atris 3.71.3 → 3.72.0

package/commands/member.js

@@ -10636,11 +10636,13 @@ function memberGoFinishTask(owner, task, result, thrown = null) {
   const required = require('../lib/member-task-pick').taskCheck(task).command;
   const checked = mission.verifier_result && mission.verifier_result.passed === true
     && (!required || String(mission.verifier_result.command || '').trim() === required);
-  if (!thrown && result && result.started && ['complete', 'ready'].includes(mission.status) && checked) {
+  // The commit comes from the member's own work copy, not the main folder.
+  const workRoot = (result && result.worktree && result.worktree.path) || (mission.worktree && mission.worktree.path) || undefined;
+  const passed = !thrown && result && result.started && ['complete', 'ready'].includes(mission.status) && checked;
+  const changedNothing = passed && selfWrittenJob(task) && !runChangedSomething(taskDb, db, task, result, workRoot);
+  if (passed && !changedNothing) {
     const proof = [`[verified] ${owner} ran mission ${result.mission_id} and its check passed.`,
       receipt ? `Receipt: ${receipt}` : ''].filter(Boolean).join('\n');
-    // The commit comes from the member's own work copy, not the main folder.
-    const workRoot = (result.worktree && result.worktree.path) || (mission.worktree && mission.worktree.path) || undefined;
     const ready = taskDb.readyTask(db, { id: task.id, actor: owner, proof, workRoot });
     if (ready.ready !== false) return { id: task.id, title: task.title, outcome: 'review', receipt: receipt || null };
     // Its change already merged and the merge line closed the job.
@@ -10650,6 +10652,7 @@ function memberGoFinishTask(owner, task, result, thrown = null) {
   const lastReason = String((ticks[ticks.length - 1] || {}).reason || (ticks[ticks.length - 1] || {}).error || '');
   const outOfTime = /timeout|wall-exceeded/.test(lastReason);
   const why = thrown ? thrown.message
+    : changedNothing ? 'the run passed its check but changed nothing: no new commit, no pushed branch, no pull request'
     : outOfTime ? 'ran out of time before the work finished'
     : (result && result.error) || (result && result.started ? 'the check did not pass' : 'the run did not start');
   const reason = String(why || 'the run did not finish').split(/\r?\n/)[0].trim().slice(0, 200);
@@ -10678,6 +10681,28 @@ function memberGoFinishTask(owner, task, result, thrown = null) {
   return { id: task.id, title: task.title, outcome, reason, ...(held && forReview ? { held_for: 'review' } : {}) };
 }
 
+// A job the member wrote for itself from its mission ("next step toward:").
+function selfWrittenJob(task) {
+  return String((task && task.source_key) || '').startsWith('self-next:')
+    || (task && task.metadata && task.metadata.source === 'member mission');
+}
+
+// Did the run leave something for review? A pushed branch, a pull request,
+// or a local landing counts, and so does a commit in the work copy that
+// changes files since the job started. With no start commit on record there
+// is nothing to compare, so the run is taken at its word.
+function runChangedSomething(taskDb, db, task, result, workRoot) {
+  const landed = result && result.autoland;
+  if (landed && (landed.pushed || landed.url || landed.merged)) return true;
+  const start = String((taskDb.getTask(db, task.id) || task)?.metadata?.start_commit || '').trim();
+  if (!start) return true;
+  const cwd = workRoot || task.workspace_root || process.cwd();
+  const diff = spawnSync('git', ['diff', '--quiet', start, 'HEAD'], { cwd, encoding: 'utf8' });
+  // Exit 0 means no change. Exit 1 means the code differs; anything else
+  // could not be read, so the run is taken at its word.
+  return diff.status !== 0;
+}
+
 const MEMBER_GO_STRIKES = 3;
 
 // Failed runs on a task since its last pass, review, reopen, or a person

package/commands/mission.js

@@ -1774,6 +1774,14 @@ function appendMemberLog(owner, title, fields = {}, root = process.cwd()) {
   return logPath;
 }
 
