@yemi33/minions 0.1.2177 → 0.1.2179

package/engine.js

@@ -32,7 +32,7 @@ const crypto = require('crypto');
 const shared = require('./engine/shared');
 const { exec, execAsync, execSilent, runFile, ts, ENGINE_DEFAULTS,
   WI_STATUS, DONE_STATUSES, WORK_TYPE, PLAN_STATUS, PRD_ITEM_STATUS, PRD_MATERIALIZABLE, PR_STATUS, REVIEW_STATUS, DISPATCH_RESULT, AGENT_STATUS,
-  FAILURE_CLASS } = shared;
+  FAILURE_CLASS, resolvePollFlag } = shared;
 const { resolveRuntime } = require('./engine/runtimes');
 const { assertStaleHeadOk } = require('./engine/spawn-agent');
 const adoGitAuth = require('./engine/ado-git-auth');
@@ -168,7 +168,12 @@ const { runPostCompletionHooks, updateWorkItemStatus, syncPrdItemStatus, reconci
   syncPrsFromOutput, updatePrAfterReview, updatePrAfterFix, checkForLearnings, extractSkillsFromOutput,
   updateAgentHistory, updateMetrics, createReviewFeedbackForAuthor, parseAgentOutput, syncPrdFromPrs,
   isItemCompleted, classifyFailure: classifyFailureFallback, diagnoseEmptyOutput, processPendingRebases, resolveWorkItemPath,
-  mergeArtifactNotes, promoteCompletionArtifacts } = require('./engine/lifecycle');
+  mergeArtifactNotes, promoteCompletionArtifacts, pruneScopeMismatchDuplicatePrs } = require('./engine/lifecycle');
+
+// ─── Diagnostics: memory + event-loop + GC sampler (P-a1b2c3d4 / P-b2c3d4e5) ─
+
+const diagnosticsMemory = require('./engine/diagnostics-memory');
+const DIAGNOSTICS_MEMORY_PATH = path.join(ENGINE_DIR, 'diagnostics-memory.json');
 
 // ─── Agent Spawner ──────────────────────────────────────────────────────────
 
@@ -617,7 +622,11 @@ function promoteCheckpointSteeringForClose(agentId, procInfo, runtime, liveOutpu
 
 // Resolve dependency plan item IDs to their PR branches
 function resolveDependencyBranches(depIds, sourcePlan, project, config) {
-  const results = []; // [{ branch, prId }]
+  // P-faea3206: each entry now carries projectName + projectRoot + isCrossRepo
+  // so spawnAgent's dep-fetch loop can route same-project deps through the
+  // existing fetch+merge path and cross-project deps through the advisory
+  // transfer-fetch path (no auto-merge, no escalation).
+  const results = []; // [{ branch, prId, projectName, projectRoot, isCrossRepo }]
   if (!depIds?.length) return results;
 
   const projects = shared.getProjects(config);
@@ -626,6 +635,8 @@ function resolveDependencyBranches(depIds, sourcePlan, project, config) {
   const allItems = queries.getWorkItems(config);
   const depWorkItems = allItems.filter(wi => depIds.includes(wi.id));
 
+  const currentProjectName = project?.name || null;
+
   // Find PR branches for each dependency work item
   for (const p of projects) {
     const prPath = shared.projectPrPath(p);
@@ -636,7 +647,16 @@ function resolveDependencyBranches(depIds, sourcePlan, project, config) {
         depWorkItems.find(w => w.id === id)
       );
       if (linked && !results.find(r => r.branch === pr.branch)) {
-        results.push({ branch: pr.branch, prId: pr.id });
+        let depRoot = null;
+        try { depRoot = shared.resolveProjectRootDir(p.localPath, MINIONS_DIR); }
+        catch { depRoot = null; /* drive-root or missing localPath — caller falls back gracefully */ }
+        results.push({
+          branch: pr.branch,
+          prId: pr.id,
+          projectName: p.name || null,
+          projectRoot: depRoot,
+          isCrossRepo: !!currentProjectName && p.name !== currentProjectName,
+        });
       }
     }
   }
@@ -644,6 +664,48 @@ function resolveDependencyBranches(depIds, sourcePlan, project, config) {
   return results;
 }
 
+// P-faea3206: render the "## Cross-repo dependencies" prompt section that
+// gets appended to the prompt file when a dispatch has at least one
+// cross-repo (advisory) dep. The section enumerates each dep's repo, branch,
+// short SHA, and the changed-file list, plus the local ref
+// (`refs/cross-repo-deps/<branch>`) the agent can `git show` / `git log` to
+// inspect the contract without merging unrelated repo content.
+//
+// Returns "" when `deps` is empty/missing so callers can unconditionally
+// concat the result without a separate guard.
+function buildCrossRepoDepsSection(deps) {
+  if (!Array.isArray(deps) || deps.length === 0) return '';
+  const lines = [
+    '',
+    '## Cross-repo dependencies',
+    '',
+    'The work items below are dependencies in OTHER repos. They are surfaced here as',
+    '*advisory* context only — the engine intentionally does NOT merge cross-repo dep',
+    'branches into your worktree (that would commingle unrelated repo content). Use the',
+    'local refs below to read the contract (`git show <ref>`, `git log <ref> -- <files>`)',
+    'and update your code in this repo to honor it.',
+    '',
+  ];
+  for (const dep of deps) {
+    const branch = dep?.branch || '(unknown-branch)';
+    const repo = dep?.projectName || '(unknown-repo)';
+    const sha = typeof dep?.sha === 'string' && dep.sha ? dep.sha.slice(0, 12) : '';
+    const files = Array.isArray(dep?.files) ? dep.files.filter(Boolean) : [];
+    lines.push(`### ${repo} — \`${branch}\``);
+    if (sha) lines.push(`- Tip SHA: \`${sha}\``);
+    lines.push(`- Local ref: \`refs/cross-repo-deps/${branch}\``);
+    if (files.length > 0) {
+      lines.push('- Changed files:');
+      for (const f of files.slice(0, 50)) lines.push(`  - \`${f}\``);
+      if (files.length > 50) lines.push(`  - …and ${files.length - 50} more`);
+    } else {
+      lines.push('- Changed files: (not computed — inspect via `git log --stat`)');
+    }
+    lines.push('');
+  }
+  return lines.join('\n');
+}
+
 /**
  * Sync an existing worktree from origin on reuse: probe with
  * `git ls-remote --exit-code --heads origin <branch>` first so that locally
@@ -1572,6 +1634,11 @@ async function spawnAgent(dispatchItem, config) {
   // milliseconds. Keys are stamped at phase boundaries below.
   const _phaseT = { start: Date.now() };
   let _depCountForLog = 0;
+  // P-faea3206: collected info for the prompt-file "## Cross-repo dependencies"
+  // section. Populated during the dep-fetch phase below; consumed once the
+  // worktree is ready and the initial prompt has been written (alongside the
+  // dirty-files inject). Stays an empty array on single-repo / no-dep dispatches.
+  let _crossRepoDepsInfo = [];
 
   updateAgentStatus(id, AGENT_STATUS.SPAWNING, `Preparing ${type} task for ${agentId}`);
 
