@yemi33/minions 0.1.2249 → 0.1.2251

package/bin/minions.js

@@ -734,9 +734,11 @@ if (devMode) process.env.MINIONS_DASHBOARD_PORT = String(devPort);
 const DASHBOARD_PORT = resolveDashboardPort(rest).port;
 // Propagate the port to every child (engine, dashboard, delegated subcommands).
 // engine/cli.js status reads MINIONS_PORT; dashboard.js reads PORT. We export
-// MINIONS_PORT for the engine + watch-actions / pipeline / managed-spawn
-// loopback callers that already honor it, and pass PORT explicitly when
-// spawning dashboard.js.
+// MINIONS_PORT as the *requested* port for legacy consumers, but loopback callers
+// (watch-actions / pipeline / managed-spawn) must read the *actual* bound port
+// from the dashboard-port.json beacon via shared.readDashboardPortFile() — the
+// dashboard may bind to a fallback port (7332+) on EADDRINUSE, and MINIONS_PORT
+// stays frozen at the originally-requested value in that case.
 process.env.MINIONS_PORT = String(DASHBOARD_PORT);
 const POST_UPDATE_INIT_TIMEOUT_MS = 120000;
 // W-mqpx0tpi — the post-update `minions restart` runs as a child of `minions

package/dashboard/js/command-center.js

@@ -2050,7 +2050,7 @@ async function ccExecuteAction(action, targetTabId, opts) {
         break;
       }
       case 'link-pr': {
-        var prLinkRes = await _ccFetch('/api/pull-requests/link', { url: action.url, title: action.title || '', project: action.project || '', autoObserve: action.autoObserve !== false });
+        var prLinkRes = await _ccFetch('/api/pull-requests/link', { url: action.url, title: action.title || '', project: action.project || '', contextOnly: action.autoObserve === false });
         var prLinkData = await prLinkRes.json().catch(function() { return {}; });
         // eslint-disable-next-line no-unsanitized/property -- reason: structural HTML is a string literal; PR URL and server message wrapped in escHtml() (fields: action.url, prLinkData.message)
         status.innerHTML = '&#10003; PR linked: <strong>' + escHtml(action.url) + '</strong>' +

package/dashboard/js/refresh.js

@@ -869,10 +869,16 @@ function _processStatusUpdate(data, opts) {
   _safeRender('commands', function() { renderCommands(data.commands || []); });
   _changed('mcpServers', data.mcpServers);
   _safeRender('mcpServers', function() { renderMcpServers(data.mcpServers || []); });
-  // Harness propagation diagnostic comes from /api/harness/diagnostics
-  // (rare-change, fetched on each /api/status refresh so the tools page is
-  // always up to date when an operator drops a project-local skill).
+  // Harness propagation diagnostic comes from /api/harness/diagnostics.
+  // HEAVY ENDPOINT: the handler runs a synchronous `git status` per linked
+  // project (execFileSync, 10s timeout) which hard-blocks the dashboard event
+  // loop — a single WSL/UNC-path project freezes the whole dashboard for up to
+  // 10s on every poll. It is also "rare-change" and its output is ONLY rendered
+  // on the Tools page (`#harness-diag`), with no cross-page consumer of
+  // window._lastHarnessDiag. So only poll it while the Tools page is open;
+  // every other page skips the fetch entirely. (Load-reduction audit 2026-06-24.)
   _safeRender('harnessDiag', function() {
+    if (typeof currentPage !== 'undefined' && currentPage !== 'tools') return;
     fetch('/api/harness/diagnostics')
       .then(function (r) { return r.ok ? r.json() : Promise.reject(); })
       .then(function (fresh) {

package/dashboard/js/render-prs.js

@@ -59,9 +59,13 @@ async function fetchPullRequestsFromDisk(projects) {
   return out;
 }
 
+// Terminal statuses — follow-up WIs in these states are historical, not active.
+var _WI_TERMINAL = new Set(['done', 'cancelled', 'failed', 'decomposed', 'in-pr', 'implemented', 'complete']);
+
 function _countPrFollowups(pr) {
-  // PR follow-up chip (W-mpej3cox00099466) — counts WIs whose
-  // meta.pr_followup.parent_pr_url or parent_pr_id matches this PR.
+  // PR follow-up chip (W-mpej3cox00099466) — counts ACTIVE (non-terminal) WIs
+  // whose meta.pr_followup.parent_pr_url or parent_pr_id matches this PR.
+  // Terminal WIs (done/cancelled/failed) are excluded to avoid stale noise.
   if (!pr) return 0;
   var wis = (window._lastWorkItems) || [];
   if (!wis.length) return 0;
@@ -69,7 +73,9 @@ function _countPrFollowups(pr) {
   var prId = pr.id || '';
   var n = 0;
   for (var i = 0; i < wis.length; i++) {
-    var f = wis[i] && wis[i].meta && wis[i].meta.pr_followup;
+    var wi = wis[i];
+    if (!wi || _WI_TERMINAL.has(wi.status)) continue;
+    var f = wi.meta && wi.meta.pr_followup;
     if (!f) continue;
     if (prUrl && f.parent_pr_url === prUrl) { n++; continue; }
     if (prId && f.parent_pr_id === prId) { n++; }
@@ -114,7 +120,7 @@ function prRow(pr) {
     : '';
   var followupCount = _countPrFollowups(pr);
   var followupChip = followupCount > 0
-    ? ' <span class="pr-badge draft" style="font-size:var(--text-xs)" title="' + followupCount + ' follow-up work item(s) dispatched from comments on this PR">+' + followupCount + ' follow-up' + (followupCount === 1 ? '' : 's') + '</span>'
+    ? ' <span class="pr-badge draft" style="font-size:var(--text-xs)" title="' + followupCount + ' active follow-up work item(s) in progress from comments on this PR">+' + followupCount + ' follow-up' + (followupCount === 1 ? '' : 's') + '</span>'
     : '';
   // Issue #2969 — paused-cause chip(s). Prefer the API-enriched _pausedCauses
   // field; fall back to deriving from _noOpFixes for the /state/ disk-fetch
@@ -542,7 +548,7 @@ async function _submitLinkPr(e) {
   try {
     const res = await fetch('/api/pull-requests/link', {
       method: 'POST', headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ url, title, project, context, autoObserve })
+      body: JSON.stringify({ url, title, project, context, contextOnly: !autoObserve })
     });
     const data = await res.json();
     if (res.ok) {

package/dashboard/js/utils.js

@@ -537,7 +537,8 @@ function _renderMdCore(s) {
   html = html.replace(/~~(.+?)~~/g, '<s>$1</s>');
   html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, function(_, text, href) {
     if (/^(javascript|data|vbscript):/i.test(href)) return text;
-    return '<a href="' + href + '" target="_blank" rel="noopener" style="color:var(--blue)">' + text + '</a>';
+    var safeHref = href.replace(/&quot;/g, '%22');
+    return '<a href="' + safeHref + '" target="_blank" rel="noopener" style="color:var(--blue)">' + text + '</a>';
   });
 
   // 3. Block-level processing (line by line)

package/dashboard/slim/js/link-pr.js

@@ -46,7 +46,7 @@
       var res = await fetch('/api/pull-requests/link', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ url: url, title: title, project: project, context: context, autoObserve: autoObserve }),
+        body: JSON.stringify({ url: url, title: title, project: project, context: context, contextOnly: !autoObserve }),
       });
       var data = await res.json().catch(function() { return {}; });
       if (res.ok) {

package/dashboard.js

@@ -5,6 +5,16 @@
  * Opens: http://localhost:7331
  */
 
+// Enlarge the libuv thread pool (default 4) BEFORE any async fs/crypto op
+// initializes it. The dashboard fans out many concurrent filesystem reads —
+// the worst being the knowledge-base scan (~thousands of files) — and with
+// only 4 pool threads a single fs-heavy burst monopolizes the pool and starves
+// every other fs-dependent request (including the /api/status poll that drives
+// the "Dashboard unreachable — stale" banner). 16 gives headroom without
+// meaningful memory cost. Respect an operator override if already set.
+// (Load-reduction audit 2026-06-24.)
+if (!process.env.UV_THREADPOOL_SIZE) process.env.UV_THREADPOOL_SIZE = '16';
+
 // Install ISO timestamp prefixes on console.{log,info,warn,error} so the
 // post-mortem in engine/dashboard-stdio.log is diagnosable to the second.
 // Must run BEFORE any other require that might log during module init.
@@ -1335,6 +1345,15 @@ function _scanProjectLocalHarnessFootgun(project) {
     footgunWarning: _PROJECT_LOCAL_FOOTGUN_WARNING,
   };
   if (!project || !project.localPath) return out;
+  // Skip the synchronous `git status` for UNC / WSL-from-Windows paths
+  // (\\wsl.localhost\..., \\wsl$\..., or any \\server\share). git/stat over a
+  // WSL UNC mount can hang for minutes; even capped at the 10s timeout below it
+  // hard-blocks the dashboard event loop on every poll, freezing the whole
+  // dashboard. Such projects can't carry uncommitted project-local harness
+  // assets the engine would propagate anyway, so returning the empty shell here
+  // is correct, not lossy. (Load-reduction audit 2026-06-24.)
+  const _lp = String(project.localPath);
+  if (_lp.startsWith('\\\\') || _lp.startsWith('//')) return out;
   let raw = '';
   try {
     const { execFileSync } = require('child_process');
@@ -1397,7 +1416,28 @@ function _scanProjectLocalHarnessFootgun(project) {
   return out;
 }
 