+// Shorten at a word boundary so a lesson never ends mid-word.
+function clipWords(text, max) {
+  if (text.length <= max) return text;
+  const cut = text.slice(0, max + 1);
+  const space = cut.lastIndexOf(' ');
+  return `${(space > max * 0.6 ? cut.slice(0, space) : text.slice(0, max)).replace(/[\s,;:.-]+$/, '')}...`;
+}
+
 function crystallizeMemberSkillLesson(owner, entry = {}, root = process.cwd()) {
   const dir = memberDir(owner, root);
   if (!dir) return null;
@@ -1782,38 +1790,47 @@ function crystallizeMemberSkillLesson(owner, entry = {}, root = process.cwd()) {
   const skillDir = path.join(dir, 'skills', 'auto-learned');
   fs.mkdirSync(skillDir, { recursive: true });
   const skillPath = path.join(skillDir, 'SKILL.md');
-  const existingBullets = [];
+  let lines = null;
   if (fs.existsSync(skillPath)) {
     try {
-      const raw = fs.readFileSync(skillPath, 'utf8');
-      for (const line of raw.split(/\r?\n/)) {
-        if (line.trim().startsWith('- **')) existingBullets.push(line.trim());
-      }
+      lines = fs.readFileSync(skillPath, 'utf8').split(/\r?\n/);
     } catch {}
   }
+  const bulletAt = (lines || []).map((line, i) => (line.trim().startsWith('- **') ? i : -1)).filter((i) => i >= 0);
+  const existingBullets = bulletAt.map((i) => lines[i].trim());
   const verifierText = String(entry.verifier || '').replace(/\s+/g, ' ').trim();
   const nextPushText = String(entry.next_push || '').replace(/\s+/g, ' ').trim();
   const layerLabel = String(entry.layer || 'capabilities').trim();
-  const parts = [`- **${todayName()} (${layerLabel})**: ${summary.slice(0, 140)}`];
-  if (verifierText) parts.push(`Verify: \`${verifierText.slice(0, 80)}\``);
-  if (nextPushText) parts.push(`Next push: ${nextPushText.slice(0, 120)}`);
+  const parts = [`- **${todayName()} (${layerLabel})**: ${clipWords(summary, 240)}`];
+  // A cut-off command cannot be run, so a long one is left out, never clipped.
+  if (verifierText && verifierText.length <= 300) parts.push(`Verify: \`${verifierText}\``);
+  if (nextPushText) parts.push(`Next push: ${clipWords(nextPushText, 200)}`);
   const newBullet = parts.join(' -> ');
   const deduped = [
     newBullet,
     ...existingBullets.filter((b) => !b.includes(summary.slice(0, 80))),
   ].slice(0, 5);
 
