atris 3.71.3 → 3.72.0

package/lib/member-autoland.js

@@ -561,6 +561,9 @@ function autolandMemberRun({ mission, cwd, summary = '', workerEngine = '', load
 }
 
 const MAX_REQUEUES = 3;
+// A merge nobody closed within a day may belong to an earlier week. Closing it
+// later would count old work as a new landing, so a person decides.
+const STALE_MERGE_MS = 24 * 60 * 60 * 1000;
 
 // One queued branch: leave it, forget it, or catch it up and queue it again.
 // Only the exact commit autoland queued (or its own catch-up) is re-queued; a
@@ -592,13 +595,13 @@ function inMergeQueue(number, cwd) {
   return out.ok && out.stdout === 'true';
 }
 
-function requeueOne(entry, cwd, maxRequeues) {
+function requeueOne(entry, cwd, maxRequeues, now = Date.now(), dryRun = false) {
   const { branch, base, number } = entry;
   const label = `pull request #${number} (${branch})`;
   const keep = (state, line) => ({ branch, number, state, keep: true, line: `${label}: ${line}` });
   const forget = (state, line) => ({ branch, number, state, keep: false, line: `${label}: ${line}` });
   const viewed = run('gh', ['pr', 'view', String(number), '--json',
-    'number,state,headRefName,baseRefName,headRefOid,isCrossRepository,autoMergeRequest,mergeable'], cwd);
+    'number,state,headRefName,baseRefName,headRefOid,isCrossRepository,autoMergeRequest,mergeable,mergedAt'], cwd);
   let pr = null;
   try {
     pr = viewed.ok ? JSON.parse(viewed.stdout) : null;
@@ -610,6 +613,12 @@ function requeueOne(entry, cwd, maxRequeues) {
   // that carried someone else's push leaves the job for a person.
   if (pr.state === 'MERGED') {
     if (pr.headRefOid !== entry.pushed) return forget('merged', 'merged with commits someone else pushed; its job is left for you');
+    // An old merge still closes its job, recorded as merged earlier so the
+    // weekly board does not count last week's work as this week's landing.
+    const mergedMs = Date.parse(pr.mergedAt || '');
+    if (Number.isFinite(mergedMs) && now - mergedMs > STALE_MERGE_MS) {
+      return { ...forget('merged', 'merged over a day ago; closed without counting it as a new landing'), own: true, stale: true };
+    }
     return { ...forget('merged', 'merged'), own: true };
   }
   if (pr.state !== 'OPEN') return forget('closed', 'closed by someone; left alone');
@@ -625,6 +634,7 @@ function requeueOne(entry, cwd, maxRequeues) {
     // failure fails twice and waits for a fix.
     const failed = pr.headRefOid === entry.pushed ? failedCheckRuns(number, cwd) : [];
     if (failed.length && entry.reran !== entry.pushed) {
+      if (dryRun) return keep('would-rerun', 'a check failed; would run the failed checks again once');
       const reran = failed.filter((id) => run('gh', ['run', 'rerun', id, '--failed'], cwd).ok);
       if (reran.length) return { ...keep('rerun', 'a check failed; ran the failed checks again once'), reran: entry.pushed };
       return keep('queued', 'a check failed and could not be run again; will look again');
@@ -636,6 +646,12 @@ function requeueOne(entry, cwd, maxRequeues) {
   if ((Number(entry.requeues) || 0) >= maxRequeues) {
     return forget('gave-up', `dropped again after ${maxRequeues} catch-ups; left for you`);
   }
+  // A dry run never fetches, pushes, or switches auto-merge back on. GitHub's
+  // own clash flag stands in for the catch-up it would try.
+  if (dryRun) {
+    if (pr.mergeable === 'CONFLICTING') return { ...forget('clash', 'clashes with the main branch; left for you'), why: 'it clashes with the main branch' };
+    return keep('would-requeue', 'would catch it up with the main branch and queue it again');
+  }
   const fetched = run('git', ['fetch', '-q', 'origin', `+refs/heads/${branch}:refs/remotes/origin/${branch}`], cwd);
   const remote = run('git', ['rev-parse', `refs/remotes/origin/${branch}`], cwd);
   if (!fetched.ok || !remote.ok || remote.stdout !== entry.pushed) {
@@ -664,7 +680,7 @@ function heldAtClose(row) {
   return Boolean(require('./member-task-pick').heldForPerson(row));
 }
 