@@ -2438,7 +2505,26 @@ async function spawnAgent(dispatchItem, config) {
       if (depIds.length > 0) {
         _phaseT.depFetchStart = Date.now();
         try {
-          const depBranches = resolveDependencyBranches(depIds, meta?.item?.sourcePlan, project, config);
+          const depBranchesAll = resolveDependencyBranches(depIds, meta?.item?.sourcePlan, project, config);
+          // P-faea3206: partition deps into same-project (fetch + merge as
+          // today) and cross-project (fetch into the dep's project rootDir,
+          // transfer-fetch as refs/cross-repo-deps/<branch>, NEVER auto-merge,
+          // NEVER escalate). Cross-repo deps without a resolvable projectRoot
+          // (missing localPath on dep project) are dropped with a warn — the
+          // engine can't honor them safely.
+          const crossRepoDepsRaw = depBranchesAll.filter(d => d.isCrossRepo);
+          const crossRepoDepsBranches = [];
+          for (const dep of crossRepoDepsRaw) {
+            if (!dep.projectRoot) {
+              log('warn', `Skipping cross-repo dep ${dep.branch} (${dep.prId}) — dep project "${dep.projectName}" has no resolvable rootDir`);
+              continue;
+            }
+            crossRepoDepsBranches.push(dep);
+          }
+          // The historical loop below operates ONLY on same-project deps.
+          // Cross-repo deps are handled in their own block immediately after
+          // the per-branch fetch loop.
+          const depBranches = depBranchesAll.filter(d => !d.isCrossRepo);
           let depMergeFailed = false;
           let depConflictBranch = null; // track which dep branch caused the conflict
           let depConflictFiles = [];    // conflicting file names parsed from git output
@@ -2542,6 +2628,69 @@ async function spawnAgent(dispatchItem, config) {
               depMergeFailed = true;
             }
           }
+          // P-faea3206: Cross-repo dep fetch + transfer-fetch into the
+          // current worktree. These deps are ADVISORY — we never auto-merge
+          // them (cross-repo merges would commingle unrelated repo content),
+          // never trigger the local-only push recovery, and never escalate
+          // via depMergeFailed (the dispatch proceeds regardless of cross-
+          // repo dep fetch outcome). The local ref `refs/cross-repo-deps/
+          // <branch>` lets the agent inspect the contract via git show /
+          // git log without touching the working tree.
+          for (const dep of crossRepoDepsBranches) {
+            const depBranch = dep.branch;
+            const depProjectRoot = dep.projectRoot;
+            try {
+              // 1. Fetch the dep branch into the DEP project's rootDir
+              //    (the current project's origin doesn't carry that ref).
+              await shared.shellSafeGit(['fetch', 'origin', depBranch], { ..._gitOpts, cwd: depProjectRoot });
+              // 2. Transfer the tip into the current worktree via a
+              //    local-path fetch — git supports filesystem-path remotes.
+              //    Stamp it under refs/cross-repo-deps/<branch> so it's
+              //    namespaced away from refs/heads / refs/remotes and
+              //    cannot accidentally be checked out / pushed.
+              const refSpec = `${depBranch}:refs/cross-repo-deps/${depBranch}`;
+              await shared.shellSafeGit(['fetch', depProjectRoot, refSpec], { ..._gitOpts, cwd: worktreePath });
+              // 3. Resolve the tip SHA + a short changed-file list (vs the
+              //    dep project's main) for the prompt section. These are
+              //    best-effort — failure here downgrades to an empty list
+              //    rather than failing the whole advisory block.
+              let depSha = '';
+              try {
+                depSha = gitOutputToString(await shared.shellSafeGit(
+                  ['rev-parse', `refs/cross-repo-deps/${depBranch}`],
+                  { ..._gitOpts, cwd: worktreePath }
+                )).trim();
+              } catch (_) { /* best-effort */ }
+              let depFiles = [];
+              try {
+                const depMainRef = sanitizeBranch(shared.resolveMainBranch(depProjectRoot, null));
+                const diffOut = gitOutputToString(await shared.shellSafeGit(
+                  ['diff', '--name-only', `origin/${depMainRef}...${depBranch}`],
+                  { ..._gitOpts, cwd: depProjectRoot }
+                ));
+                depFiles = diffOut.split(/\r?\n/).map(s => s.trim()).filter(Boolean);
+              } catch (_) { /* best-effort */ }
+              _crossRepoDepsInfo.push({
+                branch: depBranch,
+                projectName: dep.projectName,
+                sha: depSha,
+                files: depFiles,
+              });
+              log('info', `Cross-repo dep ${dep.projectName}:${depBranch} transferred as refs/cross-repo-deps/${depBranch}${depFiles.length ? ` (${depFiles.length} changed file(s))` : ''}`);
+            } catch (crossErr) {
+              // ADVISORY: log and move on. No depMergeFailed flip, no
+              // recovery push, no failure-class escalation. Surface the
+              // miss to the agent prompt anyway so it knows the dep was
+              // attempted (with files: []) — better than silent omission.
+              log('warn', `Cross-repo dep ${dep.projectName}:${depBranch} fetch failed (advisory — dispatch proceeds): ${crossErr.message}`);
+              _crossRepoDepsInfo.push({
+                branch: depBranch,
+                projectName: dep.projectName,
+                sha: '',
+                files: [],
+              });
+            }
+          }
           _phaseT.depFetchEnd = Date.now();
           _phaseT.depPreflightStart = _phaseT.depFetchEnd;
           // Merge successfully-fetched + recovered (local-only pushed) branches sequentially
@@ -2864,6 +3013,20 @@ async function spawnAgent(dispatchItem, config) {
     _phaseT.dirtyProbeEnd = Date.now();
   }
 
+  // P-faea3206: Append a "## Cross-repo dependencies" section to the prompt
+  // file once the dep-fetch phase has populated _crossRepoDepsInfo. Lands
+  // AFTER the shared-branch prompt refresh and the dirty-files inject so the
+  // section is preserved regardless of which earlier write path ran. The
+  // section is advisory: cross-repo deps were fetched into refs/cross-repo-
+  // deps/<branch> but NOT merged into the working tree.
+  if (_crossRepoDepsInfo.length > 0) {
+    const crossSection = buildCrossRepoDepsSection(_crossRepoDepsInfo);
+    if (crossSection) {
+      try { fs.appendFileSync(promptPath, crossSection); } catch (e) { log('warn', `cross-repo deps inject: ${e.message}`); }
+      log('info', `Injected ${_crossRepoDepsInfo.length} cross-repo dep(s) into prompt for ${id}`);
+    }
+  }
+
   // Safety check: warn if a write-capable task is running in the main repo without a worktree
   if (cwd === rootDir && ['implement', 'implement:large', 'fix', 'test', 'verify', 'plan-to-prd'].includes(type)) {
     log('warn', `Agent ${agentId} running ${type} task in main repo (no worktree) for ${id} — changes may land on master directly`);
@@ -2917,6 +3080,12 @@ async function spawnAgent(dispatchItem, config) {
   const resolvedModel = runtime.resolveModel(shared.resolveAgentModel(agentConfig, engineConfig));
   const resolvedMaxBudget = shared.resolveAgentMaxBudget(agentConfig, engineConfig);
   const resolvedBare = shared.resolveAgentBareMode(agentConfig, engineConfig);
+  // P-mcp-storm (opg#134 backport) — user-scope MCP servers to keep out of
+  // this agent dispatch. Copilot loads ~/.copilot/mcp-config.json
+  // unconditionally; the adapter re-emits these as --disable-mcp-server <name>.
+  // Other runtimes ignore the opt (their buildSpawnFlags don't read it), so no
+  // runtime.name branch here.
+  const resolvedDisabledMcpServers = shared.resolveCopilotAgentDisabledMcpServers(agentConfig, engineConfig);
 
