atris 3.73.0 → 3.74.0

package/commands/member.js

@@ -777,6 +777,8 @@ const MEMBER_RUN_START_VALUE_FLAGS = [
   '--truth',
   '--proof',
   '--base',
+  '--yes-lock',
+  '--yes-lock-parent',
 ];
 
 const MEMBER_RUN_START_BOOLEAN_FLAGS = [
@@ -1000,6 +1002,12 @@ function buildMemberRunStartArgs(owner, missionText, args = [], cwd = process.cw
   pushFlagValue(startArgs, args, '--minutes');
   pushFlagValue(startArgs, args, '--hours');
   pushFlagValue(startArgs, args, '--base');
+  // a run inside a woken member's run keeps its seal: mission start reads it
+  // from the environment, never from these words
+  if (!process.env.ATRIS_HANDOFF_YES_LOCK) {
+    pushFlagValue(startArgs, args, '--yes-lock');
+    pushFlagValue(startArgs, args, '--yes-lock-parent');
+  }
   // Member runs choose and drive work immediately, so an absent check must not
   // leave autonomous callers with a mission that never ran. A check inferred
   // from the mission text counts as named.
@@ -1297,6 +1305,10 @@ function memberRunWith(name, args, { quiet = false, closeTaskIds = [] } = {}) {
       console.error(`${name} is parked; running anyway`);
     }
   } catch { /* an unreadable card is requireMemberDir's problem, not this notice's */ }
+  if (args.filter(require('./mission').isYesLockWord).length > 1) {
+    return printMemberRunResult({ started: false, state: null, mission_id: null,
+      error: 'member run got more than one --yes-lock, so it is not clear which seal applies; nothing started' }, asJson, { quiet });
+  }
   const requestedVerifier = readFlag(args, '--verify', '') || memberRunConfiguredVerifier(paths);
   const missionText = memberRunMissionText(args);
   const hasMissionOverride = Boolean(readFlag(args, '--mission', '') || readFlag(args, '--mission-id', ''));
@@ -1362,7 +1374,7 @@ function memberRunWith(name, args, { quiet = false, closeTaskIds = [] } = {}) {
   const missionWordIndices = missionText && !hasMissionOverride ? new Set(memberRunMissionWordIndices(args)) : new Set();
   const executionArgs = args.filter((_, index) => !missionWordIndices.has(index));
   const runArgs = stripKnownFlags(executionArgs,
-    ['--mission', '--mission-id', '--minutes', '--hours', '--industry', '--domain', '--value', '--outcome', '--truth', '--proof', '--base'],
+    ['--mission', '--mission-id', '--minutes', '--hours', '--industry', '--domain', '--value', '--outcome', '--truth', '--proof', '--base', '--yes-lock', '--yes-lock-parent'],
     ['--worktree', '--shared-checkout', '--no-worktree', '--choose-work', '--auto', '--ignite', '--wait', '--sync']);
   if (ignite && !hasFlag(runArgs, '--complete-on-pass')) runArgs.push('--complete-on-pass');
   if (memberRunWantsReferee(runArgs, ignite)) runArgs.push('--referee');
@@ -1374,6 +1386,16 @@ function memberRunWith(name, args, { quiet = false, closeTaskIds = [] } = {}) {
   const caller = callerRuntime(args);
   const runnerSwap = memberRunRunnerSwap(mission, args, caller);
   if (runnerSwap) runArgs.push('--engine', runnerSwap.to);
+  // A run in the foreground (wake, go, run by name) is noted on the start
+  // list under the shared lock, so member up and handoffs count it while it
+  // works. A detached run is noted by whoever started it.
+  if (!hasFlag(runArgs, '--detach') && !hasFlag(runArgs, '--dry-run')) {
+    try {
+      const stateDir = path.join(require('./mission').resolveMemberWorkspaceRoot(process.cwd()), '.atris', 'state');
+      require('../lib/handoff-wake').withWakeReservation(stateDir,
+        ({ record }) => record({ member: name, mission_id: mission.id, pid: process.pid }), { waitMs: 30000 });
+    } catch {}
+  }
   const run = memberRunCli(['mission', 'run', mission.id, ...runArgs], cwd, { live: !asJson && !quiet, missionId: mission.id });
   const payload = run.payload || {};
   const finalMission = payload.mission || require('./mission').resolveMission(mission.id, cwd) || mission;
@@ -11134,6 +11156,8 @@ async function memberUp(...args) {
     pickTask: (name, taken) => memberUpPick(root, name, taken),
     writeNextJob: (name, opts) => memberUpWriteNextJob(root, name, opts),
     spawn: (name, onExit, onClaim) => memberUpSpawn(root, name, onExit, onClaim),
+    // the start lock handoffs share, so both count what the other started
+    reserve: (fn) => require('../lib/handoff-wake').withWakeReservation(path.join(root, '.atris', 'state'), fn),
     now: () => Date.now(),
     jobOf: (name) => memberGoJob(name, root),
     waitingTasks: () => memberUpWaiting(root),
@@ -11352,10 +11376,108 @@ function collectMemberOneOnOnes(root = process.cwd(), slugs = []) {
   return queue;
 }
 
