atris 3.65.0 → 3.66.0

package/commands/xp.js

@@ -933,6 +933,8 @@ function receiptFromTaskEpisode(episode, treeHash) {
     source_episode_id: episodeId,
     workspace_root: episode.workspace_root || null,
     actor: episode.action?.actor || null,
+    // Who built the work. `actor` is the reviewer; trust is earned by the builder.
+    builder: episode.state?.metadata?.built_by || episode.state?.claimed_by || null,
     outcome: rejected ? 'rejected' : 'accepted',
     xp: rejected ? 0 : reward,
     reward: rejected ? 0 : reward,

package/commands/youtube.js

@@ -1229,7 +1229,7 @@ function buildDigestPrompt(briefs = []) {
 
 function defaultDigestRunner(prompt, deps = {}) {
   const spawn = deps.spawnSync || spawnSync;
-  return spawn('claude', ['-p', prompt, '--model', 'claude-haiku-4-5'], {
+  return spawn('claude', ['-p', prompt, '--model', 'claude-haiku-5-5'], {
     encoding: 'utf8',
     timeout: DIGEST_ENGINE_TIMEOUT_MS,
     maxBuffer: 10 * 1024 * 1024,

package/lib/auto-accept-certified.js

@@ -6,7 +6,8 @@ const path = require('path');
 const { taskProofState, taskProofExecutionState } = require('./task-proof');
 const { extractReceiptEvidence } = require('./receipt-evidence');
 const reviewIntegrity = require('./review-integrity');
-const { computeTrustTier } = require('./trust-tiers');
+const { computeTrustTier, taskTrustSubject } = require('./trust-tiers');
+const { rewriteWorktreeVerify, missingOnMain } = require('./verify-worktree-rewrite');
 const { policyLessonsForFiles, readPolicyLessons } = require('./policy-lessons');
 const { skillEvalGate } = require('./skill-eval-gate');
 