+// TTL cache for the harness diagnostic. The build runs a synchronous `git
+// status` + directory walks per project; the Tools page polls it while open,
+// so without a cache it re-runs the whole sweep every 4s and blocks the event
+// loop each time. The diagnostic is rare-change, so a short TTL is ample.
+// Bypassed whenever explicit opts are supplied (unit tests pass homeDir/
+// projects/engineConfig) so test determinism is unaffected.
+// (Load-reduction audit 2026-06-24.)
+let _harnessDiagCache = null;
+let _harnessDiagCacheTs = 0;
+const _HARNESS_DIAG_TTL_MS = 20000;
+
 function _buildHarnessDiagnostics(opts = {}) {
+  const _useCache = !opts || Object.keys(opts).length === 0;
+  if (_useCache && _harnessDiagCache && (Date.now() - _harnessDiagCacheTs) < _HARNESS_DIAG_TTL_MS) {
+    return _harnessDiagCache;
+  }
+  const out = _buildHarnessDiagnosticsUncached(opts);
+  if (_useCache) { _harnessDiagCache = out; _harnessDiagCacheTs = Date.now(); }
+  return out;
+}
+
+function _buildHarnessDiagnosticsUncached(opts = {}) {
   const homeDir = opts.homeDir || os.homedir();
   const engineConfig = opts.engineConfig || (CONFIG && CONFIG.engine) || {};
   const projects = (opts.projects || PROJECTS || []).filter(
@@ -7502,7 +7542,7 @@ const server = http.createServer(async (req, res) => {
         if (isJson) {
           try {
             const plan = JSON.parse(content);
-            const status = plan.status || 'active';
+            const status = plan.status || (plan.requires_approval && !plan.approvedAt ? 'awaiting-approval' : 'active');
             // W-mqacrzis0003df4a Bug 2 — fresh staleness from plans/*.md mtime.
             // plan.planStale lags by an engine tick; stat the source plan here
             // so the Plans tab does not silently mirror a stale-but-cached false.

package/docs/deprecated.json

@@ -110,41 +110,6 @@
     "targetRemovalDate": "2026-08-03",
     "notes": "Introduced by W-mq03l6zh0006f0a1 (Per-org ADO throttle isolation). 60-day window (2 release cycles + buffer) gives the in-flight per-org migration time to land + observe per-org keys on the diagnostics endpoint. Observable live at GET /api/diagnostics/ado-throttle — the endpoint reports a single `global` key while the arg-less shim is still load-bearing, and per-org `<orgBase>` keys once isolation is complete; that key shape is the human-readable signal for whether this shim can retire."
   },
-  {
-    "id": "pr-record-contextOnly-underscore-alias",
-    "description": "Legacy `pr._contextOnly` field on PR records (engine/<scope>/pull-requests.json + SQL). Renamed to canonical `pr.contextOnly` by the W-mq5s5ttx000j7ab8 PR-gate consolidation. The write side is already gone: normalizePrRecord DELETES `_contextOnly` once canonical `contextOnly` is present, and dashboard.js no longer references the alias at all. What survives is a READ-BRIDGE ONLY — code still reads `_contextOnly === true` as a fallback for pre-migration / raw on-disk records, and a one-shot boot migration copies the alias onto canonical `contextOnly` and deletes it.",
-    "code": [
-      { "file": "engine/shared.js", "note": "normalizePrRecord deletes `_contextOnly` when canonical `contextOnly` is present (engine/shared.js:6502-6507); the linkPr path deletes it after reading (:6716); the boot migration migratePrGateFlags deletes it (:6868-6870). The only surviving reads are legacy fallbacks: `pr._contextOnly === true` at :6555, :6713, :6759." },
-      { "file": "dashboard.js", "note": "Zero `_contextOnly` references — neither GET /api/pull-requests nor any observe/link handler writes or shapes the alias." },
-      { "file": "engine.js", "note": "discoverFromPrs reads canonical `pr.contextOnly` only." }
-    ],
-    "deprecated": "2026-06-08",
-    "targetRemovalDate": "2026-06-25",
-    "notes": "The write side already shipped out — there is no dual-write to retire. What remains is the read-fallback (`_contextOnly === true`) plus the one-shot boot migration migratePrGateFlags (engine/shared.js:6833) that copies + deletes the alias from any pre-migration on-disk record. Pair this entry's removal with `pr-record-autoObserve-underscore-alias`, `pr-record-manual-underscore-alias`, and `pr-link-autoObserve-body-param` — they share the same boot migration. Removal scope (DEFERRED — gated on a positive signal that every live pull-requests.json has been swept of underscore keys, not on the expired calendar date): delete the `_contextOnly` read-fallback in engine/shared.js and the migratePrGateFlags handling of it. On-disk sweep confirmed CLEAN on 2026-06-18: grep of every live projects/*/pull-requests.json (budget-test-project, constellation, minions-opg, office-bohemia) for the `_contextOnly`/`_autoObserve`/`_manual` record keys returned zero matches, so the deferral gate is now cleared and a deliberate, human-reviewed code removal can be scheduled (this calendar bump 2026-06-16 → 2026-06-25 is the docs-only consistency half; the MEDIUM/>3-file code removal stays a separate PR)."
-  },
-  {
-    "id": "pr-record-autoObserve-underscore-alias",
-    "description": "Legacy `pr._autoObserve` boolean on PR records. Was one of the clauses in the old `isAutoManagedPrRecord` check; replaced by the canonical `pr.contextOnly` field (foreign-author PRs linked with `autoObserve: true` now land with `contextOnly: false` directly). The write side is already gone — normalizePrRecord and the boot migration DELETE `_autoObserve`, and dashboard.js never writes it. What survives is a READ-BRIDGE ONLY: `_prRecordIsLegacyManaged` still reads `record._autoObserve === true` as a fallback when canonical `contextOnly` is absent on a pre-migration record.",
-    "code": [
-      { "file": "engine/shared.js", "note": "normalizePrRecord deletes `_autoObserve` (engine/shared.js:6502-6507); the linkPr path deletes it (:6764); migratePrGateFlags deletes it (:6868). The only surviving read is the legacy-managed fallback `record._autoObserve === true` in _prRecordIsLegacyManaged (:6823)." },
-      { "file": "dashboard.js", "note": "Zero `_autoObserve` references — link/observe handlers accept the canonical `contextOnly` body param and write no underscore alias onto the record." }
-    ],
-    "deprecated": "2026-06-08",
-    "targetRemovalDate": "2026-06-25",
-    "notes": "The write side already shipped out — there is no dual-write to retire. Removal is paired with `pr-record-contextOnly-underscore-alias` — same boot migration, same read-bridge. Removal scope (DEFERRED — gated on a sweep confirming no live record retains `_autoObserve`, not on the expired calendar date): delete the `_autoObserve === true` read in _prRecordIsLegacyManaged (engine/shared.js:6823) and the migratePrGateFlags handling of it. On-disk sweep confirmed CLEAN on 2026-06-18: grep of every live projects/*/pull-requests.json (budget-test-project, constellation, minions-opg, office-bohemia) for the `_contextOnly`/`_autoObserve`/`_manual` record keys returned zero matches, so the deferral gate is now cleared and a deliberate, human-reviewed code removal can be scheduled (this calendar bump 2026-06-16 → 2026-06-25 is the docs-only consistency half; the MEDIUM/>3-file code removal stays a separate PR)."
-  },
-  {
-    "id": "pr-record-manual-underscore-alias",
-    "description": "Legacy `pr._manual` boolean on PR records (set by older `POST /api/pull-requests/link` writes to mark manually-linked PRs). Was the third clause in the old `isAutoManagedPrRecord` check (`pr._manual && !pr._contextOnly` → auto-managed). Post-consolidation, the dispatch gate reads only `pr.contextOnly`. The write side is already gone — normalizePrRecord and the boot migration DELETE `_manual`, and dashboard.js never writes it. The alias survives only as data on pre-migration on-disk records that the boot migration sweeps away.",
-    "code": [
-      { "file": "engine.js", "note": "discoverFromPrs reads canonical `pr.contextOnly` only — `_manual` is no longer read." },
-      { "file": "engine/shared.js", "note": "normalizePrRecord deletes `_manual` (engine/shared.js:6502-6507); the linkPr path deletes it (:6765); migratePrGateFlags deletes it (:6869). No code reads `_manual` for dispatch decisions." },
-      { "file": "dashboard.js", "note": "Zero `_manual` references — the link handler no longer writes the provenance alias onto the record." }
-    ],
-    "deprecated": "2026-06-08",
-    "targetRemovalDate": "2026-06-25",
-    "notes": "Disambiguation: this entry covers ONLY the PR-record `_manual` flag (engine/<scope>/pull-requests.json). Other `_manual`-named flags elsewhere in the engine (work items, dispatch records, etc.) are NOT covered by this entry and remain in active use. The write side already shipped out — there is no write site or dashboard badge left to remove. Removal scope (DEFERRED — gated on a sweep confirming no live record retains `_manual`, not on the expired calendar date): drop the `_manual` handling in normalizePrRecord and migratePrGateFlags (engine/shared.js) once the on-disk sweep is confirmed. On-disk sweep confirmed CLEAN on 2026-06-18: grep of every live projects/*/pull-requests.json (budget-test-project, constellation, minions-opg, office-bohemia) for the `_contextOnly`/`_autoObserve`/`_manual` record keys returned zero matches, so the deferral gate is now cleared and a deliberate, human-reviewed code removal can be scheduled (this calendar bump 2026-06-16 → 2026-06-25 is the docs-only consistency half; the MEDIUM/>3-file code removal stays a separate PR)."
-  },
   {
     "id": "pr-link-autoObserve-body-param",
     "description": "Legacy `autoObserve` body parameter on `POST /api/pull-requests/link`. Replaced by canonical `contextOnly` body param (inverse boolean: `autoObserve: false` ⇔ `contextOnly: true`). This is a READ-BRIDGE on the input side only — the handler reads `body.contextOnly` first and falls back to `!body.autoObserve` for callers not yet migrated. No underscore alias is written onto the record (the record-field aliases already shipped out — see the three paired entries); the only thing kept alive is the input fallback.",
@@ -176,5 +141,15 @@
     "deprecated": "2026-06-08",
     "targetRemovalDate": null,
     "notes": "targetRemovalDate intentionally null — unlike the record-field aliases (`_contextOnly`, `_autoObserve`, `_manual`) which carry a 7-day clock, the `observe` body param is documented as a longer-lived back-compat alias. Set targetRemovalDate to a concrete future date once the dashboard UI + any client scripts are confirmed to POST `contextOnly` exclusively. Removal scope when the date is set: drop the `body.observe` fallback in dashboard.js, drop `observe` from the route registry params, and update any client still POSTing `observe`."
+  },
+  {
+    "id": "discover-review-skills-shim",
+    "description": "engine/discover-review-skills.js is a 25-line re-export shim for engine/discover-project-skills.js. Zero production callers; only test files (discover-review-skills.test.js, discover-project-skills.test.js:706) reference it.",
+    "addedDate": "2026-06-24",
+    "targetRemovalDate": "2026-09-01",
+    "removalGate": "No external callers import discover-review-skills.js; test files updated to import from discover-project-skills.js directly.",
+    "removalScope": "Delete engine/discover-review-skills.js, delete test/unit/discover-review-skills.test.js, update test/unit/discover-project-skills.test.js:706 to import from discover-project-skills.js.",
+    "autoRemoveSafe": false,
+    "notes": "gate: zero test references to discover-review-skills; must update tests to point to discover-project-skills.js before file can be deleted"
   }
 ]