   // W-mpg6isvy000xca4d — On retry after FAILURE_CLASS.MODEL_UNAVAILABLE, swap
   // to the runtime-appropriate fallback model. Two paths gated on
@@ -2971,6 +3140,7 @@ async function spawnAgent(dispatchItem, config) {
     disableBuiltinMcps: engineConfig.copilotDisableBuiltinMcps,
     suppressAgentsMd: engineConfig.copilotSuppressAgentsMd,
     reasoningSummaries: engineConfig.copilotReasoningSummaries,
+    disabledMcpServers: resolvedDisabledMcpServers,
   });
 
   // MCP servers: agents inherit from ~/.claude.json directly as Claude Code processes.
@@ -3365,6 +3535,7 @@ async function spawnAgent(dispatchItem, config) {
         disableBuiltinMcps: engineConfig?.copilotDisableBuiltinMcps,
         suppressAgentsMd: engineConfig?.copilotSuppressAgentsMd,
         reasoningSummaries: engineConfig?.copilotReasoningSummaries,
+        disabledMcpServers: resolvedDisabledMcpServers,
       });
       if (!resumeArgs.includes('--resume')) {
         log('warn', `Steering: runtime ${runtime.name} did not accept session resume — skipping for ${agentId}`);
@@ -5163,21 +5334,43 @@ function materializePlansAsWorkItems(config) {
     if (totalCreated > 0) {
       log('info', `Plan discovery: ${totalCreated} total item(s) from ${file} across ${itemsByProject.size} project(s)`);
 
-      // Pre-create shared feature branch if branch_strategy is shared-branch
+      // Pre-create shared feature branch in every touched project (P-1c0f5e84).
+      // Cross-repo plans materialize work items into multiple projects; each
+      // one needs the shared branch created off its own main and pushed to
+      // its own origin so the dispatcher can later `git worktree add ... origin/<branch>`
+      // per project. Idempotent — `git rev-parse --verify` skips the create
+      // when the branch already exists locally, and `git push -u origin` is
+      // a no-op when the remote already has the same tip.
       if (plan.branch_strategy === 'shared-branch' && plan.feature_branch) {
-        try {
-          const firstProject = itemsByProject.values().next().value?.project;
-          if (!firstProject?.localPath) throw new Error('no project with localPath');
-          const root = path.resolve(firstProject.localPath);
-          const mainBranch = shared.resolveMainBranch(root, firstProject.mainBranch);
-          const branch = sanitizeBranch(plan.feature_branch);
-          // Create branch from main (idempotent — ignores if exists)
-          // P-a7c4d2e8 (F3): argv-form (shell:false) replaces shell-piped exec.
-          try { shared.shellSafeGitSync(['branch', branch, mainBranch], { cwd: root }); } catch { /* idempotent — branch may already exist */ }
-          try { shared.shellSafeGitSync(['push', '-u', 'origin', branch], { cwd: root }); } catch (e) { log('warn', `git push -u origin ${branch} (pre-create): ${e.message?.split('\n')[0]}`); }
-          log('info', `Shared branch pre-created: ${branch} for plan ${file}`);
-        } catch (err) {
-          log('warn', `Failed to pre-create shared branch for ${file}: ${err.message}`);
+        const branch = sanitizeBranch(plan.feature_branch);
+        for (const [projName, { project: itProject }] of itemsByProject) {
+          // Skip the _central bucket — those items have no project root.
+          if (!itProject?.localPath) continue;
+          try {
+            const root = path.resolve(itProject.localPath);
+            const mainBranch = shared.resolveMainBranch(root, itProject.mainBranch);
+            // Idempotency guard: rev-parse --verify exits 0 when the branch
+            // already exists locally. Only attempt the branch-create when
+            // it returns a nonzero exit (caught below).
+            let branchExists = false;
+            try {
+              shared.shellSafeGitSync(['rev-parse', '--verify', '--quiet', `refs/heads/${branch}`], { cwd: root });
+              branchExists = true;
+            } catch { /* branch does not exist — fall through to create */ }
+            if (!branchExists) {
+              try { shared.shellSafeGitSync(['branch', branch, mainBranch], { cwd: root }); }
+              catch (e) { log('warn', `Shared branch ${branch} create in ${projName} skipped: ${e.message?.split('\n')[0]}`); }
+            }
+            // Always push — no-op when origin already has the tip; surfaces
+            // the new branch when it was just created.
+            try { shared.shellSafeGitSync(['push', '-u', 'origin', branch], { cwd: root }); }
+            catch (e) { log('warn', `git push -u origin ${branch} (pre-create in ${projName}): ${e.message?.split('\n')[0]}`); }
+            log('info', `Shared branch pre-created: ${branch} in ${projName} for plan ${file}`);
+          } catch (err) {
+            // Per-project failure isolation — one project's broken
+            // localPath / git config must not block the others.
+            log('warn', `Failed to pre-create shared branch ${branch} in ${projName} for ${file}: ${err.message}`);
+          }
         }
       }
 
@@ -5415,6 +5608,44 @@ function isPrAutomationCauseHandledOrPending(project, pr, causeKey) {
 }
 
 
+/**
+ * P-a1f3c2d4 — `engine.pollingPaused` is a hard-stop kill-switch that fires
+ * every tick when ON. Without this guard the engine would emit an info log on
+ * every tick (~6/min) while paused, drowning the rest of the log. We log once
+ * on the transition `unpaused → paused`, then stay quiet until the operator
+ * flips it back off (transition `paused → unpaused` is silent — the engine's
+ * routine "PR status poll" log entries resume on their own and visibly signal
+ * the unpause).
+ */
+let _pollingPausedLastState = false;
+function _shouldLogPollingPausedOnce() {
+  if (_pollingPausedLastState) return false;
+  _pollingPausedLastState = true;
+  return true;
+}
+function _resetPollingPausedLogState() {
+  // Only flips back to "log next time we see paused=true" when we observe
+  // paused=false. Called from the polling-gate resolution site below
+  // whenever pollingPaused is currently false.
+  _pollingPausedLastState = false;
+}
+
+/**
+ * P-b2e5d8c7 — `engine.autoFixPaused` mirrors the pollingPaused log-throttle
+ * pattern above. Same once-per-transition contract: log on unpaused → paused,
+ * stay quiet while paused, silent on paused → unpaused (routine discovery
+ * resumes and signals the unpause).
+ */
+let _autoFixPausedLastState = false;
+function _shouldLogAutoFixPausedOnce() {
+  if (_autoFixPausedLastState) return false;
+  _autoFixPausedLastState = true;
+  return true;
+}
+function _resetAutoFixPausedLogState() {
+  _autoFixPausedLastState = false;
+}
+
 // Tracks per-process which silent-discovery warnings have already been logged
 // so we don't spam the log every tick. Cleared on process exit (no need to
 // persist — the warning is for the operator at engine startup/run time).
@@ -5467,17 +5698,31 @@ async function discoverFromPrs(config, project) {
   const newWork = [];
 