+// The env a woken member starts with: its own plain-terminal run, not part of
+// the session or mission driver that handed off (those markers would turn the
+// run into proof-only mode, a native-goal wait, or a child of the old driver).
+const HANDOFF_WAKE_SCRUB_ENV = [
+  'CLAUDECODE', 'CLAUDE_CODE_ENTRYPOINT', 'CODEX_SANDBOX', 'CURSOR_AGENT', 'DEVIN_SESSION_ID',
+  'CODEX_THREAD_ID', 'CODEX_SESSION_ID', 'ATRIS_AGENT_ID',
+  'ATRIS_MISSION_DRIVER_DETACHED', 'ATRIS_MISSION_DRIVER_PARENT_PID',
+];
+
+// Start the receiver of a handoff on the handed-off step: the same bounded
+// work step `atris member wake <name>` runs (member run, 15 minutes), but
+// detached, so the member handing off is not held while the next one works.
+function startHandoffReceiver(root, to, step, parentMissionId = null) {
+  const env = { ...process.env, ATRIS_CALLER_RUNTIME: 'terminal' };
+  for (const name of HANDOFF_WAKE_SCRUB_ENV) delete env[name];
+  // The handing-off mission's git guard (a temp folder of wrappers first on
+  // PATH) belongs to that mission; the woken run sets up its own.
+  env.PATH = String(env.PATH || '').split(path.delimiter)
+    .filter((dir) => !path.basename(dir).startsWith(require('../lib/mission-protected-lane').GUARD_DIR_PREFIX))
+    .join(path.delimiter);
+  // Every woken run is under the fixed handoff seal, whatever handed off:
+  // outward commands and merging to master wait for the owner's yes. The
+  // parent only says where its yes cards show.
+  // The seal goes by environment only, never on the command line the step
+  // text shares, and every job the woken run starts inherits it. A step that
+  // starts with "-" is quoted so it can never read as an option.
+  env.ATRIS_HANDOFF_YES_LOCK = JSON.stringify(require('../lib/yes-lock').handoffSeal());
+  if (parentMissionId) env.ATRIS_HANDOFF_YES_LOCK_PARENT = parentMissionId;
+  else delete env.ATRIS_HANDOFF_YES_LOCK_PARENT;
+  const stepText = /^\s*-/.test(String(step)) ? `step: ${String(step).trim()}` : String(step);
+  const res = require('child_process').spawnSync(process.execPath, [
+    path.join(__dirname, '..', 'bin', 'atris.js'),
+    'member', 'run', to, stepText, '--minutes', '15', '--no-verify', '--detach', '--json',
+  ], { cwd: root, env, encoding: 'utf8', timeout: 120000 });
+  let payload = null;
+  const lines = String(res.stdout || '').trim().split('\n');
+  for (let i = lines.length - 1; i >= 0 && !payload; i -= 1) {
+    try { payload = JSON.parse(lines.slice(i).join('\n')); } catch {}
+  }
+  const ok = res.status === 0 && Boolean(payload && payload.ok !== false && payload.mission_id);
+  return {
+    ok,
+    mission_id: payload ? payload.mission_id || null : null,
+    pid: payload ? payload.pid || null : null,
+    worktree: payload && payload.worktree ? payload.worktree.path || null : null,
+    error: ok ? null : String((payload && payload.error) || res.stderr || (res.error && res.error.message) || `member run exited ${res.status}`),
+  };
+}
+
+// Whether to wake the receiver, and the outcome. Under the test runner a
+// handoff only records unless ATRIS_HANDOFF_WAKE=1 asks, so suites that hand
+// off never start a real engine by accident.
+function wakeOnHandoff(handoff, root, args) {
+  const testRun = Boolean(process.env.NODE_TEST_CONTEXT) && process.env.ATRIS_HANDOFF_WAKE !== '1';
+  if (hasFlag(args, '--no-wake') || testRun) {
+    return {
+      status: 'not_started',
+      reason: 'not_asked',
+      text: `${handoff.to} was not started; the handoff is only written down. to start it: atris member wake ${handoff.to}`,
+    };
+  }
+  const { wakeHandoffReceiver, withWakeReservation } = require('../lib/handoff-wake');
+  const parent = handoffParentMission(handoff, root);
+  const outcome = wakeHandoffReceiver(handoff, {
+    listMembers: () => memberUpTeam(root),
+    awake: (name) => {
+      try { return require('../lib/member-switches').isMemberAwake(name, root); } catch { return true; }
+    },
+    engine: (name) => require('../lib/member-engine').memberRosterEngine(name, root),
+    start: (name, step) => startHandoffReceiver(root, name, step, parent),
+    reserve: (fn) => withWakeReservation(path.join(root, '.atris', 'state'), fn),
+  });
+  return outcome.status === 'started' ? { ...outcome, yes_lock: 'handoff', yes_lock_parent: parent } : outcome;