package/docs/pr-auto-fix-dispatch.md

@@ -24,6 +24,8 @@ Each PR carries a `repoHost` (`github` / `ado`). Before evaluating any of the si
 - GitHub PRs honor `ghPollEnabled` (legacy macro) and the new granular `ghPrStatusPollEnabled` / `ghPrCommentsPollEnabled` / `ghPrReconcileEnabled`.
 - ADO PRs honor `adoPollEnabled` and `adoPrStatusPollEnabled` / `adoPrCommentsPollEnabled` / `adoPrReconcileEnabled`.
 
+> **UI-saved configs always carry the granular keys.** The dashboard Settings save (`dashboard/js/settings.js`) persists all seven granular poll keys on every save, so any `config.json` written through the UI always includes them. The `resolvePollFlag` legacy-macro fallback (which falls back to `{ado,gh}PollEnabled` when a granular key is absent) therefore applies only to hand-edited or legacy configs that omit the granular keys.
+
 When the provider's status poll is off, the cached `buildStatus` / `reviewStatus` / `_mergeConflict` won't refresh — but `discoverFromPrs` still runs against the **last known cache** unless `pollingPaused` is also set, which forces `pollEnabled=false` and makes every per-PR auto-dispatch gate inert.
 
 See [`docs/auto-discovery.md`](auto-discovery.md) → "Granular per-poller flags" for the full polling-side table and the resolution order.

package/engine/ado-git-auth.js

@@ -210,7 +210,8 @@ function isAdoAuthFailure(err) {
 
 function _redactBearer(s) {
   if (typeof s !== 'string') return s;
-  return s.replace(/Authorization:\s*Bearer\s+[A-Za-z0-9._\-]+/gi, 'Authorization: Bearer [REDACTED]');
+  // W-mqrb8okm — include +/= so base64-padded ADO tokens are fully redacted
+  return s.replace(/Authorization:\s*Bearer\s+[A-Za-z0-9+/=._\-]+/gi, 'Authorization: Bearer [REDACTED]');
 }
 
 function _redactErrorInPlace(err) {

package/engine/ado.js

@@ -1207,22 +1207,28 @@ async function forEachActivePr(config, token, callback) {
   //   3. The repo-host filter is explicit (repoHost === 'ado') so a future
   //      central poll that loops over both forks doesn't accidentally treat
   //      github PRs as ADO records.
-  //   4. Already-configured PRs are skipped (isPrCompatibleWithProject against
-  //      any configured ADO project) so we never double-poll PRs that the
-  //      project loop above already handled.
+  //   4. Already-configured PRs are skipped only when they are actually present
+  //      in that project's per-project file, so the project loop will really see
+  //      them. Blindly skipping all project-compatible IDs caused a permanent
+  //      orphan when the record lived in the central file (#328).
   const centralPath = path.join(shared.MINIONS_DIR, 'pull-requests.json');
   const centralPrs = shared.safeJsonArr(centralPath);
   const configuredAdoProjects = projects.filter(p => !isGitHubProject(p) && p.adoOrg && p.adoProject);
-  const isConfiguredAdoCanonical = (canonicalId) => {
-    if (!canonicalId) return false;
-    return configuredAdoProjects.some(p => shared.isPrCompatibleWithProject(p, { id: canonicalId }, ''));
-  };
 
   const activeCentral = centralPrs.filter(pr => {
     if (!shared.PR_POLLABLE_STATUSES.has(pr.status)) return false;
     if (String(pr.repoHost || 'ado').toLowerCase() !== 'ado') return false;
     if (!parseCanonicalAdoPrId(pr.id, 'central ADO PR poll')) return false;
-    if (isConfiguredAdoCanonical(pr.id)) return false;
+    // Only defer to the project loop when the PR is ACTUALLY present in that
+    // project's per-project file. Unconditionally skipping all project-compatible
+    // PRs caused a permanent orphan: the project loop never read the central file,
+    // so a PR stored centrally but compatible with a configured project was never
+    // polled (fix for #328).
+    const owningProject = configuredAdoProjects.find(p => shared.isPrCompatibleWithProject(p, { id: pr.id }, ''));
+    if (owningProject) {
+      const projectPrs = shared.safeJsonArr(shared.projectPrPath(owningProject));
+      if (projectPrs.some(p => p.id === pr.id)) return false; // present in per-project file → project loop handles it
+    }
     return true;
   });
 