-function defaultCloseTask(id, { number }) {
+function defaultCloseTask(id, { number, stale = false }) {
   const taskDb = require('./task-db');
   const db = taskDb.open();
   // A hold put on the job while its change waited to merge still wins: that
@@ -673,7 +689,9 @@ function defaultCloseTask(id, { number }) {
   if (heldAtClose(row)) return { updated: false };
   const out = taskDb.doneTask(db, {
     id, actor: 'autoland', allowReview: true, autoAccepted: true,
-    action: 'merged', proof: `its own pull request #${number} merged`,
+    action: stale ? 'merged_earlier' : 'merged',
+    proof: stale ? `its own pull request #${number} merged over a day ago; closed without counting it as a new landing`
+      : `its own pull request #${number} merged`,
   });
   return { ...out, replaced: row.metadata && row.metadata.replaced_pull_requests };
 }
@@ -681,14 +699,14 @@ function defaultCloseTask(id, { number }) {
 // The member's own change merged: close every job it was queued for. A job
 // already closed, or one that cannot be read, is left as it is. Each closed
 // job hands back the clashing pull requests its redo replaced.
-function closeMergedJobs(entry, closeTask) {
+function closeMergedJobs(entry, closeTask, { stale = false } = {}) {
   const ids = Array.isArray(entry.task_ids) ? entry.task_ids.filter((id) => typeof id === 'string' && id.trim()) : [];
   const closed = [];
   const replaced = [];
   for (const id of ids) {
     let out = null;
     try {
-      out = closeTask(id, { number: entry.number, branch: entry.branch });
+      out = closeTask(id, { number: entry.number, branch: entry.branch, stale });
     } catch {
       out = null;
     }
@@ -746,6 +764,21 @@ function defaultSendBack(id, { number, pushed, why }) {
   });
 }
 
+// The dry run's stand-ins: the same checks the real close and send-back make,
+// read only.
+function wouldClose(id) {
+  const taskDb = require('./task-db');
+  const row = taskDb.getTask(taskDb.open(), id);
+  return { updated: Boolean(row) && ['open', 'claimed', 'review'].includes(row.status) && !heldAtClose(row) };
+}
+
+function wouldSendBack(id) {
+  const taskDb = require('./task-db');
+  const row = taskDb.getTask(taskDb.open(), id);
+  const restarts = Number(row && row.metadata && row.metadata.clash_restarts) || 0;
+  return { reopened: Boolean(row) && row.status === 'review' && !heldAtClose(row) && restarts < MAX_CLASH_RESTARTS };
+}
+
 function sendBackClashedJobs(entry, why, sendBack) {
   const ids = Array.isArray(entry.task_ids) ? entry.task_ids.filter((id) => typeof id === 'string' && id.trim()) : [];
   const sent = [];
@@ -761,26 +794,45 @@ function sendBackClashedJobs(entry, why, sendBack) {
   return sent;
 }
 