   const projMeta = { name: project?.name, localPath: project?.localPath };
-  // Resolve poll-enabled per project — stale reviewStatus is untrustworthy without poller
+  // Resolve poll-enabled per project — stale reviewStatus is untrustworthy without poller.
+  // P-a1f3c2d4: engine.pollingPaused is a hard-stop master switch that wins over
+  // both adoPollEnabled and ghPollEnabled. Forcing pollEnabled=false here
+  // suppresses every per-PR auto-dispatch gate below (reviewEnabled,
+  // autoFixHumanComments, autoFixReviewFeedback, autoFixBuilds, autoFixConflicts)
+  // without us having to add a check at each call site.
+  const pollingPaused = config.engine?.pollingPaused === true;
   const isAdoProject = project?.repoHost !== 'github';
-  const pollEnabled = isAdoProject
+  const pollEnabled = !pollingPaused && (isAdoProject
     ? (config.engine?.adoPollEnabled ?? ENGINE_DEFAULTS.adoPollEnabled)
-    : (config.engine?.ghPollEnabled ?? ENGINE_DEFAULTS.ghPollEnabled);
+    : (config.engine?.ghPollEnabled ?? ENGINE_DEFAULTS.ghPollEnabled));
   const evalLoopEnabled = config.engine?.evalLoop !== false;
   const fixThrottled = isAdoProject ? isAdoThrottled() : isGhThrottled();
   const autoReviewPrs = config.engine?.autoReviewPrs ?? ENGINE_DEFAULTS.autoReviewPrs;
   const autoReReviewPrs = config.engine?.autoReReviewPrs ?? ENGINE_DEFAULTS.autoReReviewPrs;
-  const autoFixReviewFeedback = config.engine?.autoFixReviewFeedback ?? ENGINE_DEFAULTS.autoFixReviewFeedback;
-  const autoFixHumanComments = config.engine?.autoFixHumanComments ?? ENGINE_DEFAULTS.autoFixHumanComments;
+  // P-b2e5d8c7: engine.autoFixPaused is a hard-stop master switch over every
+  // auto-fix gate. Composing `!autoFixPaused && …` into each autoFix* gate
+  // here makes the kill-switch single-point: every downstream
+  // `pollEnabled && autoFix* && …` site inherits the gate without us touching
+  // the per-cause dispatch blocks. Review / re-review dispatch (autoReviewPrs
+  // / autoReReviewPrs) is intentionally NOT gated — operators can pause the
+  // fix-storm during an incident while still seeing fresh review verdicts.
+  const autoFixPaused = config.engine?.autoFixPaused === true;
+  const autoFixReviewFeedback = !autoFixPaused && (config.engine?.autoFixReviewFeedback ?? ENGINE_DEFAULTS.autoFixReviewFeedback);
+  const autoFixHumanComments = !autoFixPaused && (config.engine?.autoFixHumanComments ?? ENGINE_DEFAULTS.autoFixHumanComments);
 
   // Collect active PR dispatches to prevent simultaneous review+fix on same PR
   const dispatch = getDispatch();
@@ -5861,7 +6106,7 @@ async function discoverFromPrs(config, project) {
       const gracePeriodMs = config.engine?.buildFixGracePeriod ?? ENGINE_DEFAULTS.buildFixGracePeriod;
       if (Date.now() - new Date(pr._buildFixPushedAt).getTime() < gracePeriodMs) continue;
     }
-    const autoFixBuilds = config.engine?.autoFixBuilds ?? ENGINE_DEFAULTS.autoFixBuilds;
+    const autoFixBuilds = !autoFixPaused && (config.engine?.autoFixBuilds ?? ENGINE_DEFAULTS.autoFixBuilds);
     if (pollEnabled && autoFixBuilds && pr.status === PR_STATUS.ACTIVE && pr.buildStatus === 'failing'
       && !fixDispatched
       && !isPrNoOpFixCauseSuppressed(pr, shared.PR_FIX_CAUSE.BUILD_FAILURE)) {
@@ -6022,7 +6267,7 @@ async function discoverFromPrs(config, project) {
     }
 
     // PRs with merge conflicts — dispatch fix to resolve (gated by provider polling + autoFixConflicts)
-    const autoFixConflicts = config.engine?.autoFixConflicts ?? ENGINE_DEFAULTS.autoFixConflicts;
+    const autoFixConflicts = !autoFixPaused && (config.engine?.autoFixConflicts ?? ENGINE_DEFAULTS.autoFixConflicts);
     if (pollEnabled && autoFixConflicts && pr.status === PR_STATUS.ACTIVE && pr._mergeConflict && !fixDispatched
       && !isPrNoOpFixCauseSuppressed(pr, shared.PR_FIX_CAUSE.MERGE_CONFLICT)) {
       // W-mpritzcr0004afc5 (#2955): "don't fan out a parallel conflict-fix
@@ -7342,15 +7587,42 @@ function discoverCentralWorkItems(config) {
       let planFileContent = null;
       let planReadError = null;
       let declaredPlanProject = '';
+      let planTargetProjects = [];
       if (workType === WORK_TYPE.PLAN_TO_PRD && item.planFile) {
         const planPath = path.join(PLANS_DIR, item.planFile);
         try {
           planFileContent = fs.readFileSync(planPath, 'utf8');
           declaredPlanProject = shared.extractPlanDeclaredProject(planFileContent);
+          // P-9af2eb37 — also parse the cross-repo target list from the same
+          // plan content. extractPlanTargetProjects (P-7a3f1c08) returns
+          // [] when the plan has no <!-- minions:targetProjects=… --> marker
+          // and no **Projects:** line, so single-project plans are a no-op.
+          planTargetProjects = shared.extractPlanTargetProjects(planFileContent);
         } catch (e) {
           planReadError = e;
         }
       }
+      // P-9af2eb37 — a cross-repo plan-to-prd has NO singular **Project:**
+      // header (declaredPlanProject === '') but ≥2 entries in the parsed
+      // target list. When that happens, attach the dispatch to the first
+      // listed project (read-only worktree, no mutation, no collision risk)
+      // so vars.project_path resolves and worktree-requiring carve-outs
+      // behave. The cross-repo case is signaled to the playbook via
+      // vars.target_projects (set further down in the var-injection block).
+      const isCrossRepoPlan = workType === WORK_TYPE.PLAN_TO_PRD
+        && !declaredPlanProject
+        && Array.isArray(planTargetProjects)
+        && planTargetProjects.length >= 2;
+      let crossRepoFallbackProject = null;
+      let crossRepoFallbackError = null;
+      if (isCrossRepoPlan) {
+        const firstResolution = shared.resolveConfiguredProject(planTargetProjects[0], projects);
+        if (firstResolution.project) {
+          crossRepoFallbackProject = firstResolution.project;
+        } else if (firstResolution.error) {
+          crossRepoFallbackError = firstResolution.error;
+        }
+      }
       const requestedProjectResolution = declaredPlanProject
         ? shared.resolveConfiguredProject(declaredPlanProject, projects)
         : itemProjectResolution;
@@ -7365,7 +7637,22 @@ function discoverCentralWorkItems(config) {
         log('warn', `central work item ${item.id}: ${error}`);
         continue;
       }
-      const targetProject = requestedProjectResolution.project || (projects.length === 1 ? projects[0] : null);
+      if (isCrossRepoPlan && crossRepoFallbackError && !crossRepoFallbackProject) {
+        // First listed cross-repo target doesn't match any configured project
+        // — fail with a clear reason instead of silently degrading to a
+        // null targetProject and an empty vars.project_path.
+        mutations.set(item.id, {
+          status: WI_STATUS.FAILED,
+          failReason: crossRepoFallbackError,
+          failedAt: ts(),
+          _crossRepoTargetProjects: planTargetProjects.slice(),
+        });
+        log('warn', `central work item ${item.id} (cross-repo plan-to-prd): ${crossRepoFallbackError}`);
+        continue;
+      }
+      const targetProject = requestedProjectResolution.project
+        || crossRepoFallbackProject
+        || (projects.length === 1 ? projects[0] : null);
       if (declaredPlanProject) {
         const projectMutation = { project: targetProject.name, _declaredPlanProject: declaredPlanProject };
         mutations.set(item.id, Object.assign(mutations.get(item.id) || {}, projectMutation));
@@ -7442,6 +7729,16 @@ function discoverCentralWorkItems(config) {
         // Notes already populated by buildWorkItemDispatchVars — no need to re-read
         // Track expected plan filename for artifacts and follow-up plan-to-prd prompts.
         mutations.set(item.id, Object.assign(mutations.get(item.id) || {}, { _planFileName: planFileName }));
+        // P-4d6e2af3 — surface cross-repo intent to the plan playbook.
+        // dashboard.js#buildPlanWorkItem (~line 759) sets item._targetProjects
+        // to a string[] when the operator picked ≥2 projects in the Create-
+        // Plan modal. The playbook ({{target_projects}}, gated by P-c1f87a92)
+        // renders a plural "Projects:" header + minions:targetProjects=… marker
+        // so plan-to-prd can route each PRD item per-project. Single-project
+        // plans leave the var unset; PLAYBOOK_OPTIONAL_VARS defaults it to ''.
+        if (Array.isArray(item._targetProjects) && item._targetProjects.length > 0) {
+          vars.target_projects = item._targetProjects.join(', ');
+        }
       }
 