package/engine/check-status.js

@@ -1,6 +1,7 @@
 const fs = require('fs');
 const path = require('path');
 const dir = path.resolve(__dirname, '..');
+const { safeJson, MINIONS_DIR } = require('./shared');
 
 console.log('=== Work Items (non-done) ===');
 let items = [];
@@ -11,9 +12,16 @@ items.filter(i => i.status !== 'done').forEach(i => {
 
 console.log('\n=== Agent Status (derived from dispatch) ===');
 const { getAgentStatus } = require('./queries');
-for (const a of ['ripley', 'dallas', 'lambert', 'rebecca', 'ralph']) {
-  const s = getAgentStatus(a);
-  console.log(a.padEnd(10), s.status.padEnd(10), (s.task || '-').slice(0, 60));
+let config = {};
+try { config = safeJson(path.join(MINIONS_DIR, 'config.json')) || {}; } catch {}
+const agents = Object.keys(config.agents || {});
+if (agents.length === 0) {
+  console.log('(no agents configured)');
+} else {
+  for (const a of agents) {
+    const s = getAgentStatus(a);
+    console.log(a.padEnd(10), s.status.padEnd(10), (s.task || '-').slice(0, 60));
+  }
 }
 
 console.log('\n=== Inbox ===');

package/engine/cli.js

@@ -609,21 +609,6 @@ const commands = {
     try { shared.applyLegacyCcModelMigration(config, { logger: e.log }); }
     catch (err) { e.log('warn', `legacy ccModel migration failed: ${err.message}`); }
 
-    // W-mq5s5ttx000j7ab8-a — One-shot canonical-gate migration. Project the
-    // legacy `_contextOnly` / `_autoObserve` / `_manual` keys onto the
-    // canonical `contextOnly` field on every `projects/<name>/pull-
-    // requests.json` record BEFORE the first tick fires. `isAutoManagedPrRecord`
-    // now reads `contextOnly` only, so any record the migration doesn't reach
-    // before tick #1 would flip its auto-managed verdict. Idempotent.
-    try {
-      const projectsRoot = path.join(shared.MINIONS_DIR, 'projects');
-      // W-mqil3jtw — pass the configured agent roster so the migration
-      // cross-checks `agent` against real agent ids instead of a shape regex;
-      // a GitHub author login (e.g. `calebt_microsoft`) must not be mistaken
-      // for a managed persona and flip a context-only PR's observe toggle.
-      shared.migratePrGateFlags(projectsRoot, { config });
-    } catch (err) { e.log('warn', `pr-gate-migration failed: ${err.message}`); }
-
     // One-time force-on of the CC worker pool. The pool has been the resolved
     // default for copilot CC since PR #2492, but configs still carrying an
     // explicit `ccUseWorkerPool: false` (set before the default flipped) stay

package/engine/dispatch.js

@@ -19,10 +19,10 @@ const { getConfig, INBOX_DIR } = queries;
 const MINIONS_DIR = shared.MINIONS_DIR;
 
 // Dispatch types that do not push code to a PR branch. These remain dispatchable
-// against `_contextOnly: true` PRs because casting a review vote, posting a
+// against context-only PRs because casting a review vote, posting a
 // comment, asking a question, or running a read-only explore never mutates the
 // PR's source branch. Auto-discovery (engine.js#discoverFromPrs) is still
-// gated on `_contextOnly` separately — only explicit WIs (dashboard, watches,
+// gated on `contextOnly` separately — only explicit WIs (dashboard, watches,
 // CC) can target a context-only PR, and only via these types.
 const NON_MUTATING_DISPATCH_TYPES = new Set([
   WORK_TYPE.REVIEW,
@@ -30,6 +30,19 @@ const NON_MUTATING_DISPATCH_TYPES = new Set([
   WORK_TYPE.EXPLORE,
 ]);
 
+// Dispatch types that push code directly onto the PR's source branch. Only for
+// these does a branch mismatch (dispatch queued against old branch; PR since
+// rebased) signal a genuinely stale entry.
+//
+// implement / implement_large attach a targetPr for read-only context while
+// working on their own new branch. Comparing that work branch to the tracked
+// PR source branch always differs and causes phantom auto-cancellation (#369).
+const PR_BRANCH_TARGETED_TYPES = new Set([
+  WORK_TYPE.FIX,
+  WORK_TYPE.VERIFY,
+  WORK_TYPE.DECOMPOSE,
+]);
+
 // Lazy require to break circular dependency with engine.js
 let _lifecycle = null;
 function lifecycle() { if (!_lifecycle) _lifecycle = require('./lifecycle'); return _lifecycle; }
@@ -438,7 +451,9 @@ function getStalePrDispatchReason(entry, config) {
 
   const queuedBranch = entry.meta.branch || entry.meta.pr?.branch || '';
   const trackedBranch = tracked.branch || '';
-  if (queuedBranch && trackedBranch && shared.sanitizeBranch(queuedBranch) !== shared.sanitizeBranch(trackedBranch)) {
+  if (PR_BRANCH_TARGETED_TYPES.has(entry.type)
+      && queuedBranch && trackedBranch
+      && shared.sanitizeBranch(queuedBranch) !== shared.sanitizeBranch(trackedBranch)) {
     return `PR ${tracked.id || prLabel} branch changed from ${queuedBranch} to ${trackedBranch}`;
   }
 
@@ -602,6 +617,9 @@ function writeFailedAgentReport(item, reason, resultSummary, failureClass) {
     log('warn', 'Cannot write failed agent report without dispatch id');
     return;
   }
+  // W-mqrb8okm — redact bearer tokens before writing to inbox notes
+  const safeReason = reason ? shared.redactSecrets(reason) : reason;
+  const safeSummary = resultSummary ? shared.redactSecrets(resultSummary) : resultSummary;
   const agentId = item.agent || 'engine';
   const itemId = item.meta?.item?.id || '';
   const title = item.meta?.item?.title || item.task || item.id;
@@ -620,9 +638,9 @@ function writeFailedAgentReport(item, reason, resultSummary, failureClass) {
     `**Type:** ${item.type || 'unknown'}`,
     `**Result:** ${DISPATCH_RESULT.ERROR}`,
     failureClass ? `**Failure Class:** ${failureClass}` : '',
-    reason ? `**Reason:** ${reason}` : '',
+    safeReason ? `**Reason:** ${safeReason}` : '',
     '',
-    resultSummary ? `## Summary\n${resultSummary}` : '## Summary\n(no agent summary captured)',
+    safeSummary ? `## Summary\n${safeSummary}` : '## Summary\n(no agent summary captured)',
   ].filter(Boolean).join('\n');
   shared.writeToInbox(agentId, `agent-failure-${item.id}`, content, null, metadata);
 }
@@ -1164,4 +1182,6 @@ module.exports = {
   isCompletedWorkItemForFailure,
   _isPrdSourcedAndVetted,
   NON_MUTATING_DISPATCH_TYPES,
+  PR_BRANCH_TARGETED_TYPES,
+  writeFailedAgentReport,
 };

package/engine/github.js

@@ -594,7 +594,25 @@ async function forEachActiveGhPr(config, callback) {
   // Also poll manually-linked PRs from central pull-requests.json (extract slug from URL)
   const centralPath = path.join(MINIONS_DIR, 'pull-requests.json');
   const centralPrs = safeJsonArr(centralPath);
-  const activeCentral = centralPrs.filter(pr => PR_POLLABLE_STATUSES.has(pr.status) && pr.url);
+  // Build a slug→project map for configured GitHub projects so we can detect
+  // PRs that are actually owned by the project loop (present in per-project file).
+  const configuredGhProjectsBySlug = new Map(projects.map(p => [getRepoSlug(p), p]));
+  const activeCentral = centralPrs.filter(pr => {
+    if (!PR_POLLABLE_STATUSES.has(pr.status)) return false;
+    if (!pr.url) return false;
+    // Symmetric fix for #328: only defer to the project loop when the PR is
+    // ACTUALLY present in that project's per-project file. If it's absent there,
+    // the project loop will never see it — the central branch must poll it.
+    const ghMatch = pr.url.match(/github\.com\/([^/]+\/[^/]+)\/pull\/\d+/);
+    if (ghMatch) {
+      const owningProject = configuredGhProjectsBySlug.get(ghMatch[1]);
+      if (owningProject) {
+        const projectPrs = safeJsonArr(projectPrPath(owningProject));
+        if (projectPrs.some(p => p.id === pr.id)) return false; // present → project loop handles it
+      }
+    }
+    return true;
+  });
 
