atris 3.69.0 → 3.71.0

package/commands/autoland.js

@@ -9,6 +9,7 @@ const autoland = require('../lib/autoland');
 const { gateForHuman, plainLandingReason } = require('../lib/voice-gate');
 const { evaluateAutoAccept } = require('../lib/auto-accept-certified');
 const { sweepEngineAskReceipts } = require('../lib/engine-receipt-sweep');
+const { readSshAgents, findLeakedSshAgents, findAgentStartLines, agentStartLineText, stopLeakedSshAgents, closeLostRuns, readResourceHistory, errorReason, leakGrowthNote } = require('../lib/engine-resource');
 const { validateRecentAskReceipts } = require('../lib/engine-validate');
 const { operatorReady, hasAgentJargon, explainResult } = autoland;
 const MISSION_AUTO_VERIFY_STATUSES = new Set(['planning', 'paused', 'ready']);
@@ -358,8 +359,8 @@ function refreshLandingRefs(root) {
   }
 }
 
-function sweepLanding(root, { ttlDays, staleHours, now = Date.now() } = {}) {
-  refreshLandingRefs(root);
+function sweepLanding(root, { ttlDays, staleHours, now = Date.now(), refresh = true } = {}) {
+  if (refresh) refreshLandingRefs(root);
   const { collectBoard, reap } = require('./land');
   // light: this board only feeds .branches staleness + .summary; reap builds
   // its own full board for dirty-count salvage decisions.
@@ -479,7 +480,7 @@ function protectedReviewWaiting(root, policy = {}, waiting = []) {
 // lib/voice-gate.js (plainLandingReason); this alias keeps call sites short.
 const plainReason = plainLandingReason;
 
-function showStatus(root, args) {
+function showStatus(root, args, deps = {}) {
   const json = args.includes('--json');
   const policy = autoland.readPolicy(root);
   const enabled = Boolean(policy && policy.enabled);
@@ -528,6 +529,45 @@ function showStatus(root, args) {
   if (policy && policy.imessage_to) console.log(`  daily message: ${policy.imessage_to} at ${policy.digest_hour ?? autoland.DEFAULT_DIGEST_HOUR}:00`);
   const reapTrouble = autoland.readState(root).last_reap_error;
   if (reapTrouble) console.log(`  cleanup trouble: landing sweep failed on ${reapTrouble.date} (${reapTrouble.error}) - run: atris land --reap`);
+  const lost = readResourceHistory(root);
+  if (lost.read_error) console.log(`  engine run log: could not read it (${lost.read_error}), so lost, killed, and failed runs in the last day are unknown`);
+  if (lost.lost_closed_day) {
+    const newest = lost.last_lost_closed;
+    const when = `${String(newest.at || '').slice(0, 16).replace('T', ' ')} UTC`;
+    console.log(`  engine runs closed after their parent died in the last day: ${lost.lost_closed_day}, newest ${newest.engine || 'unknown engine'} on ${newest.task || 'no task'} at ${when}`);
+  }
+  if (lost.kills_day) {
+    // Timeouts are counted apart, and the newest kill named is the newest one
+    // that was not a timeout, so a night of timeouts cannot hide a crash.
+    const timeLimit = lost.time_limit_kills_day;
+    const counts = timeLimit === lost.kills_day
+      ? 'all at their time limit'
+      : `${timeLimit ? `${timeLimit} at their time limit, ` : ''}${lost.low_memory_kills_day} with machine memory low`;
+    const kill = lost.last_day_other_kill || lost.last_kill;
+    const label = timeLimit && lost.last_day_other_kill ? 'newest not at a time limit:' : 'newest';
+    const when = `${String(kill.at || '').slice(0, 16).replace('T', ' ')} UTC`;
+    const free = Number.isFinite(kill.free_pct) ? `, ${kill.free_pct}% memory free` : '';
+    console.log(`  engine runs force-killed in the last day: ${lost.kills_day}, ${counts}; ${label} ${kill.engine || 'unknown engine'} on ${kill.task || 'no task'} at ${when}, ${kill.cause || 'cause unknown'}${free}`);
+  }
+  if (lost.errors_day) {
+    // Runs that failed with a message and were not killed, such as an engine
+    // that could not start; kills are counted on the line above.
+    const failed = lost.last_day_error;
+    const when = `${String(failed.at || '').slice(0, 16).replace('T', ' ')} UTC`;
+    console.log(`  engine runs that ended in an error in the last day: ${lost.errors_day}, newest ${failed.engine || 'unknown engine'} on ${failed.task || 'no task'} at ${when}: ${errorReason(failed)}`);
+  }
+  const { leaked: leakedAgents, unread: unreadAgents } = countLeakedSshAgents(deps);
+  const unchecked = unreadAgents.length ? `could not read the ${unreadAgents.join(' or the ')}, so some ssh-agents went unchecked` : '';
+  if (leakedAgents) {
+    const stop = heartbeatLive ? 'the next hourly pass stops them' : 'stop them now: atris engine sweep --apply';
+    console.log(`  leaked ssh-agents on this machine: ${unchecked ? 'at least ' : ''}${leakedAgents}${leakGrowthNote(lost.first_day_leak_reading, leakedAgents)}; ${stop}${unchecked ? `; ${unchecked}` : ''}`);
+    // A test run reads only the home it was handed, never the real one.
+    if (deps.home || !process.env.NODE_TEST_CONTEXT) {
+      for (const found of findAgentStartLines(deps.home ? { home: deps.home } : {})) console.log(`    ${agentStartLineText(found)}`);
+    }
+  } else if (unchecked) {
+    console.log(`  leaked ssh-agents on this machine: unknown, ${unchecked}`);
+  }
   console.log('');
   const humanOnly = blocked.filter((r) => String(r.reason || '').startsWith('denied_tag_'));
   const needsWork = blocked.filter((r) => !String(r.reason || '').startsWith('denied_tag_'));
@@ -747,11 +787,20 @@ function persistTickReceipt(root, receipt) {
 // Heartbeat liveness helpers live in lib/autoland.js so task ready copy and
 // status share one gate (recent tick receipt within two hours).
 