@@ -1091,6 +1092,79 @@ function sniffedProtectedLane(task) {
   return null;
 }
 
+// The protected lane a task sits in, or null: a denied tag (whole word,
+// plural-stripped, the same match the landing gate uses), a lane declared in
+// its text, or, for untagged rows, lane terms in its title or objective.
+// Every automatic closer must leave these for a human.
+function deniedTagOf(task) {
+  const tag = String((task && task.tag) || '').trim().toLowerCase();
+  return [...DENIED_TAGS].find((d) =>
+    tag === d || tag.split(/[^a-z0-9]+/).some((w) => w === d || w.replace(/s$/, '') === d)) || null;
+}
+
+function protectedLaneOf(task) {
+  if (!task || typeof task !== 'object') return null;
+  const metadata = task.metadata && typeof task.metadata === 'object' ? task.metadata : {};
+  const view = { ...task, objective: task.objective || metadata.objective || '', metadata };
+  const denied = deniedTagOf(view);
+  if (denied) return denied;
+  if (declaredProtectedLane(view)) return 'declared';
+  if (!String(view.tag || '').trim()) {
+    const sniffed = sniffedProtectedLane(view);
+    if (sniffed) return sniffed.lane;
+  }
+  return null;
+}
+
+// The check the landing pass actually runs. A check recorded inside an
+// agent's temporary copy is rewritten to run from the main checkout; when the
+// file it runs only exists on the agent's branch, that is reported in plain
+// words instead of a bare "not on the list this machine may run".
+function resolveTaskVerify(task) {
+  const recorded = String((task.metadata || {}).verify || '').trim();
+  if (!recorded) return { verify: '', recorded: '', rewritten: false, missing: null };
+  const root = task.workspace_root || process.cwd();
+  const rewrite = rewriteWorktreeVerify(recorded, root);
+  const verify = rewrite.command || recorded;
+  let missing = null;
+  if (rewrite.rewritten) {
+    const chain = parseVerifyChain(verify);
+    if (chain.ok) missing = missingOnMain(chain.steps, root);
+  }
+  return { verify, recorded, rewritten: rewrite.rewritten, missing };
+}
+
+// Why the landing pass could never rerun this task's check from main, or
+// null when it can. Independent of the gate's refusal order, so a row held
+// for another reason still reports a check that can never run.
+function verifyRunnability(task) {
+  const resolved = resolveTaskVerify(task);
+  if (!resolved.verify) return 'no_verify_command';
+  if (!isAutoCertifyVerifyCommandAllowed(resolved.verify)) return 'verify_command_not_allowed';
+  if (resolved.missing) return 'verify_only_on_agent_branch';
+  return null;
+}
+
+function agentBranchOnlyResult(ref, resolved) {
+  return {
+    eligible: false,
+    ref,
+    reason: 'verify_only_on_agent_branch',
+    verify: resolved.verify,
+    recorded_verify: resolved.recorded,
+    missing_path: resolved.missing,
+    next_action: `${resolved.missing} is not on main yet; land the agent branch that has it, then the check reruns from main`,
+  };
+}
+
+function runResolvedVerify(resolved, workspaceRoot, cache) {
+  const result = runVerifyCommandCached(resolved.verify, workspaceRoot, cache);
+  if (resolved.rewritten && result.reason === 'verify_failed') {
+    return { ...result, reason: 'verify_failed_on_main', recorded_verify: resolved.recorded };
+  }
+  return resolved.rewritten ? { ...result, recorded_verify: resolved.recorded } : result;
+}
+
 function evaluateAutoAccept(task, options = {}) {
   const {
     strictVerify = true,
@@ -1103,10 +1177,9 @@ function evaluateAutoAccept(task, options = {}) {
   if (task.status !== 'review') return { eligible: false, ref, reason: 'not_in_review' };
   const metadata = task.metadata || {};
   const review = task.review || {};
-  const trustTier = computeTrustTier(
-    task.claimed_by || metadata.executed_by,
-    task.workspace_root || process.cwd(),
-  );
+  // Trust is the builder's, never the approver's: a task built by a member
+  // with a clean record lands without waiting on a human look.
+  const trustTier = computeTrustTier(taskTrustSubject(task), task.workspace_root || process.cwd());
   const tierRequiresStrictVerify = trustTier !== 'trusted';
   const requiresStrictVerify = strictVerify || tierRequiresStrictVerify;
   const approval = String(review.approval_status || metadata.approval_status || 'pending').toLowerCase();
@@ -1180,10 +1253,12 @@ function evaluateAutoAccept(task, options = {}) {
     }
     const evidenceBlock = receiptEvidenceBlock(task, ref);
     if (evidenceBlock) return evidenceBlock;
-    const verify = metadata.verify;
+    const resolvedVerify = resolveTaskVerify(task);
+    const verify = resolvedVerify.verify;
     if (tierRequiresStrictVerify && !verify) return strictVerifyMissingResult(ref);
+    if (resolvedVerify.missing) return agentBranchOnlyResult(ref, resolvedVerify);
     if (verify && executeVerify) {
-      const verifyResult = runVerifyCommandCached(verify, task.workspace_root || process.cwd(), verifyCache);
+      const verifyResult = runResolvedVerify(resolvedVerify, task.workspace_root || process.cwd(), verifyCache);
       // A check that runs and fails blocks. So does a check whose worktree
       // is gone, otherwise the daily reap converts "has a failing check"
       // into "lands unchecked" the morning after it clears the worktree.
@@ -1194,6 +1269,7 @@ function evaluateAutoAccept(task, options = {}) {
       // "the harness could not run the check" into "landed unchecked".
       if ((tierRequiresStrictVerify && !verifyResult.ok)
         || verifyResult.reason === 'verify_failed'
+        || verifyResult.reason === 'verify_failed_on_main'
         || verifyResult.reason === 'verify_unrunnable'
         || verifyResult.reason === 'verify_worktree_missing'
         || verifyResult.reason === 'verify_workdir_missing') {
@@ -1279,11 +1355,13 @@ function evaluateAutoAccept(task, options = {}) {
   }
 
   if (requiresStrictVerify) {
-    const verify = metadata.verify;
+    const resolvedVerify = resolveTaskVerify(task);
+    const verify = resolvedVerify.verify;
     if (!verify) return strictVerifyMissingResult(ref);
+    if (resolvedVerify.missing) return agentBranchOnlyResult(ref, resolvedVerify);
     if (executeVerify) {
       const workspaceRoot = task.workspace_root || process.cwd();
-      const verifyResult = runVerifyCommandCached(verify, workspaceRoot, verifyCache);
+      const verifyResult = runResolvedVerify(resolvedVerify, workspaceRoot, verifyCache);
       if (!verifyResult.ok) {
         return { eligible: false, ref, reason: verifyResult.reason, verify, ...verifyResult };
       }
@@ -1321,6 +1399,8 @@ module.exports = {
   candidatePolicyGate,
   declaredProtectedLane,
   sniffedProtectedLane,
+  protectedLaneOf,
+  verifyRunnability,
   evaluateAutoAccept,
   isAutoCertifyVerifyCommandAllowed,
   parseVerifyChain,