+}
+
+// The job a handoff came from, only to show the woken run's yes cards on it:
+// the mission whose guard this command runs under (a handoff from inside a
+// mission tick), else the job a [bet-...] tag in the step names. null when
+// neither is found; what the woken run holds never depends on it.
+function handoffParentMission(handoff, root) {
+  const fromGuard = require('../lib/mission-protected-lane').guardMissionOnPath(process.env.PATH);
+  if (fromGuard) return fromGuard;
+  const bets = Array.from(String(handoff.summary || '').matchAll(/\[(bet-[A-Za-z0-9._-]+)\]/g)).map((m) => m[1]);
+  if (!bets.length) return null;
+  const dir = path.join(require('../lib/state-home').atrisHome(), 'state', 'yes-locks');
+  let files = [];
+  try { files = fs.readdirSync(dir).filter((f) => f.endsWith('.json')); } catch {}
+  for (const name of files) {
+    try {
+      const data = JSON.parse(fs.readFileSync(path.join(dir, name), 'utf8'));
+      if (data && data.mission_id && bets.includes(data.bet_id)) return String(data.mission_id);
+    } catch {}
+  }
+  return null;
+}
+
 function memberHandoff(from, to, ...args) {
   if (from === '--help' || from === '-h' || hasFlag(args, '--help') || hasFlag(args, '-h')) {
-    console.log('Usage: atris member handoff [<from> <to> "<slice>"] [--json]');
+    console.log('Usage: atris member handoff [<from> <to> "<slice>"] [--no-wake] [--json]');
     console.log('Passes a completed slice from one member to the next specialist and queues their next_push.');
+    console.log('The next member is started on the slice when it is not already working, unless the team is at its limit.');
+    console.log('--no-wake only writes the handoff down.');
     return;
   }
   const root = process.cwd();
@@ -11374,17 +11496,21 @@ function memberHandoff(from, to, ...args) {
   }
   const targetTo = sliceWords[0];
   const summary = sliceWords.slice(1).join(' ').trim();
-  const { recordMemberHandoff } = require('./mission');
-  const handoff = recordMemberHandoff(from, targetTo, summary, root);
-  if (!handoff) {
+  const { recordMemberHandoff, updateMemberHandoff, resolveMemberWorkspaceRoot } = require('./mission');
+  const recorded = recordMemberHandoff(from, targetTo, summary, root);
+  if (!recorded) {
     console.error(`Could not record handoff from ${from} to ${targetTo}. Check member names.`);
     process.exitCode = 1;
     return null;
   }
+  const parentRoot = resolveMemberWorkspaceRoot(root);
+  // the stored summary is cut at 180 characters; the wake gets the whole step
+  const wake = { ...wakeOnHandoff({ ...recorded, summary }, parentRoot, args), at: new Date().toISOString() };
+  const handoff = updateMemberHandoff(recorded.id, { wake }, parentRoot) || { ...recorded, wake };
   const lines = [
     `Handoff recorded: ${handoff.from} -> ${handoff.to}`,
     `Slice: ${handoff.summary}`,
-    `Next: ${handoff.next_command}`,
+    wake.text,
   ];
   printJsonOrText({ ok: true, action: 'member_handoff', handoff }, lines, asJson);
   return handoff;
@@ -11773,10 +11899,18 @@ async function memberCommand(subcommand, ...args) {
         // more often than a job. Starting a paid run on it costs money and
         // does nothing useful, so name the miss and stop. Jobs keep working
         // as more than one word, or through `atris member run "<job>"`.
-        const extraWords = args.filter((a) => !String(a).startsWith('-')).length;
+        const extraWordList = args.filter((a) => !String(a).startsWith('-'));
+        const extraWords = extraWordList.length;
         if (!/\s/.test(subcommand.trim()) && extraWords === 0) {
           return memberUnknownWord(subcommand);
         }
+        // `atris member inbox validator`: an unknown word followed by a member
+        // name is a command shape (verb, then who), not a job. It once started
+        // a mission called "inbox validator"; name the miss instead.
+        if (!/\s/.test(subcommand.trim()) && extraWords === 1
+          && isKnownMemberSlug(String(extraWordList[0]).trim(), process.cwd())) {
+          return memberUnknownWord(subcommand);
+        }
         return memberSteerOrDispatch(subcommand, ...args);
       }
       console.log('run "<job>"          pick the right member and run it: atris member run "fix the flaky login test"');