+// A mission can queue its change while a sweep is reading GitHub. Apply only
+// the sweep's own changes to the list as it stands now: an entry someone
+// added or rewrote meanwhile is kept as they left it.
+function mergeQueueChanges(latest, snapshot, swept) {
+  const out = { ...latest };
+  for (const [key, before] of Object.entries(snapshot)) {
+    if (JSON.stringify(latest[key]) !== JSON.stringify(before)) continue;
+    if (key in swept) out[key] = swept[key];
+    else delete out[key];
+  }
+  return out;
+}
+
 // Look at every branch autoland queued and re-queue the ones GitHub dropped.
 // A branch whose own change merged closes the jobs it was queued for; one that
-// clashes sends its jobs back on the list.
-function requeueDroppedAutolands({ cwd, maxRequeues = MAX_REQUEUES, closeTask = defaultCloseTask, sendBack = defaultSendBack } = {}) {
+// clashes sends its jobs back on the list. dryRun reads GitHub and the job
+// list, says what it would do, and changes nothing anywhere.
+function requeueDroppedAutolands({ cwd, maxRequeues = MAX_REQUEUES, closeTask = defaultCloseTask, sendBack = defaultSendBack, now = Date.now(), dryRun = false } = {}) {
   const file = queueFile(cwd);
   if (!file) return { checked: 0, results: [], line: 'not inside a git checkout' };
   if (!policyOn(cwd)) return { checked: 0, results: [], line: 'self-landing is not switched on in the main checkout' };
+  if (dryRun) {
+    closeTask = wouldClose;
+    sendBack = wouldSendBack;
+  }
   const entries = readQueue(file);
+  const snapshot = JSON.parse(JSON.stringify(entries));
   const results = [];
   for (const [key, entry] of Object.entries(entries)) {
     const valid = entry && typeof entry.branch === 'string' && entry.branch === key && typeof entry.base === 'string'
       && Number.isInteger(entry.number) && entry.number > 0 && /^[0-9a-f]{40,64}$/.test(String(entry.pushed || ''));
-    const result = valid ? requeueOne(entry, cwd, maxRequeues)
+    const result = valid ? requeueOne(entry, cwd, maxRequeues, now, dryRun)
       : { branch: key, state: 'unreadable', keep: false, line: `${key}: queue entry could not be read; dropped from the list` };
     if (valid && result.own) {
-      const merged = closeMergedJobs(entry, closeTask);
+      const merged = closeMergedJobs(entry, closeTask, { stale: result.stale === true });
       result.closed = merged.closed;
       const n = result.closed.length;
-      if (n) result.line += `; closed ${n === 1 ? 'its job' : `its ${n} jobs`}`;
-      result.replaced = closeReplacedPullRequests(merged.replaced, entry.number, cwd);
+      if (n) result.line += `; ${dryRun ? 'would close' : 'closed'} ${n === 1 ? 'its job' : `its ${n} jobs`}`;
+      result.replaced = dryRun ? [] : closeReplacedPullRequests(merged.replaced, entry.number, cwd);
       if (result.replaced.length) {
         result.line += `; closed the clashing ${result.replaced.length === 1 ? 'change' : 'changes'} it replaced (${result.replaced.map((r) => `#${r}`).join(', ')})`;
       }
@@ -788,7 +840,8 @@ function requeueDroppedAutolands({ cwd, maxRequeues = MAX_REQUEUES, closeTask =
     if (valid && result.state === 'clash') {
       result.sent_back = sendBackClashedJobs(entry, result.why, sendBack);
       const n = result.sent_back.length;
-      if (n) result.line = result.line.replace(/; left for you$/, `; ${n === 1 ? 'its job went' : `its ${n} jobs went`} back on the list`);
+      const went = dryRun ? 'would go' : 'went';
+      if (n) result.line = result.line.replace(/; left for you$/, `; ${n === 1 ? `its job ${went}` : `its ${n} jobs ${went}`} back on the list`);
     }
     results.push(result);
     if (!result.keep) delete entries[key];
@@ -798,7 +851,7 @@ function requeueDroppedAutolands({ cwd, maxRequeues = MAX_REQUEUES, closeTask =
       entries[key] = { ...entry, reran: result.reran, reran_at: new Date().toISOString() };
     }
   }
-  if (results.length) writeQueue(file, entries);
+  if (results.length && !dryRun) writeQueue(file, mergeQueueChanges(readQueue(file), snapshot, entries));
   const requeued = results.filter((r) => r.state === 'requeued').length;
   const rerun = results.filter((r) => r.state === 'rerun').length;
   const closed = results.reduce((sum, r) => sum + (r.closed ? r.closed.length : 0), 0);
@@ -810,8 +863,46 @@ function requeueDroppedAutolands({ cwd, maxRequeues = MAX_REQUEUES, closeTask =
   return { checked: results.length, requeued, rerun, closed, results, line };
 }
 
+// The team loop is not the only thing running. On 2026-10-15 it swept for the
+// last time at 07:03, two member changes merged at 07:05, and their jobs
+// waited a week while mission runs kept going. A finished mission run looks at
+// the merge line too, but only while the loop is down: a live loop does it
+// along with its code refresh and two-hour warning, which a second caller
+// would throw off. It takes the loop's lock and its own five-minute timer, so
+// a loop starting mid-pass never overlaps it. Nothing queued, or self-landing
+// off: GitHub is not called.
+function teamLoopAlive(cwd) {
+  const root = mainCheckoutRoot(cwd);
+  if (!root) return false;
+  let pid = null;
+  try {
+    pid = JSON.parse(fs.readFileSync(path.join(root, '.atris', 'state', 'member-up.json'), 'utf8')).pid;
+  } catch {
+    return false;
+  }
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === 'EPERM';
+  }
+}
+
+function sweepAfterMissionRun({ cwd, now = Date.now(), requeue = requeueDroppedAutolands } = {}) {
+  if (!policyOn(cwd)) return null;
+  const file = queueFile(cwd);
+  if (!file || !Object.keys(readQueue(file)).length) return null;
+  if (teamLoopAlive(cwd)) return null;
+  return require('./member-up').withMaintenanceLock(
+    { cwd, now, stateFile: 'mission-merge-pass.json' },
+    () => requeue({ cwd, now }),
+  );
+}
+
 module.exports = {
   autolandMemberRun,
+  sweepAfterMissionRun,
   landingDestination,
   requeueDroppedAutolands,
   codeStatus,

package/lib/member-progress.js

@@ -4,7 +4,7 @@
 // stderr and appended to <dir>/<member>.log so another shell can tail it.
 