package/lib/cleanup-summary.js

@@ -0,0 +1,129 @@
+'use strict';
+
+// One plain line per cleanup run, in the daily journal's "## <project>
+// overnight" section: the hourly autoland tick writes its own line there and
+// so do project jobs (project-obelisk's review sweep and state sync). The
+// session start screen reads the latest one back, so the owner sees what the
+// background work did without opening anything.
+
+const fs = require('fs');
+const path = require('path');
+
+const CLEANUP_WORDS = /\b(landed|land on|closed|put away|parked|need you|reran|archived)\b/i;
+
+function localDate(now) {
+  return `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}-${String(now.getDate()).padStart(2, '0')}`;
+}
+
+function journalFile(root, now) {
+  return path.join(root, 'atris', 'logs', String(now.getFullYear()), `${localDate(now)}.md`);
+}
+
+function sectionName(root) {
+  return `${path.basename(path.resolve(root)).replace(/^project-/, '')} overnight`;
+}
+
+// Same text twice in one day is written once.
+function appendOvernightNote(root, line, now = new Date()) {
+  const text = String(line || '').trim();
+  if (!text || !fs.existsSync(path.join(root, 'atris'))) return false;
+  const file = journalFile(root, now);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const body = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+  const bullet = `- ${text}`;
+  if (body.split('\n').some((l) => l.trim() === bullet)) return false;
+  const marker = `## ${sectionName(root)}`;
+  const idx = body.split('\n').findIndex((l) => l.trim() === marker);
+  let next;
+  if (idx === -1) {
+    next = `${body}${body && !body.endsWith('\n') ? '\n' : ''}\n${marker}\n${bullet}\n`;
+  } else {
+    const lines = body.split('\n');
+    let end = idx + 1;
+    while (end < lines.length && !lines[end].startsWith('## ')) end += 1;
+    let insertAt = end;
+    while (insertAt > idx + 1 && !lines[insertAt - 1].trim()) insertAt -= 1;
+    lines.splice(insertAt, 0, bullet);
+    next = lines.join('\n');
+  }
+  const tmp = `${file}.tmp-${process.pid}`;
+  fs.writeFileSync(tmp, next);
+  fs.renameSync(tmp, file);
+  return true;
+}
+
+function overnightBullets(text) {
+  const bullets = [];
+  let inSection = false;
+  for (const line of String(text || '').split('\n')) {
+    if (line.startsWith('## ')) {
+      inSection = /\bovernight\s*$/i.test(line.trim());
+      continue;
+    }
+    if (inSection && line.trim().startsWith('- ')) bullets.push(line.trim().slice(2).trim());
+  }
+  return bullets;
+}
+
+function parkedBranchCount(root) {
+  try {
+    return fs.readFileSync(path.join(root, 'atris', 'reports', 'parked-branches.md'), 'utf8')
+      .split('\n').filter((l) => /^- \d{4}-\d{2}-\d{2} · /.test(l)).length;
+  } catch {
+    return 0;
+  }
+}
+
+function shorten(text, max) {
+  if (text.length <= max) return text;
+  const cut = text.slice(0, max - 1);
+  const stop = Math.max(cut.lastIndexOf('; '), cut.lastIndexOf(', '));
+  return `${(stop > max * 0.5 ? cut.slice(0, stop) : cut).replace(/[\s,;.]+$/, '')}...`;
+}
+
+// The newest cleanup line from today's journal (yesterday's if today has
+// none), plus the parked-branch count when the line does not already say it.
+// Two small file reads; never throws.
+function latestCleanupLine(root, { now = new Date(), max = 150 } = {}) {
+  try {
+    let line = '';
+    for (const offset of [0, 1]) {
+      const day = new Date(now);
+      day.setDate(day.getDate() - offset);
+      let text = '';
+      try { text = fs.readFileSync(journalFile(root, day), 'utf8'); } catch { continue; }
+      const bullets = overnightBullets(text).filter((b) => CLEANUP_WORDS.test(b));
+      if (bullets.length) { line = bullets[bullets.length - 1]; break; }
+    }
+    const parked = parkedBranchCount(root);
+    if (parked && !/parked/i.test(line)) {
+      const note = `${parked} agent branch${parked === 1 ? '' : 'es'} parked for you`;
+      line = line ? `${shorten(line.replace(/\.$/, ''), max - note.length - 2)}; ${note}` : `${note}.`;
+    }
+    return line ? shorten(line, max) : '';
+  } catch {
+    return '';
+  }
+}
+
+function plural(n, word, many = `${word}s`) {
+  return `${n} ${n === 1 ? word : many}`;
+}
+
+// The autoland tick's own line. Null when the tick did nothing worth a line.
+function tickSummaryLine({ landed = 0, closed = 0, putAway = 0, needYou = 0 } = {}) {
+  const parts = [];
+  if (landed) parts.push(`landed ${plural(landed, 'finished item')}`);
+  if (closed) parts.push(`closed ${plural(closed, 'idle item')} that could never land on their own, each with a plain reason`);
+  if (putAway) parts.push(`put away ${plural(putAway, 'done or long-idle item')}`);
+  if (!parts.length) return null;
+  if (needYou) parts.push(`${needYou} need you (money, deploys, security, or customers)`);
+  const text = parts.join('; ');
+  return `Autoland: ${text.charAt(0).toUpperCase()}${text.slice(1)}.`;
+}
+
+module.exports = {
+  appendOvernightNote,
+  latestCleanupLine,
+  tickSummaryLine,
+};