package/commands/mission.js

@@ -1905,15 +1905,58 @@ function recordMemberHandoff(fromMember, toMember, sliceSummary, root = process.
     next_command: `atris member go ${to}`,
     created_at: now,
   };
+  const handoffsFile = path.join(parentRoot, '.atris', 'state', 'member-handoffs.jsonl');
+  try {
+    withHandoffsLock(handoffsFile, () => fs.appendFileSync(handoffsFile, `${JSON.stringify(handoff)}\n`, 'utf8'));
+  } catch {
+    return null;
+  }
   try {
-    const handoffsFile = path.join(parentRoot, '.atris', 'state', 'member-handoffs.jsonl');
-    fs.mkdirSync(path.dirname(handoffsFile), { recursive: true });
-    fs.appendFileSync(handoffsFile, `${JSON.stringify(handoff)}\n`, 'utf8');
     autoQueueMemberNextPush(to, `${from} handoff: ${cleanSummary}`, `Baton pass from ${from}`, parentRoot);
   } catch {}
   return handoff;
 }
 
+// Every write to member-handoffs.jsonl (append or whole-file rewrite) holds
+// one lock file beside it, so concurrent handoffs never lose a row.
+// (Codex review round 3 on #1483.)
+function withHandoffsLock(handoffsFile, fn) {
+  fs.mkdirSync(path.dirname(handoffsFile), { recursive: true });
+  const lockFile = path.join(path.dirname(handoffsFile), 'member-handoffs.lock');
+  return require('../lib/handoff-wake').withFileLock(lockFile, fn, { staleMs: 60 * 1000, waitMs: 30 * 1000 });
+}
+
+function rewriteHandoffs(handoffsFile, lines) {
+  const tmp = `${handoffsFile}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, `${lines.join('\n')}\n`, 'utf8');
+  fs.renameSync(tmp, handoffsFile);
+}
+
+// Merge `patch` into the newest handoff row with this id. Returns the
+// updated row, or null when it is not on file.
+function updateMemberHandoff(handoffId, patch, root = process.cwd()) {
+  const id = String(handoffId || '');
+  if (!id || !patch) return null;
+  const handoffsFile = path.join(resolveMemberWorkspaceRoot(root), '.atris', 'state', 'member-handoffs.jsonl');
+  try {
+    return withHandoffsLock(handoffsFile, () => {
+      const lines = fs.readFileSync(handoffsFile, 'utf8').split(/\r?\n/).filter((l) => l.trim());
+      for (let i = lines.length - 1; i >= 0; i -= 1) {
+        let row = null;
+        try { row = JSON.parse(lines[i]); } catch {}
+        if (!row || row.id !== id) continue;
+        const updated = { ...row, ...patch };
+        lines[i] = JSON.stringify(updated);
+        rewriteHandoffs(handoffsFile, lines);
+        return updated;
+      }
+      return null;
+    });
+  } catch {
+    return null;
+  }
+}
+
 function closeMemberHandoffsForReceiver(receiverMember, root = process.cwd()) {
   const receiver = String(receiverMember || '').trim().toLowerCase();
   if (!receiver) return 0;
@@ -1921,28 +1964,30 @@ function closeMemberHandoffsForReceiver(receiverMember, root = process.cwd()) {
   const handoffsFile = path.join(parentRoot, '.atris', 'state', 'member-handoffs.jsonl');
   if (!fs.existsSync(handoffsFile)) return 0;
   try {
-    const rawLines = fs.readFileSync(handoffsFile, 'utf8').split(/\r?\n/).filter((l) => l.trim());
-    let closedCount = 0;
-    const now = stampIso();
-    const updatedLines = rawLines.map((line) => {
-      try {
-        const row = JSON.parse(line);
-        if (row && String(row.to || '').toLowerCase() === receiver && (row.status || 'open') === 'open') {
-          closedCount++;
-          return JSON.stringify({ ...row, status: 'closed', closed_at: now });
-        }
-      } catch {}
-      return line;
-    });
-    if (closedCount > 0) {
-      fs.writeFileSync(handoffsFile, `${updatedLines.join('\n')}\n`, 'utf8');
-    }
-    return closedCount;
+    return withHandoffsLock(handoffsFile, () => closeHandoffRows(handoffsFile, receiver));
   } catch {
     return 0;
   }
 }
 