 const fs = require('fs');
-const os = require('os');
+const { atrisHome } = require('./state-home');
 const path = require('path');
 
 const MAX_PROGRESS_BYTES = 256 * 1024;
@@ -135,7 +135,7 @@ function formatCodexEvent(event, cwd) {
 }
 
 function progressDir() {
-  return process.env.ATRIS_PROGRESS_DIR || path.join(os.homedir(), '.atris', 'progress');
+  return process.env.ATRIS_PROGRESS_DIR || path.join(atrisHome(), 'progress');
 }
 
 function safeMember(member) {

package/lib/member-report.js

@@ -251,14 +251,24 @@ function sameTitle(a, b) {
 function summarize(items) {
   const groups = { merged: [], finished: [], turned_down: [], waiting: [] };
   const sorted = [...items].sort((a, b) => b.at - a.at);
+  const indexed = sorted.every((item) => !item.title || typeof item.title === 'string');
+  const titles = new Set();
+  const links = new Set();
   for (const item of sorted) {
     if (!item.title) continue;
     // Newest word on a piece of work wins, and merged beats finished. A pull
     // request a diary already logged shares its link, so it counts once.
+    const title = indexed ? item.title.trim().toLowerCase() : null;
     const seenBefore = (seen) => sameTitle(seen.title, item.title) || (item.link && seen.link === item.link);
-    if (Object.values(groups).some((list) => list.some(seenBefore))) continue;
+    if (indexed
+      ? titles.has(title) || (item.link && links.has(item.link))
+      : Object.values(groups).some((list) => list.some(seenBefore))) continue;
     const { member, at, group, ...rest } = item;
     groups[group].push(rest);
+    if (indexed) {
+      titles.add(title);
+      if (item.link) links.add(item.link);
+    }
   }
   return groups;
 }

package/lib/member-self-next-job.js

@@ -5,7 +5,7 @@
 // job is a normal open task: the North Star is the goal, and the mission's
 // `## Check` section names the command that proves a run. A mission with no
 // runnable check writes nothing, so the member stays idle as before. At most
-// one self-written job is open per member, and at most MAX_PER_DAY are
+// one self-written job is open, claimed, or in review per member, and at most MAX_PER_DAY are
 // written per member per local day, so an idle team cannot spin forever.
 
 const fs = require('fs');
@@ -75,6 +75,11 @@ function writeSelfNextJob(taskDb, db, { root, workspaceRoot, member, job, now =
   if (mine.some((row) => row.status === 'open' || row.status === 'claimed')) {
     return { skip: 'its last self-written job is still open' };
   }
+  // A job waiting for review still holds the seat. Freeing it at review let
+  // atris-cli pile up 15 "next step toward" jobs in review at once.
+  if (mine.some((row) => row.status === 'review')) {
+    return { skip: 'its last self-written job is still waiting for review' };
+  }
   const day = localDay(now);
   const today = mine.filter((row) => String(row.source_key).startsWith(`${prefix}${day}:`)).length;
   if (today >= MAX_PER_DAY) return { skip: `already wrote ${MAX_PER_DAY} jobs for itself today` };

package/lib/member-up.js

@@ -69,15 +69,17 @@ function refreshMemberCode(root) {
     : { state: 'refresh-failed', line: 'could not refresh the members\' code copy; will try again' };
 }
 