package/lib/engine-ask.js

@@ -11,6 +11,7 @@ const {
 } = require('./runner-command');
 const {
   canonicalEngineName,
+  currentClaudeModel,
   engineFailureHealthStatus,
   setEngineHealth,
 } = require('./engine-registry');
@@ -241,7 +242,7 @@ function assertAskModelSupported(engine, model) {
 
 function resolveAskModel(engine, modelName = '') {
   const requested = String(modelName || '').trim();
-  if (requested) return requested;
+  if (requested) return currentClaudeModel(requested);
   if (engine !== 'claude' && engine !== 'fable' && engine !== 'haiku') return '';
   return RUNNER_PROFILE_DEFS[engine]?.model || DEFAULT_CLAUDE_RUNNER_MODEL;
 }
@@ -291,7 +292,7 @@ function buildReadOnlyEngineInvocation(engineName, prompt, modelName = '', {
     return {
       engine,
       bin: profile.bin,
-      args: ['exec', ...(model ? ['-m', model] : []), ...effortArgs, '--sandbox', 'read-only', '--ephemeral', '--ignore-user-config', '--ignore-rules', '--color', 'never', request],
+      args: ['exec', ...(model ? ['-m', model] : []), ...effortArgs, '--sandbox', 'read-only', '--ephemeral', '--skip-git-repo-check', '--ignore-user-config', '--ignore-rules', '--color', 'never', request],
     };
   }
   if (engine === 'cursor') {

package/lib/engine-registry.js

@@ -137,13 +137,20 @@ function engineFailureHealthStatus(result) {
   return engineStallReason(result) ? 'error' : null;
 }
 
+// hosted: the engine runs on Atris's own servers and bills the person's atris
+// tokens. With no roster pick the router never puts a hosted engine ahead of
+// a tool installed here; atris-fast is the last resort for search and review
+// (not build, see hostedFallbacks), and only for someone logged in to atris.
+// role_order: the engine's place for one job when it differs from its
+// fallback_order. Haiku searches first wherever the claude CLI is installed.
 const ENGINE_SEED_META = Object.freeze({
-  'atris-fast': Object.freeze({ tier: 'fast', roles: Object.freeze(['navigator']), models: Object.freeze(['atris fast']), duty: 'learning', fallback_order: 10 }),
+  'atris-fast': Object.freeze({ tier: 'fast', roles: Object.freeze(['navigator']), models: Object.freeze(['atris fast']), duty: 'learning', fallback_order: 10, hosted: true }),
   // roster_only_roles: jobs a roster pick may give this engine, but the router
-  // never hands it on its own. Claude and haiku can own search when picked;
-  // with no pick, search stays with atris-fast, then composer. Codex can own
-  // review when picked; it stays out of roles, so every review list built
-  // from roles (the router, one lap, wish audit, the chart) is unchanged.
+  // never hands it on its own. Claude can own search when picked; with no
+  // pick, search goes to haiku, then other installed tools, then atris-fast.
+  // Codex can own review when picked; it stays out of roles, so every review
+  // list built from roles (the router, one lap, wish audit, the chart) is
+  // unchanged.
   codex: Object.freeze({ tier: 'pro', roles: Object.freeze(['executor']), roster_only_roles: Object.freeze(['validator']), models: Object.freeze(['codex']), fallback_order: 10 }),
   claude: Object.freeze({ tier: 'max', roles: Object.freeze(['validator', 'executor', 'navigator']), roster_only_roles: Object.freeze(['navigator']), models: Object.freeze(['opus 5.5', 'opus 5', 'fable', 'haiku']), fallback_order: 20 }),
   cursor: Object.freeze({ tier: 'pro', roles: Object.freeze(['executor']), models: Object.freeze(['composer 2.5', 'grok 4.6', 'kimi 3']), fallback_order: 30 }),
@@ -151,8 +158,8 @@ const ENGINE_SEED_META = Object.freeze({
   devin: Object.freeze({ tier: 'max', roles: Object.freeze(['executor']), roster_only_roles: Object.freeze(['navigator']), models: Object.freeze(['built-in router']), duty: 'errands', fallback_order: 40 }),
   grok: Object.freeze({ tier: 'pro', roles: Object.freeze(['executor']), models: Object.freeze(['grok 4.7 fast', 'grok 4.7']), fallback_order: 45 }),
   fable: Object.freeze({ tier: 'max', roles: Object.freeze(['validator', 'executor']), models: Object.freeze(['opus 5.5', 'opus 5', 'fable', 'haiku']), duty: 'leader', fallback_order: 50 }),
-  composer: Object.freeze({ tier: 'fast', roles: Object.freeze(['navigator', 'executor']), models: Object.freeze(['composer 2.5']), fallback_order: 60 }),
-  haiku: Object.freeze({ tier: 'fast', roles: Object.freeze(['validator', 'navigator']), roster_only_roles: Object.freeze(['navigator']), models: Object.freeze(['haiku']), fallback_order: 70 }),
+  composer: Object.freeze({ tier: 'fast', roles: Object.freeze(['navigator', 'executor']), models: Object.freeze(['composer 2.5']), fallback_order: 60, hosted: true }),
+  haiku: Object.freeze({ tier: 'fast', roles: Object.freeze(['validator', 'navigator']), role_order: Object.freeze({ navigator: 5 }), models: Object.freeze(['haiku']), fallback_order: 70 }),
   agy: Object.freeze({
     tier: 'pro',
     roles: Object.freeze(['executor']),
@@ -203,6 +210,16 @@ function binInstalled(bin) {
   return probe.status === 0 && Boolean(String(probe.stdout || '').trim());
 }
 