   // W-mp5trwh60008386d: probe each unique slug in the central list ONCE before iterating PRs.
   // Without this gate, central PRs would inherit the same per-PR 404 trapdoor that project-local

package/engine/lifecycle.js

@@ -720,7 +720,8 @@ function updateWorkItemStatus(meta, status, reason) {
           delete target._noopReason;
         }
       } else if (status === WI_STATUS.FAILED) {
-        if (reason) target.failReason = reason;
+        // W-mqrb8okm — redact bearer tokens from reason before persisting as failReason
+        if (reason) target.failReason = shared.redactSecrets(reason);
         target.failedAt = ts();
       }
     }
@@ -1122,7 +1123,7 @@ function syncPrsFromOutput(output, agentId, meta, config, opts = {}) {
 //
 // `enrollPrFromCanonicalId` is the write-side fix: given a canonical PR id and
 // the owning project, fetch live state from GitHub (or ADO, best-effort) and
-// insert a `_contextOnly: true` row into the project's `pull-requests.json`.
+// insert a `contextOnly: true` row into the project's `pull-requests.json`.
 // Idempotent — no-op if a record already exists. Always marks the record as
 // context-only so the engine doesn't try to re-dispatch fix/review loops on
 // an already-merged PR (matches the #1772 enrollment-flag semantics).
@@ -1704,12 +1705,47 @@ function markMissingPrAttachment(meta, agentId, reason, resultSummary, severity,
   let phantomRetryDeferred = false;
   let phantomRetryExhausted = false;
   let phantomRetryCount = 0;
+  let systematicPhantomFired = false;
   if (isHard && isPhantom && noPrWiPath) {
     mutateJsonFileLocked(noPrWiPath, data => {
       if (!Array.isArray(data)) return data;
       const w = data.find(i => i.id === meta.item.id);
       if (!w) return data;
       const phantomRetries = w._phantomRetryCount || 0;
+
+      // W-mqsh4d95000fb753 — mirror the _phantomAgents tracking that
+      // _deferRetryWithCounter performs. Without this, the systematic phantom
+      // detector (≥2 distinct agents all phantom-complete the same item) never
+      // fires through this path because _phantomAgents stays empty {}.
+      if (!w._phantomAgents || typeof w._phantomAgents !== 'object' || Array.isArray(w._phantomAgents)) {
+        w._phantomAgents = {};
+      }
+      if (agentId) {
+        w._phantomAgents[agentId] = (w._phantomAgents[agentId] || 0) + 1;
+      }
+      const distinctPhantomAgents = Object.keys(w._phantomAgents);
+      if (distinctPhantomAgents.length >= 2 && phantomRetries >= 1) {
+        w.status = WI_STATUS.FAILED;
+        w.failReason = `Systematic phantom completion across ${distinctPhantomAgents.length} agents ` +
+          `(${distinctPhantomAgents.join(', ')}) — likely a content filter triggered by the task description ` +
+          `or a malformed prompt. Manual intervention required.`;
+        w._failureClass = 'phantom-all-agents';
+        w.failedAt = ts();
+        delete w.completedAt;
+        delete w.dispatched_at;
+        delete w.dispatched_to;
+        delete w._pendingReason;
+        delete w._phantomCompletion;
+        delete w._phantomBranch;
+        delete w._missingPrAttachment;
+        phantomRetryExhausted = true;
+        phantomRetryCount = phantomRetries;
+        systematicPhantomFired = true;
+        log('warn', `Work item ${meta.item.id} systematically phantoms across ${distinctPhantomAgents.length} agents ` +
+          `(${distinctPhantomAgents.join(', ')}) — marking non-retryable (phantom-all-agents)`);
+        return data;
+      }
+
       if (phantomRetries < ENGINE_DEFAULTS.maxPhantomRetries) {
         w.status = WI_STATUS.PENDING;
         w._phantomRetryCount = phantomRetries + 1;
@@ -1758,6 +1794,14 @@ function markMissingPrAttachment(meta, agentId, reason, resultSummary, severity,
       }
       return;
     }
+    if (systematicPhantomFired) {
+      // Already hard-failed with phantom-all-agents inside mutateJsonFileLocked;
+      // skip the generic hard-fail path below to preserve the correct failReason.
+      if (meta.item?.sourcePlan) {
+        try { syncPrdItemStatus(meta.item.id, WI_STATUS.FAILED, meta.item.sourcePlan); } catch (e) { log('warn', 'phantom-all-agents PRD sync: ' + e.message); }
+      }
+      return;
+    }
     if (phantomRetryExhausted) {
       // Fall through to the regular hard-fail path with augmented reason so
       // operators see "phantom retries exhausted" instead of the generic msg.
@@ -3401,9 +3445,7 @@ function createReviewFeedbackForAuthor(reviewerAgentId, pr, config, opts = {}) {
 function updateMetrics(agentId, dispatchItem, result, taskUsage, prsCreatedCount, model) {
   if (!agentId || agentId.startsWith('temp-') || agentId === 'agent1' || agentId === 'reviewer' || agentId.startsWith('_test')) return;
 
-  const metricsPath = path.join(ENGINE_DIR, 'metrics.json');
-  mutateJsonFileLocked(metricsPath, metrics => {
-    metrics = metrics || {};
+  shared.mutateMetrics(metrics => {
     if (!metrics[agentId]) {
       metrics[agentId] = { ...DEFAULT_AGENT_METRICS };
     }

package/engine/pipeline.js

@@ -714,12 +714,16 @@ async function executePlanStage(stage, stageState, run, config, pipeline = {}) {
 // `<endpoint>: <reason>` so updateRunStage records a terminal failure.
 async function executeApiStage(stage, stageState, run) {
   const calls = stage.calls || [{ endpoint: stage.endpoint, method: stage.method || 'POST', body: stage.body }];
+  if (!calls.length) {
+    return { status: PIPELINE_STATUS.FAILED, error: 'calls array is empty', completedAt: ts() };
+  }
   const maxAttempts = ENGINE_DEFAULTS.pipelineApiRetries;
   const retryDelay = ENGINE_DEFAULTS.pipelineApiRetryDelay;
   const timeoutMs = ENGINE_DEFAULTS.pipelineApiTimeoutMs;
 
   for (const call of calls) {
-    const url = `http://localhost:${process.env.MINIONS_PORT || 7331}${call.endpoint}`;
+    const port = shared.readDashboardPortFile(MINIONS_DIR)?.port || (process.env.MINIONS_PORT && parseInt(process.env.MINIONS_PORT, 10)) || 7331;
+    const url = `http://localhost:${port}${call.endpoint}`;
     const body = typeof call.body === 'string' ? call.body : JSON.stringify(call.body || {});
 