-// Shared by all windows of a project, including linked work folders. The
-// completed-pass timestamp survives release, so a second window waits too.
-function memberMaintenance({ cwd, codeRoot, now = Date.now(), requeueDropped, waitingTasks = () => [] }) {
+// One lock for every pass that reads GitHub's merge line, shared by all windows
+// of a project, including linked work folders. Each caller keeps its own
+// completed-pass file, so its timer survives release and a second window
+// waits too. Busy lock or no git: nothing runs.
+function withMaintenanceLock({ cwd, now = Date.now(), stateFile }, fn) {
   const common = maintenanceGit(cwd, ['rev-parse', '--path-format=absolute', '--git-common-dir']);
   if (!common.ok) return { results: [] };
   const dir = path.join(path.dirname(common.text), '.atris', 'state');
   fs.mkdirSync(dir, { recursive: true });
   const lock = path.join(dir, 'member-up-maintenance.lock');
-  const file = path.join(dir, 'member-up-maintenance.json');
+  const file = path.join(dir, stateFile);
   let fd;
   try {
     fd = fs.openSync(lock, 'wx');
@@ -110,6 +112,15 @@ function memberMaintenance({ cwd, codeRoot, now = Date.now(), requeueDropped, wa
     };
     state.checked_at = now;
     save();
+    return fn(state, save);
+  } finally {
+    fs.closeSync(fd);
+    fs.unlinkSync(lock);
+  }
+}
+
+function memberMaintenance({ cwd, codeRoot, now = Date.now(), requeueDropped, waitingTasks = () => [] }) {
+  return withMaintenanceLock({ cwd, now, stateFile: 'member-up-maintenance.json' }, (state, save) => {
     const out = requeueDropped();
     const results = [...(out?.results || [])];
     const merged = results.some((r) => r.state === 'merged');
@@ -128,10 +139,7 @@ function memberMaintenance({ cwd, codeRoot, now = Date.now(), requeueDropped, wa
     state.refresh_failed = refresh?.state === 'refresh-failed';
     save();
     return { ...out, results };
-  } finally {
-    fs.closeSync(fd);
-    fs.unlinkSync(lock);
-  }
+  });
 }
 
 function dayOf(ms) {
@@ -514,6 +522,7 @@ module.exports = {
   idleWaitMs,
   memberUpResult,
   memberMaintenance,
+  withMaintenanceLock,
   parseMemberUpArgs,
   runMemberUp,
 };