       // Inject plan-to-prd variables — read the plan file content for the playbook
@@ -7458,6 +7755,23 @@ function discoverCentralWorkItems(config) {
         vars.plan_file = item.planFile || '';
         vars.project_name_lower = (targetProject?.name || 'project').toLowerCase();
         vars.project_filename_slug = safePrdProjectSlug(targetProject?.name || 'project');
+        // P-9af2eb37 — cross-repo override. When the plan has NO singular
+        // **Project:** header but ≥2 entries in the parsed target list,
+        // (a) the per-project slug from safePrdProjectSlug would collide
+        //     across sibling cross-repo PRDs dispatched on the same day
+        //     (every cross-repo PRD on `minions-opg`-as-fallback would
+        //     resolve to `minions-opg-<date>.json`); use `cross-<uid>-…`
+        //     instead so each cross-repo PRD gets a unique filename and
+        //     the disambiguation in the existing prdExisting loop below
+        //     never has to disambiguate cross-repo siblings.
+        // (b) surface the parsed list to the plan-to-prd.md playbook via
+        //     vars.target_projects so the agent can route each PRD item to
+        //     the right repo (PLAYBOOK_OPTIONAL_VARS already includes
+        //     target_projects — set in P-4d6e2af3 for the plan playbook).
+        if (isCrossRepoPlan) {
+          vars.project_filename_slug = 'cross-' + shared.uid();
+          vars.target_projects = planTargetProjects.join(', ');
+        }
         // Default empty string so the {{existing_prd_json}} token always resolves —
         // playbook treats empty as "no existing PRD, fresh run". Without this default
         // the renderPlaybook pass logs an "unresolved template variables" warning
@@ -7603,91 +7917,116 @@ async function discoverWork(config) {
 
   // Side-effect passes: materialize plans and design docs into work-items.json
   // These write to project work queues — picked up by discoverFromWorkItems below.
-  reconcilePrdStatuses(config); // Backward-scan: correct "missing" PRD items that have done work items (#929)
-  materializePlansAsWorkItems(config);
+  // Gated by config.engine?.planMaterializationEnabled !== false (P-d6f0a2b5) —
+  // operators can suppress the PRD reconcile + plan materialization pair
+  // without disabling the rest of discoverWork (e.g. when running a long
+  // migration that must not auto-create work items).
+  if (config.engine?.planMaterializationEnabled !== false) {
+    reconcilePrdStatuses(config); // Backward-scan: correct "missing" PRD items that have done work items (#929)
+    materializePlansAsWorkItems(config);
+  }
 
   for (const project of projects) {
     const root = project.localPath ? path.resolve(project.localPath) : null;
     if (!root || !fs.existsSync(root)) continue;
 
     // Source 1: Pull Requests → fixes, reviews, build-test
-    const prWork = await discoverFromPrs(config, project);
-    allFixes.push(...prWork.filter(w => w.type === WORK_TYPE.FIX));
-    allReviews.push(...prWork.filter(w => w.type === WORK_TYPE.REVIEW));
-    allWorkItems.push(...prWork.filter(w => w.type === WORK_TYPE.TEST));
+    // Gated by config.engine?.prDiscoveryEnabled !== false (P-d6f0a2b5) —
+    // per-project project.workSources.pullRequests.enabled still composes
+    // inside discoverFromPrs; a `false` at either level skips the call.
+    if (config.engine?.prDiscoveryEnabled !== false) {
+      const prWork = await discoverFromPrs(config, project);
+      allFixes.push(...prWork.filter(w => w.type === WORK_TYPE.FIX));
+      allReviews.push(...prWork.filter(w => w.type === WORK_TYPE.REVIEW));
+      allWorkItems.push(...prWork.filter(w => w.type === WORK_TYPE.TEST));
+    }
 
     // Side-effect: specs → work items (picked up below)
     materializeSpecsAsWorkItems(config, project);
 
     // Source 3: Work items (includes auto-filed from plans, design docs, build failures)
-    allWorkItems.push(...discoverFromWorkItems(config, project));
+    // Gated by config.engine?.workItemsDiscoveryEnabled !== false (P-d6f0a2b5) —
+    // per-project project.workSources.workItems.enabled still composes
+    // inside discoverFromWorkItems; a `false` at either level skips the call.
+    if (config.engine?.workItemsDiscoveryEnabled !== false) {
+      allWorkItems.push(...discoverFromWorkItems(config, project));
+    }
   }
 
   // Source 2: Minions-level PRD → implements (multi-project, called once outside project loop)
   // PRD items (prd/*.json), materialized from plans/*.md, flow through materializePlansAsWorkItems → discoverFromWorkItems
 
   // Central work items (project-agnostic — agent decides where to work)
-  const centralWork = discoverCentralWorkItems(config);
+  // Gated by config.engine?.centralWorkDiscoveryEnabled !== false (P-d6f0a2b5) —
+  // `let centralWork = []` keeps the downstream `...centralWork` spread
+  // iterable when the gate is off.
+  let centralWork = [];
+  if (config.engine?.centralWorkDiscoveryEnabled !== false) {
+    centralWork = discoverCentralWorkItems(config);
+  }
 