+function acceptedNotLandedNote(receipt) {
+  const rows = Array.isArray(receipt.accepted_not_landed) ? receipt.accepted_not_landed : [];
+  if (!rows.length) return '';
+  return `, ${rows.length} accepted but not proven landed (${rows.map((r) => `${r.ref} ${r.status}`).join(', ')})`;
+}
+
 function stuckBacklogNote(receipt) {
   const parts = [];
   const scanned = Number(receipt.scanned || 0);
   const certified = Number(receipt.certified || 0);
-  if (scanned > 0 && receipt.landed.length === 0) {
+  // Stuck means nothing cleared review. Accepted-but-unproven work is named
+  // separately (accepted_not_landed), not misread as a wedged queue.
+  const accepted = Array.isArray(receipt.accepted) ? receipt.accepted.length : receipt.landed.length;
+  if (scanned > 0 && accepted === 0) {
     parts.push(`${certified}/${scanned} certified in review, none landed`);
   }
   const unrunnable = Array.isArray(receipt.unrunnable_verifiers) ? receipt.unrunnable_verifiers.length : 0;
@@ -773,6 +822,85 @@ function engineReceiptSweepNote(receipt) {
   return `, finalized ${finalized} stale engine receipt${finalized === 1 ? '' : 's'} as presumed dead`;
 }
 