     const attemptOnce = (attempt) => new Promise((resolve) => {

package/engine/queries.js

@@ -1684,35 +1684,53 @@ async function _scanKnowledgeBase() {
   // ~30 large KB entries. `_flat()` materialises a fresh flat string via
   // Buffer round-trip so the cached entry no longer pins the parent file.
   const _flat = (s) => Buffer.from(String(s || ''), 'utf8').toString('utf8');
-  const entries = [];
+  // Build the full (category, file) work list first, THEN process it with a
+  // bounded concurrency window. The KB tree holds thousands of files; the old
+  // unbounded `Promise.all(files.map(...))` per category fired thousands of
+  // concurrent readFile+stat ops at once, flooding the (default-4, now 16)
+  // libuv thread pool and starving every other fs-dependent dashboard request
+  // — including the /api/status poll — for tens of seconds, which is what
+  // tripped the "stale / unreachable" banner. Capping in-flight reads keeps
+  // the scan from monopolizing the pool. (Load-reduction audit 2026-06-24.)
+  const work = [];
   for (const cat of KB_CATEGORIES) {
     const catDir = path.join(KNOWLEDGE_DIR, cat);
     const files = (await fsp.readdir(catDir).catch(() => [])).filter(f => f.endsWith('.md'));
-    const fileResults = await Promise.all(files.map(async f => {
-      const filePath = path.join(catDir, f);
-      const [content, stat] = await Promise.all([
-        fsp.readFile(filePath, 'utf8').catch(() => ''),
-        fsp.stat(filePath).catch(() => null),
-      ]);
-      const titleMatch = content.match(/^#\s+(.+)/m);
-      const title = _flat(titleMatch ? titleMatch[1].trim() : f.replace(/\.md$/, ''));
-      const agentMatch = f.match(/^\d{4}-\d{2}-\d{2}-(\w+)-/);
-      const dateMatch = f.match(/^(\d{4}-\d{2}-\d{2})/) || content.match(/^date:\s*(\d{4}-\d{2}-\d{2})$/m);
-      const sourceMatch = content.match(/^source:\s*(.+)/m);
-      const sortTs = (stat && stat.mtimeMs) || 0;
-      const displayDate = dateMatch ? _flat(dateMatch[1]) : (sortTs ? new Date(sortTs).toISOString().slice(0, 10) : '');
-      return {
-        cat, file: f, title,
-        agent: agentMatch ? agentMatch[1] : '',
-        date: displayDate,
-        sortTs,
-        source: _flat(sourceMatch ? sourceMatch[1].trim() : ''),
-        preview: _flat(content.slice(0, 200)),
-        size: content.length,
-      };
-    }));
-    entries.push(...fileResults);
-  }
+    for (const f of files) work.push({ cat, catDir, f });
+  }
+  const scanOne = async ({ cat, catDir, f }) => {
+    const filePath = path.join(catDir, f);
+    const [content, stat] = await Promise.all([
+      fsp.readFile(filePath, 'utf8').catch(() => ''),
+      fsp.stat(filePath).catch(() => null),
+    ]);
+    const titleMatch = content.match(/^#\s+(.+)/m);
+    const title = _flat(titleMatch ? titleMatch[1].trim() : f.replace(/\.md$/, ''));
+    const agentMatch = f.match(/^\d{4}-\d{2}-\d{2}-(\w+)-/);
+    const dateMatch = f.match(/^(\d{4}-\d{2}-\d{2})/) || content.match(/^date:\s*(\d{4}-\d{2}-\d{2})$/m);
+    const sourceMatch = content.match(/^source:\s*(.+)/m);
+    const sortTs = (stat && stat.mtimeMs) || 0;
+    const displayDate = dateMatch ? _flat(dateMatch[1]) : (sortTs ? new Date(sortTs).toISOString().slice(0, 10) : '');
+    return {
+      cat, file: f, title,
+      agent: agentMatch ? agentMatch[1] : '',
+      date: displayDate,
+      sortTs,
+      source: _flat(sourceMatch ? sourceMatch[1].trim() : ''),
+      preview: _flat(content.slice(0, 200)),
+      size: content.length,
+    };
+  };
+  const entries = [];
+  const KB_SCAN_CONCURRENCY = 16;
+  let _next = 0;
+  const worker = async () => {
+    while (_next < work.length) {
+      const idx = _next++;
+      entries.push(await scanOne(work[idx]));
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(KB_SCAN_CONCURRENCY, work.length) }, worker));
   entries.sort((a, b) =>
     (b.sortTs || 0) - (a.sortTs || 0) ||
     (b.date || '').localeCompare(a.date || '') ||

package/engine/scheduler.js

@@ -259,9 +259,9 @@ function parseCronExpr(expr) {
 
   return {
     matches(date) {
-      return minuteMatcher(date.getMinutes()) &&
-             hourMatcher(date.getHours()) &&
-             dowMatcher(date.getDay());
+      return minuteMatcher(date.getUTCMinutes()) &&
+             hourMatcher(date.getUTCHours()) &&
+             dowMatcher(date.getUTCDay());
     }
   };
 }
@@ -298,11 +298,11 @@ function shouldRunNow(schedule, lastRunAt) {
   if (lastRunAt) {
     const last = new Date(lastRunAt);
     if (!isNaN(last.getTime()) &&
-        last.getFullYear() === now.getFullYear() &&
-        last.getMonth() === now.getMonth() &&
-        last.getDate() === now.getDate() &&
-        last.getHours() === now.getHours() &&
-        last.getMinutes() === now.getMinutes()) {
+        last.getUTCFullYear() === now.getUTCFullYear() &&
+        last.getUTCMonth() === now.getUTCMonth() &&
+        last.getUTCDate() === now.getUTCDate() &&
+        last.getUTCHours() === now.getUTCHours() &&
+        last.getUTCMinutes() === now.getUTCMinutes()) {
       return false;
     }
   }

package/engine/shared.js

@@ -403,6 +403,19 @@ function _redactString(s, options = {}) {
     .replace(_JWT_RE, '[REDACTED_JWT]');
 }
 
+// W-mqrb8okm — Redact bearer tokens from git error.message / stdout / stderr
+// in-place. Called from shellSafeGit / shellSafeGitSync catch paths so that ADO
+// -c http.extraHeader=Authorization: Bearer TOKEN args embedded in the
+// "Command failed: git ..." error message are sanitised before the error
+// propagates to callers (who may store it as failReason / inbox notes).
+function _redactGitError(err) {
+  if (!err || typeof err !== 'object') return err;
+  if (err.message) err.message = _redactString(err.message);
+  if (typeof err.stdout === 'string') err.stdout = _redactString(err.stdout);
+  if (typeof err.stderr === 'string') err.stderr = _redactString(err.stderr);
+  return err;
+}
+
 function redactSecrets(value, options = {}) {
   if (value == null) return value;
   if (typeof value === 'string') return _redactString(value, options);
@@ -2342,17 +2355,27 @@ function shellSafeGit(args, opts = {}) {
   // can inject per-invocation `-c key=value` flags (e.g. ADO bearer-token
   // auth header) without rewriting every shellSafeGit call site. Strip the
   // key before delegating so it never reaches Node's execFile options.
-  const { timeout, gitExtraArgs, ...rest } = opts;
+  // W-mqrb8okm — `_execFileAsync` injection point for unit tests; production
+  // callers leave it unset so the module-level promisified execFile is used.
+  const { timeout, gitExtraArgs, _execFileAsync: _execFileOverride, ...rest } = opts;
   const finalArgs = (Array.isArray(gitExtraArgs) && gitExtraArgs.length > 0)
     ? [...gitExtraArgs, ...args]
     : args;
-  return _execFileAsync('git', finalArgs, {
+  const execFn = _execFileOverride || _execFileAsync;
+  return execFn('git', finalArgs, {
     windowsHide: true,
     encoding: 'utf8',
     shell: false,
     ...rest,
     timeout: timeout || 30000,
-  }).then(({ stdout }) => stdout);
+  }).then(({ stdout }) => stdout).catch(err => {
+    // W-mqrb8okm — Redact bearer tokens from git errors before they propagate.
+    // The "Command failed: git ..." message produced by Node's execFile includes
+    // every argv element, so -c http.extraHeader=Authorization: Bearer TOKEN
+    // would end up verbatim in failReason / inbox notes without this guard.
+    _redactGitError(err);
+    throw err;
+  });
 }
 
 // Sync argv-form helper for callers that aren't async (e.g. plan
@@ -2368,14 +2391,19 @@ function shellSafeGitSync(args, opts = {}) {
     ? [...gitExtraArgs, ...args]
     : args;
   const { execFileSync: _execFileSync } = require('child_process');
-  return _execFileSync('git', finalArgs, {
-    windowsHide: true,
-    encoding: 'utf8',
-    shell: false,
-    stdio: 'pipe',
-    ...rest,
-    timeout: timeout || 30000,
-  });
+  try {
+    return _execFileSync('git', finalArgs, {
+      windowsHide: true,
+      encoding: 'utf8',
+      shell: false,
+      stdio: 'pipe',
+      ...rest,
+      timeout: timeout || 30000,
+    });
+  } catch (err) {
+    // W-mqrb8okm — same bearer-token redaction as the async variant.
+    throw _redactGitError(err);
+  }
 }
 