   // Scheduled tasks (cron-style recurring work)
-  try {
-    const { discoverScheduledWork } = require('./engine/scheduler');
-    const scheduledWork = discoverScheduledWork(config);
-    if (scheduledWork.length > 0) {
-      const { createMeeting, getMeetings } = require('./engine/meeting');
-      const centralPath = path.join(MINIONS_DIR, 'work-items.json');
-      // Separate meetings (no work-items write) from task items
-      const taskItems = [];
-      for (const item of scheduledWork) {
-        if (item.type === WORK_TYPE.MEETING) {
-          const sched = (config.schedules || []).find(s => s.id === item._scheduleId);
-          const participants = (sched && sched.participants) || [];
-          const meeting = createMeeting({ title: item.title, agenda: item.description, participants });
-          log('info', `Scheduled meeting created: ${item._scheduleId} → ${meeting.id} (${participants.length} participants)`);
-        } else {
-          taskItems.push(item);
-        }
-      }
-      if (taskItems.length > 0) {
-        // Atomic write — prevents race with dispatch status updates on central work-items.json
-        mutateJsonFileLocked(centralPath, (items) => {
-          if (!Array.isArray(items)) items = [];
-          let added = 0;
-          // Snapshot active dedup keys BEFORE the loop so multiple items in the
-          // same harness mission (same _missionId) all land in one tick. Without
-          // this snapshot, the first item's push would block subsequent items
-          // in the same mission from joining (W-mq07a9gf000jbc2b — tri-agent
-          // harness mode requires Planner+Generator+Evaluator to land together).
-          const activeMissionIds = new Set();
-          const activeScheduleIds = new Set();
-          for (const existing of items) {
-            if (existing.status === WI_STATUS.DONE || existing.status === WI_STATUS.FAILED) continue;
-            if (existing._missionId) activeMissionIds.add(existing._missionId);
-            if (existing._scheduleId) activeScheduleIds.add(existing._scheduleId);
+  // Gated by config.engine?.scheduledWorkDiscoveryEnabled !== false (P-d6f0a2b5).
+  if (config.engine?.scheduledWorkDiscoveryEnabled !== false) {
+    try {
+      const { discoverScheduledWork } = require('./engine/scheduler');
+      const scheduledWork = discoverScheduledWork(config);
+      if (scheduledWork.length > 0) {
+        const { createMeeting, getMeetings } = require('./engine/meeting');
+        const centralPath = path.join(MINIONS_DIR, 'work-items.json');
+        // Separate meetings (no work-items write) from task items
+        const taskItems = [];
+        for (const item of scheduledWork) {
+          if (item.type === WORK_TYPE.MEETING) {
+            const sched = (config.schedules || []).find(s => s.id === item._scheduleId);
+            const participants = (sched && sched.participants) || [];
+            const meeting = createMeeting({ title: item.title, agenda: item.description, participants });
+            log('info', `Scheduled meeting created: ${item._scheduleId} → ${meeting.id} (${participants.length} participants)`);
+          } else {
+            taskItems.push(item);
           }
-          const addedScheduleIdsThisTick = new Set();
-          for (const item of taskItems) {
-            // Mission items dedup by _missionId against pre-existing rows only
-            // (the trio's other items added later in this loop must not block
-            // each other). Plain scheduled items keep the original scheduleId
-            // dedup AND skip if a sibling item from the same tick already
-            // claimed the schedule slot.
-            if (item._missionId) {
-              if (activeMissionIds.has(item._missionId)) continue;
-            } else {
-              if (activeScheduleIds.has(item._scheduleId)) continue;
-              if (addedScheduleIdsThisTick.has(item._scheduleId)) continue;
+        }
+        if (taskItems.length > 0) {
+          // Atomic write — prevents race with dispatch status updates on central work-items.json
+          mutateJsonFileLocked(centralPath, (items) => {
+            if (!Array.isArray(items)) items = [];
+            let added = 0;
+            // Snapshot active dedup keys BEFORE the loop so multiple items in the
+            // same harness mission (same _missionId) all land in one tick. Without
+            // this snapshot, the first item's push would block subsequent items
+            // in the same mission from joining (W-mq07a9gf000jbc2b — tri-agent
+            // harness mode requires Planner+Generator+Evaluator to land together).
+            const activeMissionIds = new Set();
+            const activeScheduleIds = new Set();
+            for (const existing of items) {
+              if (existing.status === WI_STATUS.DONE || existing.status === WI_STATUS.FAILED) continue;
+              if (existing._missionId) activeMissionIds.add(existing._missionId);
+              if (existing._scheduleId) activeScheduleIds.add(existing._scheduleId);
             }
-            items.push(item);
-            if (!item._missionId && item._scheduleId) addedScheduleIdsThisTick.add(item._scheduleId);
-            added++;
-            log('info', `Scheduled task fired: ${item._scheduleId} → ${item.title}`);
-          }
-          return items;
-        }, { defaultValue: [] });
+            const addedScheduleIdsThisTick = new Set();
+            for (const item of taskItems) {
+              // Mission items dedup by _missionId against pre-existing rows only
+              // (the trio's other items added later in this loop must not block
+              // each other). Plain scheduled items keep the original scheduleId
+              // dedup AND skip if a sibling item from the same tick already
+              // claimed the schedule slot.
+              if (item._missionId) {
+                if (activeMissionIds.has(item._missionId)) continue;
+              } else {
+                if (activeScheduleIds.has(item._scheduleId)) continue;
+                if (addedScheduleIdsThisTick.has(item._scheduleId)) continue;
+              }
+              items.push(item);
+              if (!item._missionId && item._scheduleId) addedScheduleIdsThisTick.add(item._scheduleId);
+              added++;
+              log('info', `Scheduled task fired: ${item._scheduleId} → ${item.title}`);
+            }
+            return items;
+          }, { defaultValue: [] });
+        }
       }
-    }
-  } catch (e) { log('warn', 'discover scheduled work: ' + e.message); }
+    } catch (e) { log('warn', 'discover scheduled work: ' + e.message); }
+  }
 
   // Meeting work (multi-round team discussions)
   try {
@@ -7768,15 +8107,37 @@ async function discoverWork(config) {
 
   const allWork = [...allFixes, ...allReviews, ...allWorkItems, ...centralWork];
 
-  for (const item of allWork) {
-    await addToDispatchWithValidation(item, { config });
-    // W-mph8xt88000ke0fc — Cooldowns are stamped by addToDispatch ONLY on
-    // successful append (post-dedup). Stamping unconditionally here used to
-    // leave orphan cooldowns for items collapsed by prDedupeKey / workItem-id
-    // / dispatchKey dedup or routed to the pre-dispatch review queue.
-    if (item.meta?.source === 'pr-human-feedback') {
-      clearPendingHumanFeedbackFlag(item.meta.project, item.meta.pr?.id);
-    }
+  // W-mq9acoo800177bcb — bounded-concurrency pre-dispatch eval.
+  // The validator inside addToDispatchWithValidation runs a ~25-30s LLM
+  // call per item; an approved 11-item PRD used to take ~5 min to queue
+  // because we awaited each item in series. Process items in chunks of
+  // `preDispatchEvalConcurrency` (default 6, clamp 1-20) via
+  // Promise.allSettled so a rejected branch in one item still fails open
+  // and the rest of the chunk continues. Iteration order within a chunk
+  // is irrelevant: addToDispatch's dedup gates are mutateDispatch-locked,
+  // and the only per-item side effect (`clearPendingHumanFeedbackFlag`)
+  // is an idempotent flag-clear on a single PR record.
+  const evalConcurrency = resolvePreDispatchEvalConcurrency(config);
+  for (let i = 0; i < allWork.length; i += evalConcurrency) {
+    const chunk = allWork.slice(i, i + evalConcurrency);
+    await Promise.allSettled(chunk.map(async (item) => {
+      try {
+        await addToDispatchWithValidation(item, { config });
+      } catch (e) {
+        // Fail-open contract preserved: any validator throw here means the
+        // item is dropped from this discovery tick rather than wedging the
+        // whole chunk. The item stays `pending` in work-items.json and the
+        // next tick re-discovers it.
+        log('warn', `pre-dispatch-eval: addToDispatchWithValidation threw for ${item?.meta?.item?.id || item?.id || 'unknown'}: ${e?.message || e}`);
+      }
+      // W-mph8xt88000ke0fc — Cooldowns are stamped by addToDispatch ONLY on
+      // successful append (post-dedup). Stamping unconditionally here used to
+      // leave orphan cooldowns for items collapsed by prDedupeKey / workItem-id
+      // / dispatchKey dedup or routed to the pre-dispatch review queue.
+      if (item.meta?.source === 'pr-human-feedback') {
+        clearPendingHumanFeedbackFlag(item.meta.project, item.meta.pr?.id);
+      }
+    }));
   }
 
   if (allWork.length > 0) {
@@ -7873,6 +8234,20 @@ function resolveMaxConcurrent(config) {
   return Number.isFinite(value) && value >= 0 ? value : ENGINE_DEFAULTS.maxConcurrent;
 }
 