+function closeHandoffRows(handoffsFile, receiver) {
+  const rawLines = fs.readFileSync(handoffsFile, 'utf8').split(/\r?\n/).filter((l) => l.trim());
+  let closedCount = 0;
+  const now = stampIso();
+  const updatedLines = rawLines.map((line) => {
+    try {
+      const row = JSON.parse(line);
+      if (row && String(row.to || '').toLowerCase() === receiver && (row.status || 'open') === 'open') {
+        closedCount++;
+        return JSON.stringify({ ...row, status: 'closed', closed_at: now });
+      }
+    } catch {}
+    return line;
+  });
+  if (closedCount > 0) rewriteHandoffs(handoffsFile, updatedLines);
+  return closedCount;
+}
+
 function memberMissionFile(owner, root = process.cwd()) {
   const dir = memberDir(owner, root);
   if (!dir) return null;
@@ -3217,6 +3262,7 @@ function missionFromArgs(args) {
     '--task',
     '--ask',
     '--yes-lock',
+    '--yes-lock-parent',
     '--campaign',
     '--reserve',
     '--mission-id',
@@ -3260,7 +3306,18 @@ function missionFromArgs(args) {
   const taskIds = readRepeatedFlag(args, '--task');
   // MEMBER.md approval-required becomes an open human ask the owner must clear.
   const humanAsks = [...readRepeatedFlag(args, '--ask'), ...memberApprovalAsks(owner, process.cwd(), objective)];
-  const yesLocks = readYesLockSeal(readFlag(args, '--yes-lock', ''), wantsJson(args));
+  // The seal is never read from text a caller passes through: two
+  // --yes-lock words (one could be the objective) refuse the start, and a
+  // run woken by a handoff carries its seal in the environment, which every
+  // job it starts inherits. (Codex review round 6 on #1483.)
+  if (args.filter(isYesLockWord).length > 1) {
+    exitMissionError('mission start got more than one --yes-lock, so it is not clear which seal applies; nothing started', 2, wantsJson(args));
+  }
+  const handoffSeal = String(process.env.ATRIS_HANDOFF_YES_LOCK || '').trim();
+  const yesLocks = readYesLockSeal(handoffSeal || readFlag(args, '--yes-lock', ''), wantsJson(args));
+  const yesLockParent = yesLocks.length
+    ? String((handoffSeal ? process.env.ATRIS_HANDOFF_YES_LOCK_PARENT : readFlag(args, '--yes-lock-parent', '')) || '').trim()
+    : '';
   const drive = missionDrive(readFlag(args, '--destination', ''));
   const alwaysOn = hasFlag(args, '--always-on');
   const xpTaskEnabled = hasFlag(args, '--xp-task') || hasFlag(args, '--agent-xp');
@@ -3299,6 +3356,9 @@ function missionFromArgs(args) {
     human_asks: humanAsks,
     // the sealed owner steps: the guard holds what each locks until the owner says yes
     ...(yesLocks.length ? { yes_locks: { steps: yesLocks, sealed_at: stampIso() } } : {}),
+    // a run woken by a handoff: the job it came from, only to show its yes
+    // cards there (lib/yes-lock.js handoffYesCards)
+    ...(yesLockParent ? { yes_lock_parent: yesLockParent } : {}),
     ...(campaignId ? { campaign_id: campaignId } : {}),
     ...(drive ? { drive } : {}),
     next_action: verifier ? 'run verifier with `atris mission tick <id> --verify`' : 'define verifier or run next task',
@@ -3319,7 +3379,12 @@ function missionFromArgs(args) {
 
 // --yes-lock '[{"step":3,"text":"...","categories":["publish"]}]': the owner
 // steps a job may not do before the owner says yes. Bad input stops the start.
-const YES_LOCK_CATEGORIES = new Set(['publish', 'tag', 'post', 'send', 'merge', 'deploy']);
+const YES_LOCK_CATEGORIES = new Set(['publish', 'tag', 'post', 'send', 'merge', 'deploy', 'spend']);
+function isYesLockWord(arg) {
+  const text = String(arg || '').trim();
+  return text === '--yes-lock' || text.startsWith('--yes-lock=');
+}
+
 function readYesLockSeal(raw, asJson) {
   if (!raw) return [];
   let list;
@@ -3329,7 +3394,7 @@ function readYesLockSeal(raw, asJson) {
     exitMissionError('--yes-lock takes a JSON list of {step, text, categories}', 2, asJson);
   }
   const ok = Array.isArray(list) && list.every(l => l && Number.isInteger(l.step) && l.step > 0 && Array.isArray(l.categories) && l.categories.length && l.categories.every(c => YES_LOCK_CATEGORIES.has(c)));
-  if (!ok) exitMissionError('--yes-lock takes a JSON list of {step, text, categories}, with categories from publish, tag, post, send, merge, deploy', 2, asJson);
+  if (!ok) exitMissionError('--yes-lock takes a JSON list of {step, text, categories}, with categories from publish, tag, post, send, merge, deploy, spend', 2, asJson);
   return list.map(l => ({ step: l.step, text: String(l.text || '').slice(0, 200), categories: [...new Set(l.categories)] }));
 }
 
@@ -4512,6 +4577,15 @@ function normalizedObjective(text) {
   return String(text || '').toLowerCase().replace(/\s+/g, ' ').trim();
 }
 