-  const content = [
-    '---',
-    'name: auto-learned',
-    `description: Verified patterns crystallized from passing runs for ${owner}. Bounded to 5 newest patterns so context never bloats.`,
-    '---',
-    '',
-    '# Auto-Learned Verified Patterns',
-    '',
-    ...deduped,
-    '',
-  ].join('\n');
+  let content;
+  if (bulletAt.length) {
+    // Keep whatever a person or reviewer wrote around the lessons; only the
+    // lesson list itself is rewritten.
+    const first = bulletAt[0];
+    const last = bulletAt[bulletAt.length - 1];
+    content = [...lines.slice(0, first), ...deduped, ...lines.slice(last + 1)].join('\n');
+  } else {
+    content = [
+      '---',
+      'name: auto-learned',
+      `description: Verified patterns crystallized from passing runs for ${owner}. Bounded to 5 newest patterns so context never bloats.`,
+      '---',
+      '',
+      '# Auto-Learned Verified Patterns',
+      '',
+      ...deduped,
+      '',
+    ].join('\n');
+  }
   fs.writeFileSync(skillPath, content, 'utf8');
   return skillPath;
 }
@@ -3199,6 +3216,7 @@ function missionFromArgs(args) {
     '--base',
     '--task',
     '--ask',
+    '--yes-lock',
     '--campaign',
     '--reserve',
     '--mission-id',
@@ -3242,6 +3260,7 @@ function missionFromArgs(args) {
   const taskIds = readRepeatedFlag(args, '--task');
   // MEMBER.md approval-required becomes an open human ask the owner must clear.
   const humanAsks = [...readRepeatedFlag(args, '--ask'), ...memberApprovalAsks(owner, process.cwd(), objective)];
+  const yesLocks = readYesLockSeal(readFlag(args, '--yes-lock', ''), wantsJson(args));
   const drive = missionDrive(readFlag(args, '--destination', ''));
   const alwaysOn = hasFlag(args, '--always-on');
   const xpTaskEnabled = hasFlag(args, '--xp-task') || hasFlag(args, '--agent-xp');
@@ -3278,6 +3297,8 @@ function missionFromArgs(args) {
     stop_condition: stopCondition,
     task_ids: taskIds,
     human_asks: humanAsks,
+    // the sealed owner steps: the guard holds what each locks until the owner says yes
+    ...(yesLocks.length ? { yes_locks: { steps: yesLocks, sealed_at: stampIso() } } : {}),
     ...(campaignId ? { campaign_id: campaignId } : {}),
     ...(drive ? { drive } : {}),
     next_action: verifier ? 'run verifier with `atris mission tick <id> --verify`' : 'define verifier or run next task',
@@ -3296,6 +3317,22 @@ function missionFromArgs(args) {
   return mission;
 }
 
+// --yes-lock '[{"step":3,"text":"...","categories":["publish"]}]': the owner
+// steps a job may not do before the owner says yes. Bad input stops the start.
+const YES_LOCK_CATEGORIES = new Set(['publish', 'tag', 'post', 'send', 'merge', 'deploy']);
+function readYesLockSeal(raw, asJson) {
+  if (!raw) return [];
+  let list;
+  try {
+    list = JSON.parse(raw);
+  } catch {
+    exitMissionError('--yes-lock takes a JSON list of {step, text, categories}', 2, asJson);
+  }
+  const ok = Array.isArray(list) && list.every(l => l && Number.isInteger(l.step) && l.step > 0 && Array.isArray(l.categories) && l.categories.length && l.categories.every(c => YES_LOCK_CATEGORIES.has(c)));
+  if (!ok) exitMissionError('--yes-lock takes a JSON list of {step, text, categories}, with categories from publish, tag, post, send, merge, deploy', 2, asJson);
+  return list.map(l => ({ step: l.step, text: String(l.text || '').slice(0, 200), categories: [...new Set(l.categories)] }));
+}
+
 function applyMissionStartPatch(mission, patch) {
   if (!patch || typeof patch !== 'object') return mission;
   const { metadata, ...rest } = patch;
@@ -9440,7 +9477,7 @@ function spawnGenericRunnerTick(mission, opts) {
     }
     let gitGuard;
     try {
-      gitGuard = prepareMissionGitGuard({ root: cwd, tags: missionProtectedTags(mission, cwd) });
+      gitGuard = prepareMissionGitGuard({ root: cwd, tags: missionProtectedTags(mission, cwd), missionId: mission.id, yesLockSeal: (mission.yes_locks && mission.yes_locks.steps) || [], stateDir: path.join(require('../lib/state-home').atrisHome(), 'state') });
     } catch (error) {
       resolve({
         ok: false,
@@ -9625,7 +9662,7 @@ function spawnClaudeTick(mission, opts) {
   return new Promise((resolve) => {
     let gitGuard;
     try {
-      gitGuard = prepareMissionGitGuard({ root: cwd, tags: missionProtectedTags(mission, cwd) });
+      gitGuard = prepareMissionGitGuard({ root: cwd, tags: missionProtectedTags(mission, cwd), missionId: mission.id, yesLockSeal: (mission.yes_locks && mission.yes_locks.steps) || [], stateDir: path.join(require('../lib/state-home').atrisHome(), 'state') });
     } catch (error) {
       resolve({
         ok: false,
@@ -10453,7 +10490,7 @@ async function executeMissionRunTicksPhase(context) {
         const prompt = buildTickPrompt(tickRuntimeMission, tickIdx, effectiveMaxTicks, frozen, pendingMissionPings(mission), cwd);
         let atris2GitGuard = null;
         try {
-          atris2GitGuard = prepareMissionGitGuard({ root: cwd, tags: missionProtectedTags(mission, cwd) });
+          atris2GitGuard = prepareMissionGitGuard({ root: cwd, tags: missionProtectedTags(mission, cwd), missionId: mission.id, yesLockSeal: (mission.yes_locks && mission.yes_locks.steps) || [], stateDir: path.join(require('../lib/state-home').atrisHome(), 'state') });
         } catch (error) {
           result = {
             ...result,
@@ -11281,12 +11318,23 @@ async function runMission(args) {
     context.error = error;
     throw error;
   } finally {
-    if (context.lock) completeMissionRunPhase(context);
+    if (context.lock) {
+      completeMissionRunPhase(context);
+      sweepMergedMemberWork(context);
+    }
   }
 