+// A saved not_installed is checked again on the real clock (never a test's
+// routing clock) once its last check, or the run that found it missing, is
+// a minute old. One `command -v` per missing tool per minute, no network.
+const MISSING_RECHECK_MS = 60000;
+
+function missingCheckDue(health) {
+  const stamp = Date.parse((health && (health.checked_at || health.last_failure_ts)) || '');
+  return !Number.isFinite(stamp) || stamp + MISSING_RECHECK_MS <= Date.now();
+}
+
 function canonicalEngineName(name) {
   const trimmed = String(name || '').trim();
   if (!trimmed) return '';
@@ -256,17 +273,30 @@ function normalizeEngineEntry(id, saved = {}, now) {
   // Policy over probes: a saved health status is the routing truth, verbatim.
   // Only an engine the registry has never seen gets one seeding probe; after
   // that, installed-state changes flow through `atris engine doctor` (or
-  // `atris engine health`), never through the resolve path.
+  // `atris engine health`), never through the resolve path. One exception:
+  // a missing tool is looked for again once its check is a minute old, so a
+  // tool installed next week is picked up with no repair step.
   let status;
   let installed;
+  let checkedAt = '';
   if (ENGINE_HEALTH_STATUSES.includes(savedStatus)) {
     status = savedStatus;
     installed = typeof saved.installed === 'boolean' ? saved.installed : status !== 'not_installed';
+    if (status === 'not_installed') {
+      checkedAt = String(savedHealth.checked_at || '');
+      if (missingCheckDue(savedHealth)) {
+        installed = binInstalled(def.bin);
+        status = installed ? 'ready' : 'not_installed';
+        checkedAt = new Date().toISOString();
+      }
+    }
   } else {
     installed = binInstalled(def.bin);
     status = installed ? 'ready' : 'not_installed';
+    if (!installed) checkedAt = new Date().toISOString();
   }
   let health = { status };
+  if (status === 'not_installed' && checkedAt) health.checked_at = checkedAt;
   if (status !== 'ready' && savedHealth.last_failure_ts) health.last_failure_ts = String(savedHealth.last_failure_ts);
   if (status === 'cooling') {
     // A cooldown that has passed reads as ready, so the engine comes back
@@ -559,7 +589,12 @@ function rosterPickExpired(pick, now = new Date()) {
 // read normalizes again, so older saved picks and hand edits work too.
 const CLAUDE_FAMILY_ENGINES = Object.freeze(['claude', 'fable', 'haiku']);
 const CLAUDE_MODEL_ALIASES = Object.freeze(['opus', 'sonnet', 'haiku', 'fable', 'opusplan', 'default']);
-const CLAUDE_MODEL_DATED_IDS = Object.freeze({ 'claude-haiku-4-5': 'claude-haiku-4-5-20251001' });
+// A retired model runs as its replacement, so a saved pick keeps working
+// after the upgrade. Retiring the next one is one line here.
+const RETIRED_CLAUDE_MODELS = Object.freeze({
+  'claude-haiku-4-5': 'claude-haiku-5-5',
+  'claude-haiku-4-5-20251001': 'claude-haiku-5-5',
+});
 const CLAUDE_MODEL_SPELLING = /^(opus|sonnet|haiku|fable)[\s_-]*(\d+)(?:[\s._-]+(\d+))?$/;
 const CLAUDE_LONG_CONTEXT = /\s*\[1m\]$/;
 