+// Read only: how many ssh-agents look leaked right now, and which readers
+// failed, since then the count is only a floor. A test run never reads the
+// real machine, and a thrown read counts as none.
+function countLeakedSshAgents(deps = {}) {
+  const none = { leaked: 0, unread: [] };
+  try {
+    const read = deps.readSshAgents;
+    if (!read && process.env.NODE_TEST_CONTEXT) return none;
+    const uid = deps.uid !== undefined ? deps.uid : (typeof process.getuid === 'function' ? process.getuid() : null);
+    if (uid === null) return none;
+    const { agents, referenced, unread = [] } = (read || readSshAgents)();
+    return { leaked: findLeakedSshAgents(agents, { referenced, uid }).length, unread };
+  } catch {
+    return none;
+  }
+}
+
+// Shell startup files that start an ssh-agent per shell leave one behind
+// for every engine shell. Each pass stops the ones a fresh recheck still
+// calls leaked, and never lets a failed read break the pass.
+function runSshAgentSweep(root, receipt, deps = {}) {
+  try {
+    const read = deps.read || readSshAgents;
+    const uid = deps.uid !== undefined ? deps.uid : (typeof process.getuid === 'function' ? process.getuid() : null);
+    const empty = { stopped: [], failed: [], skipped: [] };
+    // A test run must never stop real agents on the machine running it.
+    if (uid === null || (!deps.read && process.env.NODE_TEST_CONTEXT)) {
+      receipt.ssh_agent_sweep = empty;
+      return receipt.ssh_agent_sweep;
+    }
+    const { agents, referenced, unread = [] } = read();
+    const leaked = findLeakedSshAgents(agents, { referenced, uid });
+    const result = leaked.length
+      ? stopLeakedSshAgents(root, leaked, { read, uid, ...(deps.kill ? { kill: deps.kill } : {}) })
+      : empty;
+    // A reading that failed on either scan is kept, so the summary can say
+    // some agents went unchecked instead of reading as a clean machine.
+    const missed = [...new Set([...unread, ...(result.unread || [])])];
+    receipt.ssh_agent_sweep = missed.length ? { ...result, unread: missed } : result;
+  } catch (err) {
+    receipt.ssh_agent_sweep_error = String((err && err.message) || err).slice(0, 200);
+  }
+  return receipt.ssh_agent_sweep || null;
+}
+
+function sshAgentSweepNote(receipt) {
+  const stopped = (receipt.ssh_agent_sweep?.stopped || []).length;
+  const failed = (receipt.ssh_agent_sweep?.failed || []).length;
+  const replaced = (receipt.ssh_agent_sweep?.replaced || []).length;
+  const unread = receipt.ssh_agent_sweep?.unread || [];
+  const stoppedNote = stopped ? `, stopped ${stopped} leaked ssh-agent${stopped === 1 ? '' : 's'}` : '';
+  const failedNote = failed ? `, could not stop ${failed} leaked ssh-agent${failed === 1 ? '' : 's'}` : '';
+  const replacedNote = replaced ? `, left ${replaced} younger replacement ssh-agent${replaced === 1 ? '' : 's'} alone` : '';
+  const unreadNote = unread.length ? `, could not read the ${unread.join(' or the ')}, so some ssh-agents went unchecked` : '';
+  const scanErrorNote = receipt.ssh_agent_sweep_error ? ', could not scan ssh-agents, so leaked agents may remain' : '';
+  return stoppedNote + failedNote + replacedNote + unreadNote + scanErrorNote;
+}
+
+// An engine run whose dispatching process died never writes its own end.
+// Each pass writes a "parent gone" end for those, so the log stops carrying
+// them as open, and never lets a failed read break the pass.
+function runLostRunSweep(root, receipt, deps = {}) {
+  try {
+    const close = deps.close || closeLostRuns;
+    const closed = close(root, deps.now ? { now: deps.now } : {});
+    receipt.lost_run_sweep = { closed: closed.map((end) => end.run_id) };
+  } catch (err) {
+    receipt.lost_run_sweep_error = String((err && err.message) || err).slice(0, 200);
+  }
+  return receipt.lost_run_sweep || null;
+}
+
+function lostRunSweepNote(receipt) {
+  const closed = (receipt.lost_run_sweep?.closed || []).length;
+  const closedNote = closed ? `, closed ${closed} lost engine run${closed === 1 ? '' : 's'}` : '';
+  const errorNote = receipt.lost_run_sweep_error ? ', could not close lost engine runs, so unfinished records may remain' : '';
+  return closedNote + errorNote;
+}
+
 async function runEngineAnswerValidation(root, receipt, deps = {}) {
   try {
     receipt.engine_answer_validation = await validateRecentAskReceipts(root, deps);
@@ -796,6 +924,9 @@ async function runTickBody(root, { json, policy, receipt, engineValidationDeps =
     receipt.engine_receipt_sweep_error = String((err && err.message) || err).slice(0, 200);
   }
 
+  runSshAgentSweep(root, receipt);
+  runLostRunSweep(root, receipt);
+
   await runEngineAnswerValidation(root, receipt, engineValidationDeps);
 