   return context.returnValue;
 }
 
+// Merged member work closes its jobs even when the team loop is down.
+function sweepMergedMemberWork(context) {
+  try {
+    const out = require('../lib/member-autoland').sweepAfterMissionRun({ cwd: context.cwd || process.cwd() });
+    if (out && out.closed > 0 && !context.asJson) console.log(out.line);
+  } catch {}
+}
+
 function tickMission(args) {
   const asJson = wantsJson(args);
   if (hasFlag(args, '--help') || hasFlag(args, '-h') || String(args[0] || '').trim() === 'help') {
@@ -12724,6 +12772,7 @@ function missionCommand(args) {
 }
 
 module.exports = {
+  crystallizeMemberSkillLesson,
   listSiblingWorkspaceMissionHints,
   missionProtectedLaneHold,
   missionCommand,

package/commands/sync.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
+const { stateHome } = require('../lib/state-home');
 const { ensureWikiScaffold } = require('../lib/wiki');
 const { upsertAtrisClaudeBootBlock } = require('../lib/claude-boot-block');
 const { ensureRunIgnore } = require('../lib/gitignore');
@@ -809,7 +809,7 @@ function syncSkills({ silent = false } = {}) {
   }
 
   let updated = 0;
-  const homeDir = os.homedir();
+  const homeDir = stateHome();
 
   const skillFolders = fs.readdirSync(packageSkillsDir).filter(f =>
     fs.statSync(path.join(packageSkillsDir, f)).isDirectory()

package/commands/task.js

@@ -29,10 +29,10 @@ const {
   parseVerifyChain,
   parseVerifyCommand,
   runVerifyCommand,
-  runVerifyCommandCached,
   DENIED_TAGS,
 } = require('../lib/auto-accept-certified');
 const { evaluateAcceptVerify } = require('../lib/accept-verify-gate');
+const { checkedCodeSha, runVerifyAtJobCode } = require('../lib/job-code-verify');
 const { proveTaskLanding } = require('../lib/landing-proof');
 const {
   taskExplanation,
@@ -10645,22 +10645,44 @@ function stampVerifyCacheMetadata(taskDb, db, taskId, { verify, result, actor, w
     reason: (result && result.reason) || null,
     ran_at: new Date().toISOString(),
     ran_by: actor,
-    code_sha: currentHeadSha(workspaceRoot),
+    // The commit the check ran on: the job's own code when it has some,
+    // else the folder the job lives in.
+    code_sha: (result && result.code_sha) || currentHeadSha(workspaceRoot),
+    code_source: (result && result.code_source) || 'checkout',
   };
+  // A check is not a touch. Bumping updated_at here put every failed job at
+  // the front of the next pass, so the same six failing jobs won every hour.
   db.prepare(`
     UPDATE tasks
-       SET metadata = ?,
-           updated_at = ?
+       SET metadata = ?
      WHERE id = ?
-  `).run(JSON.stringify(metadata), Date.now(), taskId);
+  `).run(JSON.stringify(metadata), taskId);
+}
+
+// When a review job was last given a second check; never checked reads 0.
+function lastCheckedMs(task) {
+  const ranAt = Date.parse(String(task?.metadata?.verify_cache?.ran_at || ''));
+  return Number.isFinite(ranAt) ? ranAt : 0;
+}
+
+// The check already failed on exactly this code: running it again proves
+// nothing until the code changes.
+function failedOnSameCode(task, verify, codeSha) {
+  const cache = task?.metadata?.verify_cache;
+  return Boolean(cache && typeof cache === 'object' && cache.ok === false && cache.reason === 'verify_failed'
+    && cache.command === verify && codeSha && cache.code_sha === codeSha);
 }
 