+// True when `existing` runs under the lock `wanted` carries: the start
+// carries none, or the same seal.
+function lockCovered(existing, wanted) {
+  const want = (wanted && wanted.yes_locks && wanted.yes_locks.steps) || [];
+  if (!want.length) return true;
+  const have = (existing && existing.yes_locks && existing.yes_locks.steps) || [];
+  return JSON.stringify(have) === JSON.stringify(want);
+}
+
 function findActiveTwinMission(objective, owner, root = process.cwd()) {
   const wantObjective = normalizedObjective(objective);
   const wantOwner = String(owner || '').trim().toLowerCase();
@@ -4547,6 +4621,11 @@ function startMission(args, options = {}) {
   const idLikeObjective = String(mission.objective || '').trim();
   if (/^mission-\d{4}-\d{2}-\d{2}-/.test(idLikeObjective)) {
     const existing = resolveMission(idLikeObjective);
+    if (existing && !lockCovered(existing, mission)) {
+      // A start carrying a yes-lock never resumes a job under a weaker lock:
+      // it would run without it. (Codex review round 4 on #1483.)
+      exitMissionError(`${existing.id} is not under the yes-lock this start carries, so resuming it would run without the yes-lock; start a new job instead`, 2, asJson);
+    }
     if (existing) {
       printJsonOrText(
         { ok: true, action: 'mission_recovered', recovered: true, mission: existing, note: 'objective looked like a mission id; recovered the existing mission instead of creating a new one' },
@@ -4560,55 +4639,57 @@ function startMission(args, options = {}) {
     }
     exitMissingMission(idLikeObjective, 1, asJson);
   }
-  if (!hasFlag(args, '--duplicate')) {
-    const twin = findActiveTwinMission(mission.objective, mission.owner);
-    if (twin) {
-      const requestedDestination = mission.drive?.destination || '';
-      if (requestedDestination && twin.drive?.destination && requestedDestination !== twin.drive.destination) {
-        const proposed = proposeMissionDestinationChange(twin, requestedDestination);
-        const proposal = proposed.drive.pending_destination_proposal;
-        const missionRoot = twin.worktree_root || process.cwd();
-        const { mission: saved } = saveMission(
-          proposed,
-          missionRoot,
-          'mission_destination_change_proposed',
-          {
-            current_destination: twin.drive.destination,
-            proposed_destination: proposal.destination,
-            reason: proposal.reason,
-          },
-        );
-        printJsonOrText(
-          {
-            ok: true,
-            action: 'mission_destination_change_proposed',
-            reused: true,
-            operator_gate_required: true,
-            mission: saved,
-            proposal,
-          },
-          [
-            `Destination change proposed for ${saved.id}.`,
-            `Current destination: ${saved.drive.destination}`,
-            `Proposed destination: ${proposal.destination}`,
-            `Operator gate: ${proposal.reason}.`,
-          ],
-          asJson,
-        );
-        return;
-      }
+  // A start that carries a yes-lock never reuses a twin under a different
+  // lock (or none): the reused job would run without it. It gets a fresh
+  // job under the lock instead. (Codex review rounds 3 and 4 on #1483.)
+  const twinCandidate = hasFlag(args, '--duplicate') ? null : findActiveTwinMission(mission.objective, mission.owner);
+  if (twinCandidate && lockCovered(twinCandidate, mission)) {