@@ -574,6 +609,30 @@ function normalizeGrokModel(raw) {
   throw new Error(`grok does not know the model "${raw}". use grok 4.7 fast, grok 4.7, or a full grok- id`);
 }
 
+// The model to run for a claude id: its replacement when it is retired,
+// else the id as given. Keeps a "[1m]" tail.
+function currentClaudeModel(value) {
+  const raw = String(value || '').trim();
+  const suffix = CLAUDE_LONG_CONTEXT.test(raw) ? '[1m]' : '';
+  const base = raw.replace(CLAUDE_LONG_CONTEXT, '').trim();
+  const next = RETIRED_CLAUDE_MODELS[base.toLowerCase()];
+  return next ? `${next}${suffix}` : raw;
+}
+
+// The retired models a roster file's text still names, by id or spelled
+// out, each once, so the roster can say they were upgraded.
+function retiredModelsNamed(text) {
+  const found = [];
+  for (const id of Object.keys(RETIRED_CLAUDE_MODELS)) {
+    const [, family, major, minor] = /^claude-([a-z]+)-(\d+)-(\d+)/.exec(id) || [];
+    if (!family) continue;
+    const spelled = new RegExp(`\\b(?:claude[\\s_-]*)?${family}[\\s_-]*${major}[\\s._-]+${minor}(?![\\d.])`, 'i');
+    const base = `claude-${family}-${major}-${minor}`;
+    if (spelled.test(String(text || '')) && !found.includes(base)) found.push(base);
+  }
+  return found;
+}
+
 function normalizeRosterModel(engineId, value) {
   const raw = String(value || '').trim();
   if (!raw) return '';
@@ -588,10 +647,10 @@ function normalizeRosterModel(engineId, value) {
   const match = CLAUDE_MODEL_SPELLING.exec(lower.replace(/^claude[\s_-]*/, ''));
   if (match) {
     const id = `claude-${match[1]}-${match[2]}${match[3] ? `-${match[3]}` : ''}`;
-    return `${CLAUDE_MODEL_DATED_IDS[id] || id}${suffix}`;
+    return currentClaudeModel(`${id}${suffix}`);
   }
-  if (lower.startsWith('claude-')) return `${base}${suffix}`;
-  throw new Error(`${engineId} does not know the model "${raw}". use opus, sonnet, haiku, fable, opusplan, default, a version like opus 5.5, sonnet 5, haiku 4.5, or fable 5.1, or a full claude- id; add [1m] for the long context window`);
+  if (lower.startsWith('claude-')) return currentClaudeModel(`${base}${suffix}`);
+  throw new Error(`${engineId} does not know the model "${raw}". use opus, sonnet, haiku, fable, opusplan, default, a version like opus 5.5, sonnet 5, haiku 5.5, or fable 5.1, or a full claude- id; add [1m] for the long context window`);
 }
 