+// W-mq9acoo800177bcb — clamp the per-tick pre-dispatch validator concurrency.
+// Read-side mirror of the [1, 20] clamp dashboard.js#handleSettingsUpdate
+// applies on writes, so a hand-edited config.json or an engine-only test
+// fixture can't smuggle in a value that DOSes the LLM provider or starves
+// the rest of the tick. Falls back to ENGINE_DEFAULTS.preDispatchEvalConcurrency
+// for unset / non-finite / out-of-range values.
+function resolvePreDispatchEvalConcurrency(config) {
+  const raw = config?.engine?.preDispatchEvalConcurrency;
+  if (raw === undefined || raw === null || raw === '') return ENGINE_DEFAULTS.preDispatchEvalConcurrency;
+  const value = Number(raw);
+  if (!Number.isFinite(value)) return ENGINE_DEFAULTS.preDispatchEvalConcurrency;
+  return Math.max(1, Math.min(20, Math.floor(value)));
+}
+
 // ─── Main Tick ──────────────────────────────────────────────────────────────
 
 let tickCount = 0;
@@ -8152,8 +8527,45 @@ async function tickInner() {
     });
   }
 
-  const adoPollEnabled = config.engine?.adoPollEnabled ?? ENGINE_DEFAULTS.adoPollEnabled;
-  const ghPollEnabled = config.engine?.ghPollEnabled ?? ENGINE_DEFAULTS.ghPollEnabled;
+  // P-a1f3c2d4: engine.pollingPaused is a hard-stop master switch — it overrides
+  // both per-provider toggles. When ON, adoPollEnabled and ghPollEnabled are
+  // forced to false so the status-poll and human-comment-poll gates below
+  // short-circuit without editing every per-call gate. Reconciliation (the
+  // final block below) is NOT gated — it's a recovery sweep, not a
+  // convenience poll. The same gate is mirrored inside discoverFromPrs.
+  const pollingPaused = config.engine?.pollingPaused === true;
+  if (pollingPaused && _shouldLogPollingPausedOnce()) {
+    log('info', '[engine] PR polling paused — engine.pollingPaused=true overrides adoPollEnabled/ghPollEnabled');
+  } else if (!pollingPaused) {
+    _resetPollingPausedLogState();
+  }
+  // P-b2e5d8c7: log once on the transition unpaused → paused for autoFixPaused
+  // too. The gate itself is enforced inside discoverFromPrs (composed into
+  // autoFixBuilds / autoFixConflicts / autoFixReviewFeedback /
+  // autoFixHumanComments). Same throttling contract as pollingPaused above.
+  const autoFixPaused = config.engine?.autoFixPaused === true;
+  if (autoFixPaused && _shouldLogAutoFixPausedOnce()) {
+    log('info', '[engine] auto-fix paused — engine.autoFixPaused=true inerts autoFixBuilds/autoFixConflicts/autoFixReviewFeedback/autoFixHumanComments');
+  } else if (!autoFixPaused) {
+    _resetAutoFixPausedLogState();
+  }
+  const adoPollEnabled = !pollingPaused && (config.engine?.adoPollEnabled ?? ENGINE_DEFAULTS.adoPollEnabled);
+  const ghPollEnabled = !pollingPaused && (config.engine?.ghPollEnabled ?? ENGINE_DEFAULTS.ghPollEnabled);
+  // P-c4d8e1a3 — granular per-poller flags. Each of the 6 PR-poll axes
+  // (ADO/GH × status/comments/reconcile) plus processPendingRebases gets
+  // its own resolution via shared.resolvePollFlag(...). Explicit granular
+  // values win; the legacy `adoPollEnabled` / `ghPollEnabled` macros
+  // silence their whole bundle as a fallback (including reconcile — a
+  // documented breaking change). Defaults: all true. pollingPaused (master
+  // killswitch) still composes with status + comments gates; reconcile and
+  // the rebase processor are recovery-sweep paths and are NOT gated by it.
+  const adoStatusPollEnabled = !pollingPaused && resolvePollFlag(config.engine, 'adoPrStatusPollEnabled', 'adoPollEnabled');
+  const ghStatusPollEnabled = !pollingPaused && resolvePollFlag(config.engine, 'ghPrStatusPollEnabled', 'ghPollEnabled');
+  const adoCommentsPollEnabled = !pollingPaused && resolvePollFlag(config.engine, 'adoPrCommentsPollEnabled', 'adoPollEnabled');
+  const ghCommentsPollEnabled = !pollingPaused && resolvePollFlag(config.engine, 'ghPrCommentsPollEnabled', 'ghPollEnabled');
+  const adoReconcileEnabled = resolvePollFlag(config.engine, 'adoPrReconcileEnabled', 'adoPollEnabled');
+  const ghReconcileEnabled = resolvePollFlag(config.engine, 'ghPrReconcileEnabled', 'ghPollEnabled');
+  const rebaseProcessorEnabled = resolvePollFlag(config.engine, 'processPendingRebasesEnabled', null);
   const prPollStatusEvery = Math.max(
     1,
     Number(config.engine?.prPollStatusEvery) || ENGINE_DEFAULTS.prPollStatusEvery
@@ -8173,7 +8585,7 @@ async function tickInner() {
     lastPrStatusPollAt = now;
     // Build promise array — enabled+unthrottled polls run concurrently via Promise.allSettled
     const statusPolls = [];
-    if (adoPollEnabled) {
+    if (adoStatusPollEnabled) {
       // Per-org throttle skip happens inside forEachActivePr (one log line per skipped project).
       // Top-level short-circuit: when every known ADO org is throttled, skip the whole phase
       // with one log line to avoid the per-project iteration cost.
@@ -8186,14 +8598,16 @@ async function tickInner() {
         statusPolls.push(pollPrStatus(config).catch(err => { log('warn', `ADO PR status poll error: ${err?.message || err}${err?.stack ? ' | ' + err.stack.split('\n')[1]?.trim() : ''}`); }));
       }
     }
-    if (ghPollEnabled && !isGhThrottled()) {
+    if (ghStatusPollEnabled && !isGhThrottled()) {
       statusPolls.push(ghPollPrStatus(config).catch(err => { log('warn', `GitHub PR status poll error: ${err?.message || err}${err?.stack ? ' | ' + err.stack.split('\n')[1]?.trim() : ''}`); }));
-    } else if (ghPollEnabled && isGhThrottled()) {
+    } else if (ghStatusPollEnabled && isGhThrottled()) {
       log('info', '[gh] PR status poll skipped — throttled');
     }
     if (statusPolls.length) await Promise.allSettled(statusPolls);
     if (_isTickStale(myGeneration)) return;
-    try { await processPendingRebases(config); } catch (err) { log('warn', `Pending rebase processing error: ${err?.message || err}`); }
+    if (rebaseProcessorEnabled) {
+      try { await processPendingRebases(config); } catch (err) { log('warn', `Pending rebase processing error: ${err?.message || err}`); }
+    }
     if (_isTickStale(myGeneration)) return;
     // Sync PR status back to PRD items (missing → done when active PR exists)
     try { syncPrdFromPrs(config); } catch (err) { log('warn', `PRD sync error: ${err?.message || err}`); }
@@ -8227,7 +8641,7 @@ async function tickInner() {
     lastPrCommentsPollAt = now;
     // Build promise array — enabled+unthrottled comment polls run concurrently via Promise.allSettled
     const commentPolls = [];
-    if (adoPollEnabled) {
+    if (adoCommentsPollEnabled) {
       // Per-org throttle skip happens inside forEachActivePr (one log line per skipped project).
       // Top-level short-circuit: when every known ADO org is throttled, skip the whole phase
       // with one log line to avoid the per-project iteration cost.
@@ -8240,20 +8654,41 @@ async function tickInner() {
         commentPolls.push(pollPrHumanComments(config).catch(err => { log('warn', `ADO PR comment poll error: ${err?.message || err}${err?.stack ? ' | ' + err.stack.split('\n')[1]?.trim() : ''}`); }));
       }
     }
-    if (ghPollEnabled && !isGhThrottled()) {
+    if (ghCommentsPollEnabled && !isGhThrottled()) {
       commentPolls.push(ghPollPrHumanComments(config).catch(err => { log('warn', `GitHub PR comment poll error: ${err?.message || err}${err?.stack ? ' | ' + err.stack.split('\n')[1]?.trim() : ''}`); }));
-    } else if (ghPollEnabled && isGhThrottled()) {
+    } else if (ghCommentsPollEnabled && isGhThrottled()) {
       log('info', '[gh] PR comment poll skipped — throttled');
     }
     if (commentPolls.length) await Promise.allSettled(commentPolls);
     if (_isTickStale(myGeneration)) return;
-    // Reconciliation runs regardless of poll flags — it's a recovery sweep, not a convenience poll
-    // Reconciliation also parallelized — ADO and GitHub reconciliation are independent
+    // P-c4d8e1a3: reconcile gated by *PrReconcileEnabled (default true) — ungated
+    // by ADO/GH throttle trackers (recovery-sweep contract intact). Legacy
+    // adoPollEnabled/ghPollEnabled=false now also silences reconcile via
+    // resolvePollFlag's legacy-macro fallback (documented breaking change).
+    // ADO and GitHub reconciliation are independent and run in parallel.
     const reconcilePolls = [];
-    reconcilePolls.push(reconcilePrs(config).catch(err => { log('warn', `ADO PR reconciliation error: ${err?.message || err}${err?.stack ? ' | ' + err.stack.split('\n')[1]?.trim() : ''}`); }));
-    reconcilePolls.push(ghReconcilePrs(config).catch(err => { log('warn', `GitHub PR reconciliation error: ${err?.message || err}${err?.stack ? ' | ' + err.stack.split('\n')[1]?.trim() : ''}`); }));
-    await Promise.allSettled(reconcilePolls);
+    if (adoReconcileEnabled) {
+      reconcilePolls.push(reconcilePrs(config).catch(err => { log('warn', `ADO PR reconciliation error: ${err?.message || err}${err?.stack ? ' | ' + err.stack.split('\n')[1]?.trim() : ''}`); }));
+    }
+    if (ghReconcileEnabled) {
+      reconcilePolls.push(ghReconcilePrs(config).catch(err => { log('warn', `GitHub PR reconciliation error: ${err?.message || err}${err?.stack ? ' | ' + err.stack.split('\n')[1]?.trim() : ''}`); }));
+    }
+    if (reconcilePolls.length) await Promise.allSettled(reconcilePolls);
     if (_isTickStale(myGeneration)) return;
+
+    // W-mqba5ulq000nd255 — Cross-project PR scope-mismatch sweep. Cleans up
+    // stale records that were stamped with `_invalidProjectScope` and have a
+    // sibling in the correctly-scoped project. Cheap (a single read of all
+    // PRs + a per-affected-project mutation). Runs once per reconcile tick;
+    // sibling-less stamps are preserved as tracking signals.
+    try {
+      const result = pruneScopeMismatchDuplicatePrs(config);
+      if (result?.pruned > 0) {
+        log('info', `[pull-requests] scope-mismatch sweep pruned ${result.pruned} duplicate record(s) across ${result.scanned} scanned`);
+      }
+    } catch (err) {
+      log('warn', `[pull-requests] scope-mismatch sweep error: ${err?.message || err}`);
+    }
   }
 