+    const twin = twinCandidate;
+    const requestedDestination = mission.drive?.destination || '';
+    if (requestedDestination && twin.drive?.destination && requestedDestination !== twin.drive.destination) {
+      const proposed = proposeMissionDestinationChange(twin, requestedDestination);
+      const proposal = proposed.drive.pending_destination_proposal;
+      const missionRoot = twin.worktree_root || process.cwd();
+      const { mission: saved } = saveMission(
+        proposed,
+        missionRoot,
+        'mission_destination_change_proposed',
+        {
+          current_destination: twin.drive.destination,
+          proposed_destination: proposal.destination,
+          reason: proposal.reason,
+        },
+      );
       printJsonOrText(
-        { ok: true, action: 'mission_reused', reused: true, mission: twin, note: 'an active mission with this objective and owner already exists; resumed instead of cloning (pass --duplicate to force a second one)' },
+        {
+          ok: true,
+          action: 'mission_destination_change_proposed',
+          reused: true,
+          operator_gate_required: true,
+          mission: saved,
+          proposal,
+        },
         [
-          `Already active: ${twin.id} (${twin.status})`,
-          `Same objective, same owner, reusing it instead of starting a clone.`,
-          `Resume: atris mission run ${twin.id}`,
-          `Really want a second one: re-run with --duplicate`,
+          `Destination change proposed for ${saved.id}.`,
+          `Current destination: ${saved.drive.destination}`,
+          `Proposed destination: ${proposal.destination}`,
+          `Operator gate: ${proposal.reason}.`,
         ],
         asJson,
       );
       return;
     }
+    printJsonOrText(
+      { ok: true, action: 'mission_reused', reused: true, mission: twin, note: 'an active mission with this objective and owner already exists; resumed instead of cloning (pass --duplicate to force a second one)' },
+      [
+        `Already active: ${twin.id} (${twin.status})`,
+        `Same objective, same owner, reusing it instead of starting a clone.`,
+        `Resume: atris mission run ${twin.id}`,
+        `Really want a second one: re-run with --duplicate`,
+      ],
+      asJson,
+    );
+    return;
   }
   // Intake gate: a mission without a verifier is a planning wish, and planning
   // wishes silt up the queue (11 swept on 2026-07-06 with zero ticks). Refuse
@@ -4736,6 +4817,13 @@ function startMission(args, options = {}) {
     lane: saved.lane,
     verifier: saved.verifier,
   });
+  if (saved.yes_lock_parent && saved.yes_locks && saved.yes_locks.steps) {
+    // the lock record names the job it came from, before any command is held
+    try {
+      require('../lib/yes-lock').writeYesLocks(path.join(require('../lib/state-home').atrisHome(), 'state'), saved.id,
+        { seal: saved.yes_locks.steps, parentMissionId: saved.yes_lock_parent });
+    } catch {}
+  }
   const worktreeBaseline = captureMissionWorktreeBaseline(saved, process.cwd(), codeBaseline);
   const nextTickCommand = `atris mission tick ${saved.id}${saved.verifier ? ' --verify' : ''}`;
   const payload = {
@@ -12807,6 +12895,9 @@ module.exports = {
   usefulClaudeReceiptSummary,
   autoQueueMemberNextPush,
   recordMemberHandoff,
+  updateMemberHandoff,
+  resolveMemberWorkspaceRoot,
+  isYesLockWord,
   closeMemberHandoffsForReceiver,
   cappedClaudeReceiptText,
   extractLayerFromReceiptText,