 function cachedVerifyVerdict(task, root) {
   const metadata = (task && task.metadata) || {};
   const cache = metadata.verify_cache;
   if (!cache || typeof cache !== 'object') return { fresh: false, command: metadata.verify || null };
+  // A check run on the job's own code stays fresh until that code changes.
+  const currentCode = cache.code_source && cache.code_source !== 'checkout'
+    ? checkedCodeSha(task, root)
+    : currentHeadSha(task.workspace_root || root);
   const fresh = cache.command === metadata.verify
-    && (!cache.code_sha || cache.code_sha === currentHeadSha(task.workspace_root || root));
+    && (!cache.code_sha || cache.code_sha === currentCode);
   return { ...cache, fresh: Boolean(fresh) };
 }
 
@@ -10711,7 +10733,7 @@ function reverifyBeforeLanding(taskDb, db, task, { actor = 'autoland-verifier',
       revise_reason: revised.reason || null,
     };
   }
-  const result = runVerifyCommandCached(verify, task.workspace_root || process.cwd(), verifyCache);
+  const result = runVerifyAtJobCode(verify, task, { root: process.cwd(), cache: verifyCache });
   stampVerifyCacheMetadata(taskDb, db, task.id, { verify, result, actor, workspaceRoot: task.workspace_root });
   if (result.ok) return { ok: true, verify, result };
   const note = landingVerifyFailureNote(verify, result);
@@ -10731,7 +10753,10 @@ function reverifyBeforeLanding(taskDb, db, task, { actor = 'autoland-verifier',
 }
 
 function cmdCertifyVerified(args, options = {}) {
-  const dryRun = hasFlag(args, '--dry-run');
+  // preview: the hourly pass's dry run. Reads the named workspace's jobs and
+  // writes nothing, not even the task list file.
+  const preview = options.preview === true;
+  const dryRun = preview || hasFlag(args, '--dry-run');
   const asJson = wantsJson(args);
   const silent = options.silent === true;
   const verifyCache = options.verifyCache || null;
@@ -10741,13 +10766,18 @@ function cmdCertifyVerified(args, options = {}) {
 