 /**
@@ -3236,6 +3264,12 @@ function resolvePollFlag(engineCfg, granularKey, legacyMacroKey) {
   if (engineCfg && Object.prototype.hasOwnProperty.call(engineCfg, granularKey)) {
     return engineCfg[granularKey] !== false;
   }
+  // Legacy-macro path: reachable ONLY for hand-edited configs or pre-P-c4d8e1a3
+  // configs that set the provider-level macro (adoPollEnabled / ghPollEnabled)
+  // to false WITHOUT setting the granular key. The dashboard Settings save
+  // (dashboard/js/settings.js) always persists all seven granular keys, so
+  // UI-saved configs never reach this branch — but operator-edited config.json
+  // files that use the legacy macro still must work. Do NOT delete this branch.
   if (legacyMacroKey && engineCfg && engineCfg[legacyMacroKey] === false) {
     return false;
   }
@@ -6732,15 +6766,6 @@ function applyPrFieldDelta(target, before, after) {
 function normalizePrRecord(pr, project = null) {
   if (!pr || typeof pr !== 'object') return false;
   let changed = false;
-  const hasCanonicalContextOnly = Object.prototype.hasOwnProperty.call(pr, 'contextOnly');
-  if (hasCanonicalContextOnly) {
-    for (const legacyKey of ['_contextOnly', '_autoObserve', '_manual']) {
-      if (Object.prototype.hasOwnProperty.call(pr, legacyKey)) {
-        delete pr[legacyKey];
-        changed = true;
-      }
-    }
-  }
   const prNumber = getPrNumber(pr.prNumber ?? pr.id ?? pr.url);
   if (prNumber != null && pr.prNumber !== prNumber) {
     pr.prNumber = prNumber;
@@ -6779,15 +6804,13 @@ function normalizePrLinkItems(value) {
   return [...new Set(items.filter(item => typeof item === 'string' && item))];
 }
 
-// W-mq5s5ttx000j7ab8-a / W-mqerisvz000n3901 — canonical `contextOnly` gate
-// with a legacy bridge. Canonical `contextOnly` wins whenever it exists; legacy
-// `_contextOnly` is only a fallback for pre-migration/raw records. This keeps
-// observe toggles (`contextOnly:false`) from being overridden by stale legacy
-// contamination while still treating old context-only rows as reference-only.
+// Canonical `contextOnly` gate — reads only the canonical field.
+// All records are expected to carry `contextOnly` after the 2026-06-24
+// on-disk sweep confirmed no live `_contextOnly`/`_autoObserve`/`_manual`
+// keys remain (and the boot migration has been removed).
 function isContextOnlyPrRecord(pr) {
   if (!pr || typeof pr !== 'object') return false;
-  if (typeof pr.contextOnly === 'boolean') return pr.contextOnly;
-  return pr._contextOnly === true;
+  return pr.contextOnly === true;
 }
 
 function isAutoManagedPrRecord(pr) {
@@ -6943,12 +6966,17 @@ function upsertPullRequestRecord(prPath, entry, { project = null, itemId = null,
     prNumber: prNumber ?? entry.prNumber ?? null,
     prdItems: linkedItemIds,
   };
-  const normalizedEntryContextOnly = normalizedEntry.contextOnly != null
-    ? normalizedEntry.contextOnly
-    : normalizedEntry._contextOnly;
-  if (normalizedEntryContextOnly != null) {
-    normalizedEntry.contextOnly = normalizedEntryContextOnly === true;
-    delete normalizedEntry._contextOnly;
+  // Issue #348: backfill `project` from the project option when the entry
+  // doesn't carry one. The file path already encodes the project name (e.g.
+  // projects/<name>/pull-requests.json), so it is always deterministic.
+  // Without this, PRs linked via /api/pull-requests/link had project:null on
+  // the record, which broke any downstream path that reads pr.project to
+  // resolve the owning project.
+  if (project?.name != null && normalizedEntry.project == null) {
+    normalizedEntry.project = project.name;
+  }
+  if (normalizedEntry.contextOnly != null) {
+    normalizedEntry.contextOnly = normalizedEntry.contextOnly === true;
   }
 
   let created = false;
@@ -6970,34 +6998,18 @@ function upsertPullRequestRecord(prPath, entry, { project = null, itemId = null,
     } else {
       target.id = canonicalId;
       if (prNumber != null) target.prNumber = prNumber;
-      const targetWasAutoManaged = isAutoManagedPrRecord(target)
-        || (target.contextOnly == null && target._contextOnly === true && _prRecordIsLegacyManaged(target));
+      const targetWasAutoManaged = isAutoManagedPrRecord(target);
       for (const key of ['url', 'title', 'description', 'agent', 'branch', 'reviewStatus', 'status', 'created', 'sourcePlan', 'itemType']) {
         if (normalizedEntry[key] != null && normalizedEntry[key] !== '' && (target[key] == null || target[key] === '')) {
           target[key] = normalizedEntry[key];
         }
       }
-      // W-mq5s5ttx000j7ab8-a — `_manual` and `_autoObserve` are no longer
-      // copied through; the engine reads gate state from the canonical
-      // `contextOnly` field (see isAutoManagedPrRecord above + the boot
-      // migration migratePrGateFlags). `_context`/`_projectResolution` are
-      // unrelated breadcrumbs and stay.
       for (const key of ['_context', '_projectResolution']) {
         if (normalizedEntry[key] != null) target[key] = normalizedEntry[key];
       }
-      // Accept either the canonical `contextOnly` (preferred) or the legacy
-      // `_contextOnly` from callers that haven't been migrated yet
-      // (dashboard.js manual-link path, lifecycle.js oneShot tagging — items
-      // (b)/(c) of the decomposition). Persist as canonical `contextOnly`.
-      const incomingContextOnly = normalizedEntry.contextOnly != null
-        ? normalizedEntry.contextOnly
-        : normalizedEntry._contextOnly;
-      if (incomingContextOnly != null) {
-        const wouldDemoteManagedPr = incomingContextOnly === true && targetWasAutoManaged;
-        target.contextOnly = wouldDemoteManagedPr ? false : incomingContextOnly === true;
-        delete target._contextOnly;
-        delete target._autoObserve;
-        delete target._manual;
+      if (normalizedEntry.contextOnly != null) {
+        const wouldDemoteManagedPr = normalizedEntry.contextOnly === true && targetWasAutoManaged;
+        target.contextOnly = wouldDemoteManagedPr ? false : normalizedEntry.contextOnly === true;
       }
     }
     target.prdItems = normalizePrLinkItems(target.prdItems || []);
@@ -7020,142 +7032,6 @@ function upsertPullRequestRecord(prPath, entry, { project = null, itemId = null,
   return { id: canonicalId, prNumber, created, linked, skipped, record };
 }
 