   // 1. certify and land in one task process. Keeping both phases together lets
@@ -806,6 +937,9 @@ async function runTickBody(root, { json, policy, receipt, engineValidationDeps =
   // 78 certified rows waiting. Let `atris task auto-accept-certified` apply
   // its own default (12 without --all, a high safety cap under --all) so a
   // policy with accept_all:true actually drains the full certified set.
+  // Refresh origin once, before anything is accepted: the landing proof reads
+  // origin's target, and a stale ref would call landed work unlanded.
+  refreshLandingRefs(root);
   const cliArgs = ['task', 'auto-accept-certified', '--json', '--certify-first'];
   if (policy.accept_all) cliArgs.push('--all');
   else if (policy.strict_verify === false) cliArgs.push('--no-strict-verify');
@@ -829,7 +963,21 @@ async function runTickBody(root, { json, policy, receipt, engineValidationDeps =
     if (parsed.certification && parsed.certification.ok !== true) {
       receipt.certify_error = 'certify-verified failed';
     }
-    receipt.landed = results.filter((r) => r.action === 'accepted').map((r) => r.ref);
+    // Accepted is a review verdict; landed is a git fact. Only work whose
+    // landing proof passed (lib/landing-proof.js) may be called landed. The
+    // rest is named with the reason, so an accept over an empty or unpushed
+    // commit reads as what it is instead of padding the landed count.
+    const acceptedRows = results.filter((r) => r.action === 'accepted');
+    receipt.accepted = acceptedRows.map((r) => r.ref);
+    receipt.landed = acceptedRows.filter((r) => r.landing && r.landing.status === 'landed').map((r) => r.ref);
+    const notLanded = acceptedRows
+      .filter((r) => !r.landing || r.landing.status !== 'landed')
+      .map((r) => ({
+        ref: r.ref,
+        status: (r.landing && r.landing.status) || 'unverified',
+        reason: (r.landing && r.landing.reason) || 'no_landing_proof',
+      }));
+    if (notLanded.length) receipt.accepted_not_landed = notLanded;
     const citationBlocks = results
       .filter((r) => r.action === 'skipped' && r.proof_state === 'suite_green_citation_required')
       .map((r) => ({ ref: r.ref, reason: r.reason }));
@@ -964,7 +1112,7 @@ async function runTickBody(root, { json, policy, receipt, engineValidationDeps =
   // TTL-expired work is salvaged before deletion, and 48h-stale active work
   // is carried into the digest instead of silently aging forever.
   try {
-    const landingSweep = sweepLanding(root);
+    const landingSweep = sweepLanding(root, { refresh: false });
     receipt.reaped = landingSweep.reaped;
     receipt.landing_sweep = {
       before: landingSweep.before,
@@ -1035,6 +1183,22 @@ async function runTickBody(root, { json, policy, receipt, engineValidationDeps =
     receipt.wish_dispatch_error = String((err && err.message) || err).slice(0, 200);
   }
 
+  // 3e. map fold, once an hour: map notes member changes saved as their own
+  // files under atris/refs/map-notes.d/ are folded into the shared map notes
+  // on main and removed, in one pushed commit. Off by policy: map_fold:false.
+  if (policy.map_fold !== false) {
+    try {
+      const { foldDue, foldMapNotesOnMain } = require('../lib/member-map-fold');
+      if (foldDue(state.last_map_fold_at)) {
+        const fold = foldMapNotesOnMain(root);
+        receipt.map_fold = { folded: fold.folded, added: fold.added || 0, reason: fold.reason || null };
+        if (fold.reason !== 'main_unreadable') state.last_map_fold_at = new Date().toISOString();
+      }
+    } catch (err) {
+      receipt.map_fold_error = String((err && err.message) || err).slice(0, 200);
+    }
+  }
+
   // 4. daily digest at the configured hour
   const today = new Date().toISOString().slice(0, 10);
   const digestHour = Number(policy.digest_hour ?? autoland.DEFAULT_DIGEST_HOUR);
@@ -1148,7 +1312,7 @@ async function runTickBody(root, { json, policy, receipt, engineValidationDeps =
     // Always print the standing backlog, and name work that cleared every
     // gate and still did not land. That is the shape of a stuck loop.
     const stuckNote = stuckBacklogNote(receipt);
-    const summary = `autoland tick: ${receipt.reviews_certified ?? 0} reviews certified, ${receipt.landed.length} landed${receipt.landed.length ? ` (${receipt.landed.join(', ')})` : ''}, ${receipt.alarms} alarms${stuckNote}, digest ${digestTickStatus(receipt)}${reapNote}${janitorNote}${heldNote}${wishNote}${engineSweepNote}${receiptNote}`;
+    const summary = `autoland tick: ${receipt.reviews_certified ?? 0} reviews certified, ${receipt.landed.length} landed${receipt.landed.length ? ` (${receipt.landed.join(', ')})` : ''}${acceptedNotLandedNote(receipt)}, ${receipt.alarms} alarms${stuckNote}, digest ${digestTickStatus(receipt)}${reapNote}${janitorNote}${heldNote}${wishNote}${engineSweepNote}${sshAgentSweepNote(receipt)}${lostRunSweepNote(receipt)}${receiptNote}`;
     const validationLine = engineAnswerValidationLine(receipt);
     if (validationLine) console.log(validationLine);
     console.log(gateForHuman(summary).text);
@@ -1221,6 +1385,11 @@ module.exports = {
   hasAgentJargon,
   runEngineAnswerValidation,
   runTickBody,
+  runSshAgentSweep,
+  sshAgentSweepNote,
+  showStatus,
+  runLostRunSweep,
+  lostRunSweepNote,
   sweepLanding,
   verifyClosedTaskMissions,
 };