package/commands/slop.js

@@ -418,9 +418,15 @@ function findDeadCode(root = process.cwd(), opts = {}) {
   const candidates = scanDirs.flatMap((d) => listJsFiles(d));
   if (!candidates.length) return { root, candidates: 0, dead: [], testOnly: [] };
 
-  // 1) reachability BFS from entrypoints over static edges
+  // 1) reachability BFS from entrypoints over static edges. A file that runs
+  //    itself when started directly (`node lib/x.js`, guarded by
+  //    `require.main === module`) is an entrypoint too, even if only a test
+  //    imports it.
   const reached = new Set();
-  const queue = [...deadEntrypoints(root)];
+  const runsItself = (f) => {
+    try { return /\brequire\.main\s*===\s*module\b/.test(fs.readFileSync(f, 'utf8')); } catch { return false; }
+  };
+  const queue = [...deadEntrypoints(root), ...candidates.filter(runsItself)];
   while (queue.length) {
     const f = queue.pop();
     if (reached.has(f)) continue;

package/lib/falsifier-probe.js

@@ -52,7 +52,8 @@ function probeVerifierCanFail({ command, runner, tmpRoot } = {}) {
     // like it cannot fail. Same strip as verifyCommandEnv.
     const env = { ...process.env };
     delete env.NODE_TEST_CONTEXT;
-    const result = run('bash', ['-lc', cmd], {
+    // a login shell rebuilds PATH; a mission guard's wrappers go back first
+    const result = run('bash', ['-lc', `${require('./spawn-env').shellGuardLine(env)}${cmd}`], {
       cwd: dir,
       encoding: 'utf8',
       timeout: PROBE_TIMEOUT_MS,