   // 2.9. Stalled dispatch detection — auto-retry failed items blocking the graph (~20 min — cadence in ENGINE_DEFAULTS.stalledDispatchSweepEvery)
@@ -8793,6 +9228,29 @@ async function tickInner() {
   if (!discoveryOk) {
     log('warn', 'Discovery failed after pending dispatch pass — new work may be stale until next tick');
   }
+
+  // 6. Periodic memory baseline (P-b2c3d4e5).
+  // Sample once every ENGINE_DEFAULTS.memoryBaselineEveryTicks ticks (default
+  // 6 ≈ 60s at the default 10s tickInterval). When the cadence is <= 0,
+  // sampling is disabled cleanly — no log emission, no sidecar write
+  // (operator opt-out). The diagnostics-memory.json sidecar is a passive
+  // cache (single-object latest sample) — gitignored and exempt from the
+  // SQL-first state rule, same as engine/dashboard-port.json.
+  safe('memoryBaseline', () => emitMemoryBaseline(tickCount));
+}
+
+function emitMemoryBaseline(tickN) {
+  const every = Number(ENGINE_DEFAULTS.memoryBaselineEveryTicks);
+  if (!Number.isFinite(every) || every <= 0) return;
+  if ((tickN % every) !== 0) return;
+  const sample = diagnosticsMemory.sampleSelf({ label: 'engine' });
+  diagnosticsMemory.recordSample(sample);
+  try { safeWrite(DIAGNOSTICS_MEMORY_PATH, sample); }
+  catch (e) { log('warn', `memoryBaseline sidecar write: ${e.message}`); }
+  log('info',
+    `MEMORY_BASELINE engine rss=${sample.rss} heapUsed=${sample.heapUsed} ` +
+    `eventLoopLagP99=${sample.eventLoopLagP99.toFixed(2)}ms ` +
+    `gcPauses=${sample.gcCount}/${sample.gcPausesTotalMs.toFixed(2)}ms tickN=${tickN}`);
 }
 
 // ─── Exports (for engine/cli.js and other modules) ──────────────────────────
@@ -8832,6 +9290,7 @@ module.exports = {
   reconcileItemsWithPrs, detectDependencyCycles,
   areDependenciesMet, // exported for testing (P-bf04-decompose-zero-children)
   parseConflictFiles, pruneAncestorDeps, preflightMergeSimulation, // exported for testing
+  resolveDependencyBranches, buildCrossRepoDepsSection, // exported for testing (P-faea3206)
   gitOutputToString, gitErrorOutput, classifyDepMergeFailureOutput, listUnmergedFiles, // exported for testing
   buildDepConflictFixItem, deriveConflictFixKey, // exported for testing (W-mpcwojgr000a0244)
   isWorktreeRetryableError, removeStaleIndexLock, syncReusedWorktree, assertCleanSharedWorktree, _quarantineDirtyWorktree, // exported for testing
@@ -8866,8 +9325,12 @@ module.exports = {
   // Tick
   tick,
   resolveMaxConcurrent, _pollIntervalMsFromTicks, _shouldRunPeriodicPhase, // exported for testing
+  // W-mq9acoo800177bcb — exported for testing the clamped concurrency resolver
+  resolvePreDispatchEvalConcurrency,
   // P-c2e5a1d9-a — exported for testing the tick-generation force-release path
   _isTickStale,
+  // P-b2c3d4e5 — exported for testing the memory baseline emitter + sidecar path
+  emitMemoryBaseline, DIAGNOSTICS_MEMORY_PATH,
   get tickGeneration() { return tickGeneration; },
   set tickGeneration(v) { tickGeneration = v; },
   get tickRunning() { return tickRunning; },