package/commands/autopilot.js

@@ -119,7 +119,7 @@ function repoMapAuditReportsClean(cwd) {
  * Scan workspace for the next thing worth doing.
  * Returns { task, why, kind } or null.
  */
-async function suggestNextTask(cwd, skipped = new Set(), { auto = false } = {}) {
+async function suggestNextTask(cwd, skipped = new Set(), { auto = false, problems = null } = {}) {
   const atrisDir = path.join(cwd, 'atris');
   const suggestions = [];
 
@@ -344,7 +344,9 @@ async function suggestNextTask(cwd, skipped = new Set(), { auto = false } = {})
         kind: 'imagined',
         priority: 99
       };
-    } catch {
+    } catch (err) {
+      // An engine that never answered is not an idle workspace; tell the caller.
+      if (problems && err && err.launchFailed) problems.push(String(err.message || '').split('\n')[0]);
       return null;
     }
   }
@@ -607,6 +609,8 @@ function executePhaseDetailed(phase, context, options = {}) {
 
   let rosterRunner = null;
   let startedMs = Date.now();
+  // Prep writes its own pair of readings inside the pass, before this launch's.
+  let endResource = () => null;
   try {
     let cmd = options.cmdOverride;
     if (!cmd) {
@@ -638,6 +642,12 @@ function executePhaseDetailed(phase, context, options = {}) {
     const env = { ...process.env };
     delete env.CLAUDECODE;
     startedMs = Date.now();
+    // Machine memory and load at both ends of the launch, so a phase killed
+    // with SIGKILL says whether the machine was short on memory.
+    endResource = require('../lib/engine-resource').startEngineRun(process.cwd(), {
+      engine: (rosterRunner && rosterRunner.engineId) || 'runner',
+      task: `autopilot ${phase}`,
+    });
     const output = execPhaseCommandSync(cmd, {
       cwd: process.cwd(),
       encoding: 'utf8',
@@ -648,10 +658,12 @@ function executePhaseDetailed(phase, context, options = {}) {
     });
 
