride = '',
   limit = 1,
+  maxMisses = DEFAULT_MAX_MISSES,
   now = Date.now(),
   verifyCommand = DEFAULT_VERIFY,
   verifyTimeoutMs = DEFAULT_VERIFY_TIMEOUT_MS,
@@ -307,19 +311,29 @@ function landStaleGreenBranches(root, {
     .filter((b) => b.state === 'active' && b.stale)
     .sort((a, b) => b.activityHours - a.activityHours);
   const verdicts = [];
-  let attempts = 0;
+  // Only landed and red verdicts spend the per-tick budget: an erroring or
+  // ineligible branch must not starve the rest of the queue. A bounded run of
+  // misses still stops the walk so a fully broken queue does not burn a
+  // scratch checkout per branch per tick.
+  let spent = 0;
+  let misses = 0;
   for (const candidate of candidates) {
-    if (attempts >= limit) {
-      verdicts.push(verdictFor(candidate.name, live.base, { action: 'skipped', reason: 'per_tick_limit' }));
+    if (spent >= limit || misses >= maxMisses) {
+      verdicts.push(verdictFor(candidate.name, live.base, { action: 'skipped', reason: spent >= limit ? 'per_tick_limit' : 'attempt_cap' }));
       continue;
     }
-    attempts += 1;
     let verdict;
     try {
       verdict = landOneBranch(root, live.base, candidate.name, { verifyCommand, verifyTimeoutMs, dryRun, push, runVerifyFn, env });
     } catch (err) {
       verdict = verdictFor(candidate.name, live.base, { action: 'error', reason: 'exception', detail: String((err && err.message) || err).slice(0, 300) });
     }
+    if (verdict.action === 'landed' || verdict.action === 'red') {
+      spent += 1;
+      misses = 0;
+    } else {
+      misses += 1;
+    }
     if (verdict.action === 'red' && openFlags) {
       try {
         const flagged = openRedFlag(root, verdict, { runCli });

package/lib/member-identity.js

@@ -0,0 +1,56 @@
+'use strict';
+
+// How a launch names the member it runs as, in one place. The writers use
+// these lines and the team view reads them back with patterns built from the
+// same lines, so the wording cannot drift apart.
+//
+// Mission ticks (atris member run, atris mission) say:
+//   You are the member "validator".
+//   **Objective:** <what the run is for>
+// Dispatch briefs say:
+//   You are acting as validator. <the work>
+
+const escapeRegExp = require('./escape-regexp');
+
+const NAME = '([a-z0-9][a-z0-9_-]*[a-z0-9])';
+const SLOT = '\u0000';
+
+function memberIdentityLine(name) {
+  return `You are the member "${name}".`;
+}
+
+function missionObjectiveLine(objective) {
+  return `**Objective:** ${objective}`;
+}
+
+function patternFrom(line, name) {
+  return new RegExp(escapeRegExp(line).replace(escapeRegExp(SLOT), name), 'i');
+}
+
+const MISSION_MEMBER = patternFrom(memberIdentityLine(SLOT), NAME);
+const DISPATCH_MEMBER = /\bacting as (?:the )?([a-z0-9][a-z0-9_-]*[a-z0-9])[.,:;]?/i;
+const OBJECTIVE = patternFrom(missionObjectiveLine(SLOT), '(.+?)(?=\\s\\*\\*[A-Z][^*]*:\\*\\*|\\s#|$)');
+
+// One prompt -> { member, doing }. The member is the name the prompt runs
+// as, or null. doing is what the run is for: a mission's objective, or the
+// words after the dispatch line.
+function readMemberLaunch(prompt) {
+  const text = String(prompt || '').replace(/\\0?12|\\n/g, ' ').replace(/\s+/g, ' ').trim();
+  const mission = MISSION_MEMBER.exec(text);
+  if (mission) {
+    const objective = OBJECTIVE.exec(text);
+    return { member: mission[1].toLowerCase(), doing: objective ? objective[1].trim() : text };
+  }
+  const dispatch = DISPATCH_MEMBER.exec(text);
+  if (dispatch) {
+    const after = text.slice(dispatch.index + dispatch[0].length).trim();
+    return { member: dispatch[1].toLowerCase(), doing: after || text };
+  }
+  return { member: null, doing: text };
+}
+
+module.exports = {
+  memberIdentityLine,
+  missionObjectiveLine,
+  readMemberLaunch,
+};