 // A saved pick's model, normalized the same way assign does. null means the
@@ -1903,38 +1962,48 @@ function resolveEngineForRoleRanked(role, root = process.cwd(), options = {}) {
   const engines = registry.engines
     .filter((engine) => engine.roles.includes(normalizedRole))
     .filter((engine) => !routerSkipsRole(engine, normalizedRole))
+    .filter((engine) => !engineHosted(engine))
     .filter((engine) => engineReadyAt(engine, options.now))
+    .map((engine) => withRoleOrder(engine, normalizedRole))
     .sort((a, b) => {
       const byOrder = Number(a.fallback_order) - Number(b.fallback_order);
       return byOrder || String(a.id).localeCompare(String(b.id));
     });
   // Ranking reads the router's history off disk (task receipts, mission
   // events, dispatch receipts). A valid roster pick decides without it, so
-  // rank only when something asks for the full ranked list.
+  // rank only when something asks for the full ranked list. Hosted engines
+  // join after the ranking, so no track record can lift one over a tool
+  // installed here.
   let rankedCache = null;
   const rank = () => {
     if (!rankedCache) {
-      rankedCache = routerBrain.rankEnginesDetailed(engines, {
+      const ranked = routerBrain.rankEnginesDetailed(engines, {
         root,
         taskType: options.taskType || options.task_type || normalizedRole,
         lowStakes: options.lowStakes,
         stakes: options.stakes,
       });
+      rankedCache = { ...ranked, candidates: [...ranked.candidates, ...hostedFallbacks(registry, normalizedRole, options)] };
     }
     return rankedCache;
   };
   const choice = rosterChoice(normalizedRole, withProjectRoster(registry, root, options), options);
+  const label = rosterJobLabel(options.job ? rosterJobKey(options.job) || normalizedRole : normalizedRole);
   if (choice) {
     // The job's own workers go first, in order, then the router's list.
     const after = choice.walk.slice(choice.lead_index + 1).filter((step) => !step.skip).map((step) => step.raw);
     const lead = [choice.engine, ...after].filter((engine, index, list) => list.findIndex((other) => other.id === engine.id) === index);
     const leadIds = new Set(lead.map((engine) => engine.id));
+    const first = choice.walk[0];
+    const missing = choice.lead_index > 0 && first.skip === 'not ready' && engineMissing(registry, first.worker.engine)
+      ? first.worker.engine : '';
     const result = {
       engine: choice.engine,
       reason: choice.reason,
       source: choice.source,
       job: choice.job,
       team: choice.team,
+      notice: showSwitchNotice(switchNotice({ label: choice.job, role: normalizedRole, missing, engine: choice.engine }), options),
     };
     let rankedList = null;
     Object.defineProperty(result, 'ranked', {
@@ -1951,7 +2020,122 @@ function resolveEngineForRoleRanked(role, root = process.cwd(), options = {}) {
     return result;
   }
   const ranked = rank();
-  return { engine: ranked.candidates[0] || null, reason: routerPickExplanation(ranked), source: 'router', team: [], ranked: ranked.candidates };
+  const engine = ranked.candidates[0] || null;
+  const reason = engine && engineHosted(engine) && !engines.length
+    ? `router picked ${engine.id} because no tool installed here can take ${normalizedRole} work.`
+    : routerPickExplanation(ranked);
+  const notice = switchNotice({
+    label,
+    role: normalizedRole,
+    missing: missingPickedTool(normalizedRole, withProjectRoster(registry, root, options), options),
+    engine,
+    registry,
+    canLogIn: !atrisLoggedIn(options),
+  });
+  return { engine, reason, source: 'router', team: [], ranked: ranked.candidates, notice: showSwitchNotice(notice, options) };
+}
+
+// --- When a job runs somewhere other than its pick -----------------------
+
+function engineHosted(engine) {
+  const seed = engine && ENGINE_SEED_META[engine.id];
+  return Boolean(seed && seed.hosted);
+}
+
+// The engine with its place for this one job, when its seed names one.
+function withRoleOrder(engine, role) {
+  const seed = ENGINE_SEED_META[engine.id];
+  const order = seed && seed.role_order ? seed.role_order[role] : undefined;
+  return Number.isInteger(order) ? { ...engine, fallback_order: order } : engine;
+}
+
+// True when this machine is logged in to atris: an ATRIS_TOKEN, or the token
+// `atris login` saves. One file read, no process and no network, so routing
+// stays probe-free. options.loggedIn decides in tests.
+function atrisLoggedIn(options = {}) {
+  if (typeof options.loggedIn === 'boolean') return options.loggedIn;
+  if (String(process.env.ATRIS_TOKEN || '').trim()) return true;
+  try {
+    const saved = JSON.parse(fs.readFileSync(path.join(stateHome(), '.atris', 'credentials.json'), 'utf8'));
+    return Boolean(saved && saved.token);
+  } catch {
+    return false;
+  }
+}
+