     try { fs.unlinkSync(tmpFile); } catch {}
+    endResource();
     recordPhaseRosterRun(process.cwd(), phase, rosterRunner, startedMs, { outcome: 'landed', stdout: output || '' });
     return { prompt, output: output || '' };
   } catch (err) {
     try { fs.unlinkSync(tmpFile); } catch {}
+    const resourceEnd = endResource(err);
     recordPhaseRosterRun(process.cwd(), phase, rosterRunner, startedMs, phaseFailureOutcome(err, rosterRunner), err);
     if (isPhaseTimeoutError(err)) {
       // A roster worker that stalls sits out the cooldown, so the next
@@ -664,7 +676,8 @@ function executePhaseDetailed(phase, context, options = {}) {
       throw new Error(`${phase} phase timed out after ${timeout / 1000}s (configured runner hit the wall; any work it committed survives, reconcile from pre-tick HEADs)`);
     }
     if (isPhaseKillError(err)) {
-      throw new Error(`${phase} phase killed by ${err.signal || 'a signal'} before the ${timeout / 1000}s wall, not a timeout; check memory pressure or an external supervisor`);
+      const cause = resourceEnd && resourceEnd.cause ? `${resourceEnd.cause}; ` : '';
+      throw new Error(`${phase} phase killed by ${err.signal || 'a signal'} before the ${timeout / 1000}s wall, not a timeout; ${cause}check memory pressure or an external supervisor`);
     }
     if (err.stdout) {
       return { prompt, output: err.stdout };
@@ -1525,6 +1538,7 @@ function defaultPlanReviewExecutor(prompt, { cwd, timeout = 180000 } = {}) {
   fs.writeFileSync(tmpFile, prompt);
   let runner = null;
   let startedMs = Date.now();
+  let endResource = () => null;
   try {
     runner = buildPlanReviewRunner(tmpFile, cwd, timeout);
     const cmd = runner.command;
@@ -1532,6 +1546,12 @@ function defaultPlanReviewExecutor(prompt, { cwd, timeout = 180000 } = {}) {
     const env = { ...process.env };
     delete env.CLAUDECODE;
     startedMs = Date.now();
+    // Machine memory and load at both ends of the review, so one killed with
+    // SIGKILL says whether the machine was short on memory.
+    endResource = require('../lib/engine-resource').startEngineRun(cwd, {
+      engine: (runner && runner.engineId) || 'runner',
+      task: 'autopilot plan review',
+    });
     const output = execPhaseCommandSync(cmd, {
       cwd,
       encoding: 'utf8',
@@ -1540,11 +1560,15 @@ function defaultPlanReviewExecutor(prompt, { cwd, timeout = 180000 } = {}) {
       maxBuffer: 10 * 1024 * 1024,
       env,
     });
+    endResource();
     recordPhaseRosterRun(cwd, 'plan review', runner, startedMs, { outcome: 'landed', stdout: output || '' });
     return output || '';
   } catch (err) {
+    const end = endResource(err);
     recordPhaseRosterRun(cwd, 'plan review', runner, startedMs, phaseFailureOutcome(err, runner), err);
     if (err.stdout) return err.stdout;
+    // A kill leaves no report of its own, so the error names the likely cause.
+    if (end && end.cause && err instanceof Error) err.message = `${err.message}; ${end.cause}`;
     throw err;
   } finally {
     try { fs.unlinkSync(tmpFile); } catch {}
@@ -1557,6 +1581,9 @@ function defaultPlanReviewExecutor(prompt, { cwd, timeout = 180000 } = {}) {
  */
 function defaultCodexExecutor(prompt, { cwd, timeout = 180000 } = {}) {
   const cmd = process.env.ATRIS_CODEX_CMD || 'codex';
+  // Machine memory and load at both ends of the signer, so one killed with
+  // SIGKILL says whether the machine was short on memory.
+  const endResource = require('../lib/engine-resource').startEngineRun(cwd, { engine: 'codex', task: 'autopilot codex review' });
   const proc = spawnSync(cmd, ['-p', prompt], {
     cwd,
     encoding: 'utf8',
@@ -1575,8 +1602,18 @@ function defaultCodexExecutor(prompt, { cwd, timeout = 180000 } = {}) {
       if (sweepErr.code !== 'ESRCH') throw sweepErr;
     }
   }
+  // spawnSync does not throw, so a failure is passed in the thrown shape.
+  const failed = proc.error || proc.signal || proc.status !== 0;
+  const end = endResource(failed ? {
+    code: proc.error && proc.error.code,
+    signal: proc.signal,
+    stderr: proc.stderr,
+    message: proc.error ? proc.error.message : `codex exited with status ${proc.status}`,
+  } : null);
+  const cause = end && end.cause ? `; ${end.cause}` : '';
   if (proc.status !== 0 && !proc.stdout) {
-    throw new Error(`codex exited with status ${proc.status}: ${proc.stderr || 'no output'}`);
+    const how = proc.signal ? `was stopped by ${proc.signal}` : `exited with status ${proc.status}`;
+    throw new Error(`codex ${how}: ${proc.stderr || 'no output'}${cause}`);
   }
   return proc.stdout || '';
 }
@@ -3268,10 +3305,14 @@ Reply with the JSON array and nothing else.`;
   fs.writeFileSync(tmpFile, prompt);
 