   const taskDb = getTaskDb();
   const db = taskDb.open();
-  const { projection } = writeDefaultProjection(taskDb, db);
+  const projection = preview
+    ? enrichTaskProjection(taskDb.taskProjection(db, { workspaceRoot: options.workspaceRoot || taskDb.workspaceRoot(), limit: 500 }))
+    : writeDefaultProjection(taskDb, db).projection;
+  // Least recently checked first, oldest first among never-checked jobs. The
+  // limit counts checks that actually run, so skipped rows never use a turn.
   const candidates = (projection.tasks || [])
     .filter((t) => t && t.status === 'review')
-    .sort((a, b) => Number(b.updated_at || 0) - Number(a.updated_at || 0))
-    .slice(0, max);
+    .sort((a, b) => lastCheckedMs(a) - lastCheckedMs(b) || Number(a.updated_at || 0) - Number(b.updated_at || 0));
   const results = [];
+  let checks = 0;
   for (const item of candidates) {
+    if (checks >= max) break;
     const fullProjection = enrichTaskProjection(taskDb.taskProjection(db, { taskId: item.id }));
     const task = fullProjection.tasks[0] || null;
     if (!task) {
@@ -10809,11 +10839,16 @@ function cmdCertifyVerified(args, options = {}) {
       results.push({ ref, action: 'skipped', reason: 'no_runnable_check_in_proof' });
       continue;
     }
+    if (failedOnSameCode(task, verify, checkedCodeSha(task, process.cwd()))) {
+      results.push({ ref, action: 'skipped', reason: 'failed_on_this_code', verify });
+      continue;
+    }
+    checks += 1;
     if (dryRun) {
       results.push({ ref, action: 'would_certify', verify });
       continue;
     }
-    const run = runVerifyCommandCached(verify, task.workspace_root || process.cwd(), verifyCache);
+    const run = runVerifyAtJobCode(verify, task, { root: process.cwd(), cache: verifyCache });
     stampVerifyCacheMetadata(taskDb, db, task.id, { verify, result: run, actor, workspaceRoot: task.workspace_root });
     if (!run.ok) {
       results.push({ ref, action: 'verify_failed', reason: run.reason, verify });
@@ -10840,7 +10875,7 @@ function cmdCertifyVerified(args, options = {}) {
     const certifiedNow = readied.event?.payload?.agent_certified === true;
     results.push({ ref, action: certifiedNow ? 'certified' : 'pass_recorded', verify });
   }
-  const { outPath } = writeDefaultProjection(taskDb, db);
+  const outPath = preview ? null : writeDefaultProjection(taskDb, db).outPath;
   const certified = results.filter((r) => r.action === 'certified').length;
   const payload = {
     ok: true,
@@ -13698,6 +13733,7 @@ module.exports = {
   delegateTask,
   AGENT_ENV_MARKERS,
   autoRenderTodoFromDb,
+  cmdCertifyVerified,
   refreshKeptTaskList,
   keptCount,
   projectionMissions,