package/lib/merged-review-close.js

@@ -0,0 +1,206 @@
+'use strict';
+
+// Jobs whose change is already on the main branch close themselves, every
+// hour, with no person and no team loop.
+//
+// On 2026-10-22 four jobs in this repo sat in review for a week after their
+// change merged. Two were still on the autoland list (#1318, #1319); two had
+// left it, so only the code itself could say they landed. This pass reads
+// git, never GitHub, and closes a review job only on one of two exact facts:
+//
+// One. The commit the builder recorded for the job (work_commit, different
+// from the commit it started on) is on the main branch, and it came in from
+// a side branch. A commit on the main line itself proves nothing: a builder
+// working in the main folder records whatever the main branch was at.
+//
+// Two. The job has no commit of its own, and every test file its check names
+// was first added to the main branch after the job was written, did not exist
+// where the job started, is still there, and no other review job names it.
+//
+// Either way, work a later commit reverted stays open, and so does a job
+// whose row changed after the scan read it.
+//
+// A merge more than a day old still closes the job, but records it as
+// merged earlier, so last week's work never counts as this week's landing.
+
+const { spawnSync } = require('child_process');
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const SHA = /^[0-9a-f]{40,64}$/;
+const TEST_FILE = /^(?!\/)(?!.*\.\.)[\w.@+-]+(?:\/[\w.@+-]+)+\.(?:c|m)?[jt]s$|^(?!\/)(?!.*\.\.)[\w.@+-]+(?:\/[\w.@+-]+)+\.py$/;
+
+function git(args, cwd) {
+  const res = spawnSync('git', args, { cwd, encoding: 'utf8', timeout: 60000, maxBuffer: 64 * 1024 * 1024 });
+  return { ok: res.status === 0, status: res.status, out: String(res.stdout || '').trim() };
+}
+
+// The branch merged work lands on: origin's default first, then the usual
+// names, then a local branch for a project with no remote.
+function mainBranchRef(root) {
+  const head = git(['symbolic-ref', '--quiet', 'refs/remotes/origin/HEAD'], root);
+  const candidates = [head.ok ? head.out.replace(/^refs\/remotes\//, '') : '', 'origin/master', 'origin/main', 'master', 'main'];
+  for (const ref of candidates.filter(Boolean)) {
+    if (git(['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], root).ok) return ref;
+  }
+  return null;
+}
+
+function createdMs(value) {
+  if (typeof value === 'number') return value;
+  const asNumber = Number(value);
+  if (Number.isFinite(asNumber) && asNumber > 0) return asNumber;
+  const parsed = Date.parse(String(value || ''));
+  return Number.isFinite(parsed) ? parsed : null;
+}
+
+function verifyTestFiles(verify) {
+  return [...new Set(String(verify || '').replace(/[`'"]/g, ' ').split(/\s+/).filter((t) => TEST_FILE.test(t)))];
+}
+
+// One reader per pass: the main line is read once, and each answer is kept.
+function createReader(root, base) {
+  const line = git(['log', '--first-parent', '--format=%H %ct', base], root).out
+    .split('\n').filter(Boolean).map((row) => {
+      const [sha, ct] = row.split(' ');
+      return { sha, at: Number(ct) * 1000 };
+    }).reverse();
+  const onLine = new Map(line.map((c, i) => [c.sha, i]));
+  const ancestor = (sha, of) => git(['merge-base', '--is-ancestor', sha, of], root).status === 0;
+  const commitExists = (sha) => SHA.test(sha) && git(['cat-file', '-e', `${sha}^{commit}`], root).ok;
+
+  // The main-line commit that brought `sha` in, and whether `sha` is itself
+  // on the main line. The main line is ordered, so a binary search holds.
+  function landing(sha) {
+    if (!commitExists(sha) || !line.length || !ancestor(sha, line[line.length - 1].sha)) return null;
+    if (onLine.has(sha)) return { sha, at: line[onLine.get(sha)].at, mainLine: true };
+    let lo = 0;
+    let hi = line.length - 1;
+    while (lo < hi) {
+      const mid = (lo + hi) >> 1;
+      if (ancestor(sha, line[mid].sha)) hi = mid;
+      else lo = mid + 1;
+    }
+    return { sha: line[lo].sha, at: line[lo].at, mainLine: false };
+  }
+
+  function firstAdded(file) {
+    const rows = git(['log', base, '--diff-filter=A', '--format=%H', '--', file], root).out.split('\n').filter(Boolean);
+    return rows.length ? rows[rows.length - 1] : null;
+  }
+
+  const existsAt = (sha, file) => git(['cat-file', '-e', `${sha}:${file}`], root).ok;
+  const commitTime = (sha) => Number(git(['log', '-1', '--format=%ct', sha], root).out) * 1000;
+  // Taken back out: git's own revert message names the commit it reverts.
+  const reverted = (...shas) => shas.filter(Boolean).some((sha) => git(['log', base, '--format=%H', '-F',
+    `--grep=This reverts commit ${sha}`], root).out.length > 0);
+  const onBase = (file) => existsAt(base, file);
+  return { landing, firstAdded, existsAt, commitExists, commitTime, reverted, onBase };
+}
+
+// Commit times are whole seconds, so compare at that grain.
+const notBefore = (ms, created) => ms >= Math.floor(created / 1000) * 1000;
+
+// Why this review job's change is on the main branch, or null. `shared`
+// holds test files named by more than one review job: a new file two jobs