   let output = '';
+  let endResource = () => null;
   try {
     const cmd = buildRunnerCommand({ promptFile: tmpFile });
     const env = { ...process.env };
     delete env.CLAUDECODE;
+    // Machine memory and load at both ends of the proposal, so one killed
+    // with SIGKILL says whether the machine was short on memory.
+    endResource = require('../lib/engine-resource').startEngineRun(cwd, { engine: 'runner', task: 'horizon proposal' });
     output = execPhaseCommandSync(cmd, {
       cwd,
       encoding: 'utf8',
@@ -3280,13 +3321,18 @@ Reply with the JSON array and nothing else.`;
       maxBuffer: 10 * 1024 * 1024,
       env
     }).toString();
+    endResource();
   } catch (err) {
+    const end = endResource(err);
+    // launchFailed marks errors where the engine never answered.
     if (isPhaseTimeoutError(err)) {
-      throw new Error(`horizon-proposal phase timed out after ${PHASE_TIMEOUT / 1000}s`);
+      throw Object.assign(new Error(`horizon-proposal phase timed out after ${PHASE_TIMEOUT / 1000}s`), { launchFailed: true });
     }
     if (isPhaseKillError(err)) {
-      throw new Error(`horizon-proposal phase killed by ${err.signal || 'a signal'} before the ${PHASE_TIMEOUT / 1000}s wall, not a timeout`);
+      const cause = end && end.cause ? `; ${end.cause}` : '';
+      throw Object.assign(new Error(`horizon-proposal phase killed by ${err.signal || 'a signal'} before the ${PHASE_TIMEOUT / 1000}s wall, not a timeout${cause}`), { launchFailed: true });
     }
+    if (err && typeof err === 'object') err.launchFailed = true;
     throw err;
   } finally {
     try { fs.unlinkSync(tmpFile); } catch {}
@@ -3470,18 +3516,23 @@ async function autopilotAtris(description, options = {}) {
       break;
     }
 
-    const suggestion = await suggestNextTask(cwd, skipped, { auto });
+    const problems = [];
+    const suggestion = await suggestNextTask(cwd, skipped, { auto, problems });
 
     if (!suggestion) {
+      // A failed proposal launch must not read as a clean workspace.
+      const proposalFailure = problems[0] ? `I could not ask the engine for new work: ${problems[0]}` : '';
       tickOutcome = 'idle';
-      tickOutcomeText = 'I checked the repo and found no work to pick up this tick.';
+      tickOutcomeText = proposalFailure
+        ? `I found no work to pick up this tick. ${proposalFailure}`
+        : 'I checked the repo and found no work to pick up this tick.';
       tickNextStep = 'scan for new signals and propose the next horizon';
       if (verbose) {
-        console.log('  nothing to do. workspace is clean.');
+        console.log(proposalFailure ? `  nothing to do. ${proposalFailure}` : '  nothing to do. workspace is clean.');
       } else {
         printPlainBlock([
           'I found no work this tick.',
-          'The workspace looks clean.',
+          proposalFailure || 'The workspace looks clean.',
           '',
           'Next I will stop until a new signal appears.'
         ].join('\n'));
@@ -3956,10 +4007,14 @@ Search the codebase to verify. Reply: YES <reason> or NO <reason>`;
   const tmpFile = path.join(cwd, '.staleness-prompt.tmp');
   fs.writeFileSync(tmpFile, prompt);
 
+  let endResource = () => null;
   try {
     const env = { ...process.env };
     delete env.CLAUDECODE;
     const cmd = buildRunnerCommand({ promptFile: tmpFile, allowedTools: 'Bash,Read,Glob,Grep' });
+    // Machine memory and load at both ends of the check, so one killed with
+    // SIGKILL says whether the machine was short on memory.
+    endResource = require('../lib/engine-resource').startEngineRun(cwd, { engine: 'runner', task: 'staleness check' });
     const output = execPhaseCommandSync(cmd, {
       cwd,
       encoding: 'utf8',
@@ -3968,6 +4023,7 @@ Search the codebase to verify. Reply: YES <reason> or NO <reason>`;
       maxBuffer: 2 * 1024 * 1024,
       env
     }).trim();
+    endResource();
 
     try { fs.unlinkSync(tmpFile); } catch {}
 
@@ -3980,7 +4036,10 @@ Search the codebase to verify. Reply: YES <reason> or NO <reason>`;
   } catch (err) {
     try { fs.unlinkSync(tmpFile); } catch {}
     // On timeout or crash, treat as unverifiable, conservative default
-    return { fresh: false, reasoning: `Model check failed: ${(err.message || '').slice(0, 100)}` };
+    // A kill leaves no report of its own, so the reason names the likely cause.
+    const end = endResource(err);
+    const cause = end && end.cause ? `; ${end.cause}` : '';
+    return { fresh: false, reasoning: `Model check failed: ${(err.message || '').slice(0, 100)}${cause}` };
   }
 }
 
@@ -3992,6 +4051,7 @@ async function autopilotFromTodo(options = {}) {
 }
 
 module.exports = {
+  askModel,
   snapshotRepoHeads,
   diffAdvancedRepoHeads,
   reconcileTimedOutTick,