package/commands/zen.js

@@ -0,0 +1,183 @@
+'use strict';
+
+const { abandonedDaysFromEnv, checkZen, sideCopyLines } = require('../lib/zen');
+const { applyZen } = require('../lib/zen-apply');
+const { workspaceZen } = require('../lib/zen-workspace');
+
+function showZenHelp() {
+  console.log('usage: atris zen [--check] [--no-fetch] [--json]');
+  console.log('');
+  console.log('Brings this repo to zen: code matches origin, nothing left lying around.');
+  console.log('Old stashes are archived, idle side copies put away, finished branches');
+  console.log('cleared, stray code edits saved to a zen-backup/ branch, and the main');
+  console.log('branch caught up. Only branches already on origin are cleared, so nothing');
+  console.log('is lost, and everything else can be brought back. Team notes');
+  console.log('in atris/ and agent config stay as they are. Anything touched in the last');
+  console.log('30 minutes is left alone. A side copy with unsaved work nobody has touched in');
+  console.log('3 days is saved to a zen-backup/ branch and put away. A side copy locked with git worktree lock');
+  console.log('always stays. Then the workspace is tidied with atris clean, and');
+  console.log('anything only you can do is listed with the one command that does it.');
+  console.log('');
+  console.log('  --check      Only look. Report what is out of place and change nothing.');
+  console.log('  --no-fetch   Use the last fetched origin instead of fetching.');
+  console.log('  --json       Print machine-readable results.');
+  console.log('');
+  console.log('Add more team-state paths in .atris/zen.json: {"team_state": ["logs/"]}');
+}
+
+function pause(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function makeOut(calm) {
+  const dim = (text) => (calm ? `\x1b[2m${text}\x1b[0m` : text);
+  const line = (text = '', ms = 110) => {
+    console.log(text);
+    if (calm && text) pause(ms);
+  };
+  // One raked line, drawn left to right.
+  const rake = (width = 34) => {
+    if (!calm) {
+      console.log(`  ${'─'.repeat(width)}`);
+      return;
+    }
+    process.stdout.write('  ');
+    for (let i = 0; i < width; i += 1) {
+      process.stdout.write(dim('─'));
+      pause(14);
+    }
+    process.stdout.write('\n');
+    pause(160);
+  };
+  return { dim, line, rake };
+}
+
+function teamLine(n) {
+  if (!n) return 'no team notes changed.';
+  return n === 1 ? '1 team note kept as it is.' : `${n} team notes kept as they are.`;
+}
+
+function printYours(yours, line, dim) {
+  const width = Math.max(...yours.map((item) => item.text.length));
+  for (const item of yours) line(`  ${item.text.padEnd(width)}   ${dim(item.cmd)}`);
+}
+
+function printCheck(result, workspace) {
+  const kept = result.team_files
+    ? (result.team_files === 1 ? '1 team file kept as it is' : `${result.team_files} team files kept as they are`)
+    : 'no team files changed';
+  const stale = result.fetched === false ? ' (could not reach origin, using last fetch)' : '';
+  const tidy = workspace?.todo.length || 0;
+  if (result.zen && tidy) {
+    console.log(`zen: almost, the code is calm and the workspace has ${tidy} ${tidy === 1 ? 'thing' : 'things'} to tidy`);
+    console.log(`  code matches ${result.upstream}${stale}`);
+    console.log(`  ${kept}`);
+    console.log('  run atris zen to make it zen');
+  } else if (result.zen) {
+    console.log('zen: yes');
+    console.log(`  code matches ${result.upstream}${stale}`);
+    console.log(`  ${kept}`);
+  } else {
+    const n = result.problems.length;
+    console.log(`zen: no, ${n} ${n === 1 ? 'thing is' : 'things are'} out of place${stale}`);
+    for (const problem of result.problems) console.log(`  - ${problem.text}`);
+    console.log(`  ${kept}`);
+    console.log('  run atris zen to make it zen');
+  }
+  if (result.worktrees_with_work.length) {
+    for (const text of sideCopyLines(result.worktrees_with_work, abandonedDaysFromEnv())) console.log(`  ${text}`);
+  }
+  const held = result.worktrees_locked?.length || 0;
+  if (held) {
+    console.log(`  ${held} side ${held === 1 ? 'copy is locked by its owner' : 'copies are locked by their owners'}, left alone`);
+  }
+  const live = result.worktrees_in_use?.length || 0;
+  if (live) {
+    const mins = result.fresh_minutes;
+    console.log(`  ${live} side ${live === 1 ? 'copy was' : 'copies were'} used in the last ${mins} ${mins === 1 ? 'minute' : 'minutes'}, left alone`);
+  }
+  if (workspace?.todo.length) {
+    console.log('workspace:');
+    for (const text of workspace.todo) console.log(`  - ${text}`);
+  }
+  if (workspace?.yours.length) {
+    console.log('for you:');
+    printYours(workspace.yours, (text) => console.log(text), (text) => text);
+  }
+}
+
+function printApply(result, out) {
+  const { dim, line, rake } = out;
+  line('');
+  line('  atris zen', 200);
+  line('');
+  rake();
+  line('');
+  line(dim('  code'));
+  if (!result.done.length && result.zen) line(`  matches ${result.upstream || 'origin'}`);
+  for (const text of result.done) line(`  ${text}`);
+  for (const text of [...result.left, ...result.notes]) line(dim(`  ${text}`));
+  line('');
+  const ws = result.workspace || { done: [], yours: [] };
+  if (ws.ran) {
+    line(dim('  workspace'));
+    if (!ws.done.length) line('  tidy');
+    for (const text of ws.done) line(`  ${text}`);
+    line('');
+  }
+  if (ws.yours?.length) {
+    line(dim('  for you'));
+    printYours(ws.yours, line, dim);
+    line('');
+  }
+  if (result.zen) {
+    line(`  ${result.already ? 'already zen.' : 'zen.'}`, 260);
+  } else {
+    line('  almost zen. still out of place:');
+    for (const text of result.remaining) line(dim(`  - ${text}`));
+  }
+  line(dim(`  ${teamLine(result.team_files)}`));
+  if (result.saved.length) {
+    line(dim('  everything is kept: git for-each-ref refs/archive refs/heads/zen-backup'));
+  }
+  line('');
+}
+
+function zenCommand(args = [], cwd = process.cwd()) {
+  if (args.includes('--help') || args.includes('-h') || args[0] === 'help') {
+    showZenHelp();
+    return 0;
+  }
+  const fetch = !args.includes('--no-fetch');
+  const json = args.includes('--json');
+
+  if (args.includes('--check')) {
+    const result = checkZen({ cwd, fetch });
+    if (json) {
+      console.log(JSON.stringify(result, null, 2));
+      return result.ok ? (result.zen ? 0 : 1) : 2;
+    }
+    if (!result.ok) {
+      console.log(`zen: can't check, ${result.error}.`);
+      return 2;
+    }
+    const workspace = workspaceZen({ root: result.root, dryRun: true });
+    printCheck(result, workspace);
+    return result.zen && !workspace.todo.length ? 0 : 1;
+  }
+
+  const result = applyZen({ cwd, fetch });
+  if (json) {
+    console.log(JSON.stringify(result, null, 2));
+    return result.ok ? (result.zen ? 0 : 1) : 2;
+  }
+  if (!result.ok) {
+    console.log(`zen: can't start, ${result.error}.`);
+    return 2;
+  }
+  const calm = Boolean(process.stdout.isTTY) && !process.env.CI;
+  printApply(result, makeOut(calm));
+  return result.zen ? 0 : 1;
+}
+
+module.exports = { zenCommand, showZenHelp };