+// The hosted engines that may take this job, after every installed tool:
+// atris-fast for search and review, composer for search. None without a
+// login, since a hosted run bills the person's atris tokens. None for build:
+// the hosted turn's file relay here is read-only (a 2026-10-07 probe asked
+// it to write a file and the relay refused every write), so a hosted build
+// would answer in chat and change nothing.
+function hostedFallbacks(registry, role, options = {}) {
+  if (role === 'executor' || !atrisLoggedIn(options)) return [];
+  return registry.engines
+    .filter((engine) => engineHosted(engine))
+    .filter((engine) => engine.id === 'atris-fast' || (engine.roles.includes(role) && !routerSkipsRole(engine, role)))
+    .filter((engine) => engineReadyAt(engine, options.now))
+    .sort((a, b) => Number(a.fallback_order) - Number(b.fallback_order));
+}
+
+function engineMissing(registry, engineId) {
+  const engine = registry.engines.find((entry) => entry.id === engineId);
+  return Boolean(engine && engine.health && engine.health.status === 'not_installed');
+}
+
+// The tool the first roster pick in line names for this job, when that tool
+// is not installed here. '' when no pick names a missing tool.
+function missingPickedTool(role, registry, options = {}) {
+  const machine = options.machineRosterPicks || readMachineRoster(options);
+  const session = options.sessionRosterPicks || readSessionRosterLayer(options).picks;
+  for (const key of rosterJobKeysFor(role, options)) {
+    for (const value of [session && session[key], registry.roster && registry.roster[key], machine && machine[key]]) {
+      const pick = rosterPickObject(value);
+      if (!pick || pickRoleForKey(key, pick) !== role) continue;
+      const [first] = pickWorkers(pick);
+      if (!first || first.error || rosterPickExpired(first, options.now)) continue;
+      return engineMissing(registry, first.engine) ? first.engine : '';
+    }
+  }
+  return '';
+}
+
+function noticeToolName(engineId) {
+  if (engineId === 'atris-fast') return 'atris 2.5 fast';
+  if (CLAUDE_FAMILY_ENGINES.includes(engineId) && engineId !== 'haiku') return 'claude code';
+  return engineId;
+}
+
+// One plain line when a job runs somewhere other than its pick because the
+// picked tool is missing, or lands on a hosted engine. '' when nothing
+// switched. With no pick, search's own pick is haiku on claude code.
+function switchNotice({ label, role, missing = '', engine = null, registry = null, canLogIn = false }) {
+  const missingName = missing ? (CLAUDE_FAMILY_ENGINES.includes(missing) ? 'claude code' : noticeToolName(missing)) : '';
+  if (!engine) {
+    if (!registry) return '';
+    const what = missingName ? `${missingName} is not installed and no other tool here can take it` : 'no tool here can take it';
+    if (role === 'executor') return `${label}: ${what}. install claude code or codex; atris 2.5 fast cannot edit files yet.`;
+    return `${label}: ${what}. install claude code${canLogIn ? ', or run atris login so atris 2.5 fast can take it' : ''}.`;
+  }
+  const hosted = engineHosted(engine);
+  const tokens = hosted ? ' (uses your atris tokens)' : '';
+  if (missingName) return `${label}: ${missingName} is not installed, so ${noticeToolName(engine.id)} took it${tokens}.`;
+  if (!hosted || !registry) return '';
+  const why = role === 'navigator' && engineMissing(registry, 'claude') ? 'claude code is not installed' : 'no tool here can take it';
+  return `${label}: ${why}, so ${noticeToolName(engine.id)} took it${tokens}.`;
+}
+
+// Each notice prints once per run, on stderr, however many times a job
+// resolves. ATRIS_SWITCH_NOTICE=0 silences it.
+const SHOWN_NOTICES = new Set();
+
+function showSwitchNotice(notice, options = {}) {
+  if (!notice) return '';
+  if (options.quiet !== true && process.env.ATRIS_SWITCH_NOTICE !== '0' && !SHOWN_NOTICES.has(notice)) {
+    SHOWN_NOTICES.add(notice);
+    console.error(notice);
+  }
+  return notice;
 }
 
 // The ordered team for one job: every worker that can run right now, lead
@@ -2176,6 +2360,7 @@ function engineDoctorReport(root = process.cwd()) {
     let health = engine.health && engine.health.status ? engine.health : { status: installed ? 'ready' : 'not_installed' };
     if (installed && health.status === 'not_installed') health = { status: 'ready' };
     if (!installed && health.status === 'ready') health = { status: 'not_installed' };
+    if (!installed && health.status === 'not_installed') health = { ...health, checked_at: new Date().toISOString() };
     return { ...engine, installed, health };
   });
   const next = { ...registry, updated_at: new Date().toISOString(), engines };
@@ -2200,6 +2385,9 @@ module.exports = {
   setRosterPick,
   confirmRoster,
   normalizeRosterModel,
+  currentClaudeModel,
+  retiredModelsNamed,
+  RETIRED_CLAUDE_MODELS,
   isClaudeFamilyModel,
   rosterModelLabel,
   parseRosterUntil,