+// both point at says nothing about which one landed it.
+function mergedProof(task, reader, shared = new Set()) {
+  const metadata = (task && task.metadata) || {};
+  const work = String(metadata.work_commit || '').trim();
+  const start = String(metadata.start_commit || '').trim();
+  const created = createdMs(task.created_at);
+  if (SHA.test(work) && work !== start) {
+    // The job has code of its own: only that code can say it landed. A test
+    // file someone else merged does not close a redo that never merged.
+    const landed = reader.landing(work);
+    if (!landed || landed.mainLine) return null;
+    // A commit older than the job is not the job's work.
+    if (created && !notBefore(reader.commitTime(work), created)) return null;
+    if (reader.reverted(work, landed.sha)) return null;
+    return { how: 'work_commit', commit: work, landed_sha: landed.sha, landed_at: landed.at };
+  }
+  // A check run from another folder names paths relative to that folder.
+  if (/(^|[\s;&|(])cd\s/.test(String(metadata.verify || ''))) return null;
+  const files = verifyTestFiles(metadata.verify);
+  if (!files.length || !created || files.some((file) => shared.has(file))) return null;
+  let latest = null;
+  for (const file of files) {
+    const added = reader.firstAdded(file);
+    if (!added || !reader.onBase(file)) return null;
+    if (SHA.test(start) && reader.commitExists(start) && reader.existsAt(start, file)) return null;
+    const landed = reader.landing(added);
+    if (!landed) return null;
+    // Added before the job existed: the test belongs to earlier work.
+    if (!notBefore(reader.commitTime(added), created)) return null;
+    if (reader.reverted(added, landed.sha)) return null;
+    if (!latest || landed.at > latest.landed_at) latest = { commit: added, landed_sha: landed.sha, landed_at: landed.at, file };
+  }
+  return latest ? { how: 'verify_test', files, ...latest } : null;
+}
+
+function heldForPerson(row) {
+  if (!row || typeof row !== 'object') return true;
+  return Boolean(require('./member-task-pick').heldForPerson(row));
+}
+
+// The row must still be the one the scan read: new proof since then (a newer
+// updated_at) means newer work the old read knows nothing about.
+function defaultClose(id, { action, proof, updatedAt }) {
+  const taskDb = require('./task-db');
+  const db = taskDb.open();
+  const row = taskDb.getTask(db, id);
+  if (!row || row.status !== 'review' || heldForPerson(row)) return { updated: false };
+  if (updatedAt != null && Number(row.updated_at) !== Number(updatedAt)) return { updated: false };
+  return taskDb.doneTask(db, { id, actor: 'autoland', allowReview: true, autoAccepted: true, action, proof });
+}
+
+function proofLine(found) {
+  const short = (sha) => String(sha || '').slice(0, 10);
+  const when = new Date(found.landed_at).toISOString().slice(0, 16).replace('T', ' ');
+  return found.how === 'work_commit'
+    ? `its own commit ${short(found.commit)} is on the main branch, merged ${when} UTC (${short(found.landed_sha)})`
+    : `its check ${found.files.join(', ')} was added to the main branch after the job was written, merged ${when} UTC (${short(found.landed_sha)})`;
+}
+
+// Close every review job in `tasks` whose change is on the main branch.
+// dryRun reports what would close and writes nothing.
+function closeMergedReviewJobs({ root, tasks = [], now = Date.now(), dryRun = false, close = defaultClose } = {}) {
+  const base = mainBranchRef(root);
+  if (!base) return { base: null, checked: 0, matched: [], closed: [] };
+  const reader = createReader(root, base);
+  const candidates = tasks.filter((t) => t && t.status === 'review' && !heldForPerson(t)
+    && String((t.review && t.review.approval_status) || (t.metadata && t.metadata.approval_status) || 'pending') === 'pending');
+  const named = new Map();
+  for (const task of tasks.filter((t) => t && t.status === 'review')) {
+    for (const file of verifyTestFiles(task.metadata && task.metadata.verify)) named.set(file, (named.get(file) || 0) + 1);
+  }
+  const shared = new Set([...named].filter(([, n]) => n > 1).map(([file]) => file));
+  const matched = [];
+  const closed = [];
+  for (const task of candidates) {
+    let found = null;
+    try {
+      found = mergedProof(task, reader, shared);
+    } catch {
+      found = null;
+    }
+    if (!found) continue;
+    const fresh = now - found.landed_at <= DAY_MS;
+    const action = fresh ? 'merged' : 'merged_earlier';
+    const proof = fresh ? `merged: ${proofLine(found)}` : `merged earlier, closed without counting it as a new landing: ${proofLine(found)}`;
+    const row = { id: task.id, ref: task.display_id || task.id, title: task.title, how: found.how, action, landed_at: new Date(found.landed_at).toISOString(), proof };
+    matched.push(row);
+    if (dryRun) continue;
+    let out = null;
+    try {
+      out = close(task.id, { action, proof, updatedAt: task.updated_at });
+    } catch {
+      out = null;
+    }
+    if (out && out.updated) closed.push(row);
+  }
+  return { base, checked: candidates.length, matched, closed };
+}
+
+module.exports = {
+  closeMergedReviewJobs,
+};