package/lib/auto-accept-certified.js

@@ -1157,8 +1157,13 @@ function agentBranchOnlyResult(ref, resolved) {
   };
 }
 
-function runResolvedVerify(resolved, workspaceRoot, cache) {
-  const result = runVerifyCommandCached(resolved.verify, workspaceRoot, cache);
+// A check recorded from main runs against the job's own code, the same place
+// the second check ran it (lib/job-code-verify.js), so the landing gate never
+// judges a branch-only test by the main folder.
+function runResolvedVerify(resolved, task, workspaceRoot, cache) {
+  const result = resolved.rewritten
+    ? runVerifyCommandCached(resolved.verify, workspaceRoot, cache)
+    : require('./job-code-verify').runVerifyAtJobCode(resolved.verify, task, { root: workspaceRoot, cache });
   if (resolved.rewritten && result.reason === 'verify_failed') {
     return { ...result, reason: 'verify_failed_on_main', recorded_verify: resolved.recorded };
   }
@@ -1258,7 +1263,7 @@ function evaluateAutoAccept(task, options = {}) {
     if (tierRequiresStrictVerify && !verify) return strictVerifyMissingResult(ref);
     if (resolvedVerify.missing) return agentBranchOnlyResult(ref, resolvedVerify);
     if (verify && executeVerify) {
-      const verifyResult = runResolvedVerify(resolvedVerify, task.workspace_root || process.cwd(), verifyCache);
+      const verifyResult = runResolvedVerify(resolvedVerify, task, task.workspace_root || process.cwd(), verifyCache);
       // A check that runs and fails blocks. So does a check whose worktree
       // is gone, otherwise the daily reap converts "has a failing check"
       // into "lands unchecked" the morning after it clears the worktree.
@@ -1361,7 +1366,7 @@ function evaluateAutoAccept(task, options = {}) {
     if (resolvedVerify.missing) return agentBranchOnlyResult(ref, resolvedVerify);
     if (executeVerify) {
       const workspaceRoot = task.workspace_root || process.cwd();
-      const verifyResult = runResolvedVerify(resolvedVerify, workspaceRoot, verifyCache);
+      const verifyResult = runResolvedVerify(resolvedVerify, task, workspaceRoot, verifyCache);
       if (!verifyResult.ok) {
         return { eligible: false, ref, reason: verifyResult.reason, verify, ...verifyResult };
       }