package/lib/mission-protected-lane.js

@@ -235,11 +235,53 @@ function gitSubcommand(args) {
   return '';
 }
 
+// Tools that can publish, post, send, or merge. With a mission id, each one
+// found on PATH gets a wrapper that checks the mission's your-yes lock first
+// (lib/yes-lock.js); with no lock file the wrapper just runs the tool.
+const YES_LOCK_TOOLS = ['npm', 'yarn', 'pnpm', 'npx', 'pnpx', 'bunx', 'gh', 'atris'];
+
+// The lines every wrapper shares: ask the lock, refuse with its message, run
+// the real tool, and close the steps a yes allowed once that run succeeds.
+function yesLockLines(toolExpr, binExpr) {
+  return [
+    `const yesLock = require(${JSON.stringify(path.join(__dirname, 'yes-lock.js'))});`,
+    `const verdict = config.missionId ? yesLock.check({ stateDir: config.stateDir, missionId: config.missionId, seal: config.seal, tool: ${toolExpr}, args, gitBin: config.gitBin || null, cwd: process.cwd(), env: process.env }) : null;`,
+    `if (verdict && verdict.hold) { process.stderr.write(verdict.message + '\\n'); process.exit(yesLock.HELD_EXIT); }`,
+    `const runReal = () => { const child = spawnSync(${binExpr}, args, { cwd: process.cwd(), stdio: 'inherit' }); const ok = !child.error && child.status === 0; if (verdict && verdict.consume) yesLock.consume(config.stateDir, config.missionId, config.seal, verdict.consume, { ok, claims: verdict.claims }); if (child.error) { process.stderr.write(child.error.message + '\\n'); process.exit(1); } process.exit(child.status == null ? 1 : child.status); };`,
+  ];
+}
+
+function resolveTool(name, root, pathValue) {
+  const found = spawnSync('sh', ['-c', `command -v ${name}`], { cwd: root, encoding: 'utf8', timeout: 5000, env: { ...process.env, PATH: pathValue } });
+  const bin = String(found.stdout || '').trim();
+  return found.status === 0 && bin && path.isAbsolute(bin) ? bin : null;
+}
+
+function yesLockWrapper({ tool, realBin, missionId, seal, stateDir }) {
+  const config = { tool, realBin, missionId, seal, stateDir };
+  return [
+    '#!/usr/bin/env node',
+    "'use strict';",
+    `const { spawnSync } = require('child_process');`,
+    `const config = ${JSON.stringify(config)};`,
+    `const args = process.argv.slice(2);`,
+    ...yesLockLines('config.tool', 'config.realBin'),
+    'runReal();',
+    '',
+  ].join('\n');
+}
+
 function prepareMissionGitGuard({
   root = process.cwd(),
   tags = [],
   pathValue = process.env.PATH || '',
+  missionId = null,
+  // the sealed owner steps from the mission record, and where approvals live
+  yesLockSeal = [],
+  stateDir = null,
 } = {}) {
+  const seal = Array.isArray(yesLockSeal) ? yesLockSeal : [];
+  const locked = Boolean(missionId && seal.length && stateDir);
   const resolved = spawnSync('sh', ['-c', 'command -v git'], {
     cwd: root,
     encoding: 'utf8',
@@ -253,7 +295,7 @@ function prepareMissionGitGuard({
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'atris-mission-git-'));
   const wrapper = path.join(dir, 'git');
   const modulePath = __filename;
-  const config = { root: path.resolve(root), tags: normalizedTags(tags), gitBin };
+  const config = { root: path.resolve(root), tags: normalizedTags(tags), gitBin, missionId: locked ? missionId : null, seal, stateDir };
   const source = [
     '#!/usr/bin/env node',
     "'use strict';",
@@ -263,6 +305,7 @@ function prepareMissionGitGuard({
     gitSubcommand.toString(),
     defaultGit.toString(),
     `const args = process.argv.slice(2);`,
+    ...yesLockLines("'git'", 'config.gitBin'),
     `if (gitSubcommand(args) === 'commit') {`,
     `  const result = guard.inspectMissionProtectedDiff({ root: config.root, tags: config.tags, includeUnstaged: false, git: defaultGit(config.gitBin) });`,
     `  if (!result.allowed) {`,
@@ -270,12 +313,17 @@ function prepareMissionGitGuard({
     `    process.exit(78);`,
     `  }`,
     `}`,
-    `const child = spawnSync(config.gitBin, args, { cwd: process.cwd(), stdio: 'inherit' });`,
-    `if (child.error) { process.stderr.write(child.error.message + '\\n'); process.exit(1); }`,
-    `process.exit(child.status == null ? 1 : child.status);`,
+    'runReal();',
     '',
   ].join('\n');
   fs.writeFileSync(wrapper, source, { encoding: 'utf8', mode: 0o755 });
+  if (locked) {
+    for (const tool of YES_LOCK_TOOLS) {
+      const realBin = resolveTool(tool, root, pathValue);
+      if (!realBin) continue;
+      fs.writeFileSync(path.join(dir, tool), yesLockWrapper({ tool, realBin, missionId, seal, stateDir }), { encoding: 'utf8', mode: 0o755 });
+    }
+  }
 
   return {
     env: { ...process.env, PATH: `${dir}${path.delimiter}${pathValue}` },