-// ─── PR Gate Migration (W-mq5s5ttx000j7ab8-a) ───────────────────────────────
-//
-// One-shot boot migration that projects the legacy gate signals
-// (`_contextOnly`, `_autoObserve`, `_manual`) onto the canonical
-// `contextOnly` field on every `projects/<name>/pull-requests.json` record.
-// Wired from `engine/cli.js#start()` before the first tick fires so the new
-// `isAutoManagedPrRecord` (which only reads `contextOnly`) returns the same
-// verdict as the legacy 6-clause helper for pre-existing data.
-//
-// Per-record decision:
-//   1. contextOnly := (_contextOnly === true)
-//   2. legacyManaged := _autoObserve === true || sourcePlan || itemType ||
-//                       (agent is a *configured* Minions persona)
-//      "Configured Minions persona" = `agent` matches an id in
-//      `config.agents` (case-insensitive). The github poller writes the PR
-//      author's login into `agent` (from `prData.user.login`); human logins
-//      like `calebt_microsoft` are kebab/snake-shaped and previously passed a
-//      naive shape regex, mis-classifying a human PR as managed and flipping
-//      its observe toggle ON on the next boot (W-mqil3jtw). Cross-checking the
-//      real roster instead of a shape heuristic fixes that. A login that is
-//      not a configured agent id is treated as a human author.
-//      NOTE: `prdItems.length > 0` is intentionally NOT a managed signal in
-//      this migration. A watch can link a PR context-only AND spin off a
-//      courtesy-review WI whose id is stamped into `prdItems`; that stamp must
-//      not override the explicit context-only intent. Genuine managed PRs
-//      always carry a real signal above (configured agent / sourcePlan /
-//      itemType / _autoObserve), so dropping prdItems-alone is safe here.
-//   3. If !contextOnly && !legacyManaged, set contextOnly = true and stamp
-//      `_migrationNote: 'auto-set-contextOnly-by-pr-gate-simplification'`.
-//   4. Persist `contextOnly`; delete `_autoObserve`, `_manual`, `_contextOnly`.
-//
-// Idempotent: records that already have `contextOnly` and none of the legacy
-// keys are skipped (no rewrite, no log line, JSON mtime unchanged).
-const _PR_GATE_MIGRATION_NOTE = 'auto-set-contextOnly-by-pr-gate-simplification';
-const _AGENT_PERSONA_RE = /^[a-z0-9_-]+$/;
-
-function _prRecordHasLegacyGateKey(record) {
-  return Object.prototype.hasOwnProperty.call(record, '_contextOnly')
-    || Object.prototype.hasOwnProperty.call(record, '_autoObserve')
-    || Object.prototype.hasOwnProperty.call(record, '_manual');
-}
-
-// Resolve the configured agent roster (lower-cased Set) once per migration.
-// Accepts either an explicit `agentIds` (Set / array) or a `config` object
-// whose `agents` keys are the roster. Returns an empty Set when nothing is
-// supplied (no record can match a managed persona).
-// (Deliberately NOT queries.getAgents(config): that lives in queries.js — which
-// requires shared.js, so importing it here is circular — and it also reads
-// dispatch/inbox state. We only need the bare id set.)
-function _resolveConfiguredAgentIds(opts = {}) {
-  let ids = opts.agentIds;
-  if (ids == null && opts.config && opts.config.agents && typeof opts.config.agents === 'object') {
-    ids = Object.keys(opts.config.agents);
-  }
-  const source = ids instanceof Set ? [...ids] : (Array.isArray(ids) ? ids : []);
-  return new Set(source.map(id => String(id || '').trim().toLowerCase()).filter(Boolean));
-}
-
-// `agentIds` (a Set, supplied by the boot migration) switches this helper into
-// "roster mode": the `agent` field only counts as a managed signal when it is
-// an actually-configured agent id, and prdItems-alone is dropped (see the
-// migration header). Callers that can't cheaply resolve the roster (the
-// runtime upsert/link demotion-guard at the `_prRecordIsLegacyManaged(target)`
-// call site) pass no agentIds and keep the legacy shape-heuristic behavior.
-function _prRecordIsLegacyManaged(record, agentIds) {
-  const rosterMode = agentIds instanceof Set;
-  // prdItems-alone is a managed signal only in the legacy runtime path, not the
-  // boot migration (see header: courtesy-review watch contamination).
-  if (!rosterMode && Array.isArray(record.prdItems) && record.prdItems.length > 0) return true;
-  if (record._autoObserve === true) return true;
-  if (record.sourcePlan) return true;
-  if (record.itemType) return true;
-  if (typeof record.agent === 'string') {
-    const agent = record.agent.trim().toLowerCase();
-    if (agent && agent !== 'human') {
-      if (rosterMode ? agentIds.has(agent) : _AGENT_PERSONA_RE.test(agent)) return true;
-    }
-  }
-  return false;
-}
-
-function migratePrGateFlags(projectsRoot, opts = {}) {
-  const summary = { projectsScanned: 0, projectsMigrated: 0, totalRecords: 0, totalMigrated: 0 };
-  if (!projectsRoot || typeof projectsRoot !== 'string') return summary;
-  const agentIds = _resolveConfiguredAgentIds(opts);
-  let entries;
-  try {
-    entries = fs.readdirSync(projectsRoot, { withFileTypes: true });
-  } catch {
-    return summary;
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const projectName = entry.name;
-    const prPath = path.join(projectsRoot, projectName, 'pull-requests.json');
-    if (!fs.existsSync(prPath)) continue;
-    summary.projectsScanned++;
-
-    let migrated = 0;
-    let stamped = 0;
-    let alreadyMigrated = 0;
-
-    mutatePullRequests(prPath, (prs) => {
-      if (!Array.isArray(prs)) return prs;
-      for (const record of prs) {
-        if (!record || typeof record !== 'object') continue;
-        const hasLegacy = _prRecordHasLegacyGateKey(record);
-        const hasCanonical = Object.prototype.hasOwnProperty.call(record, 'contextOnly');
-        if (hasCanonical && !hasLegacy) { alreadyMigrated++; continue; }
-
-        let contextOnly = (record._contextOnly === true);
-        if (!contextOnly && !_prRecordIsLegacyManaged(record, agentIds)) {
-          contextOnly = true;
-          record._migrationNote = _PR_GATE_MIGRATION_NOTE;
-          stamped++;
-        }
-        record.contextOnly = contextOnly;
-        delete record._autoObserve;
-        delete record._manual;
-        delete record._contextOnly;
-        migrated++;
-      }
-      return prs;
-    });
-
-    summary.totalRecords += (migrated + alreadyMigrated);
-    summary.totalMigrated += migrated;
-    if (migrated > 0) {
-      summary.projectsMigrated++;
-      // One line per project that actually moved. Keep idempotent runs silent.
-      console.log(`[pr-gate-migration] ${projectName}: migrated ${migrated} records (${stamped} stamped contextOnly, ${alreadyMigrated} already-migrated)`);
-    }
-  }
-  return summary;
-}
-
 // ─── PR Reference → URL Derivation ───────────────────────────────────────────
 //
 // W-mq5wfh1v000e0da9 — Given a PR ref (URL, canonical `host:scope#N` id, or
@@ -9012,7 +8888,6 @@ module.exports = {
   isContextOnlyPrRecord,
   upsertPullRequestRecord,
   isAutoManagedPrRecord, // W-mq5s5ttx000j7ab8-a — exported for engine + watch-plugin gate consolidation
-  migratePrGateFlags, // W-mq5s5ttx000j7ab8-a — boot migration wired from engine/cli.js
   autoEnrollPrFromFixWorkItem,
   deriveUrlForPrRef, // exported for testing
   classifyPrRefForVerification, // issue #246 — host routing for loose PR-ref verification

package/engine/timeout.js

@@ -970,4 +970,6 @@ module.exports = {
   // exported for testing
   rememberDeferredSteering, checkDeferredStranded, _runSteeringKillLadder, _collectDescendantPids,
   _resetSteeringStoreCacheForTest, _setSteeringStoreForTest,
+  // exported for testing — steering clamp helpers and deferred checkpoint
+  _clampSteeringDeferredMaxMs, _clampSteeringMaxKillRetries, _appendLiveOutputLine, deferSteeringUntilCheckpoint,
 };

package/engine/watch-actions.js

@@ -604,7 +604,7 @@ registerActionType(WATCH_ACTION_TYPE.MINIONS_API, {
     if (!_ALLOWED_API_METHODS.has(method)) {
       return { ok: false, summary: `minions-api: unsupported method ${method} (allowed: ${[..._ALLOWED_API_METHODS].join(', ')})` };
     }
-    const port = process.env.MINIONS_PORT || 7331;
+    const port = shared.readDashboardPortFile(shared.MINIONS_DIR)?.port || 7331;
     const headers = {
       'User-Agent': 'minions-watch/1.0',
       'X-Minions-Internal': '1',
@@ -933,7 +933,7 @@ registerActionType(WATCH_ACTION_TYPE.CC_TRIAGE, {
 
     const watchId = String(watch?.id || 'unknown');
     const triggerCount = Number(watch?.triggerCount || 0);
-    const port = process.env.MINIONS_PORT || 7331;
+    const port = shared.readDashboardPortFile(shared.MINIONS_DIR)?.port || 7331;
     const timeoutMs = Number.isFinite(p.timeoutMs) && p.timeoutMs > 0
       ? Math.min(Number(p.timeoutMs), CC_TRIAGE_MAX_TIMEOUT_MS)
       : CC_TRIAGE_DEFAULT_TIMEOUT_MS;

package/engine/worktree-gc.js

@@ -309,42 +309,56 @@ function _resetStuckPathsForTesting() { _stuckPaths.clear(); }
 // `_markStuckSuccess` with the reaped-pid attribution.
 function _postReapRetry(wtPath, gitRoot, parentDir, resolvedPath, _removeWorktree, opts, projStats, result, log, reapedPids) {
   try { shared.clearWorktreeFailureCache(resolvedPath); } catch { /* optional */ }
-  // Brief settle window for OS to release file handles from killed processes.
-  try {
-    const sleepFn = typeof opts.sleepSyncFn === 'function'
-      ? opts.sleepSyncFn
-      : (ms) => {
-        try {
-          require('child_process').execFileSync(process.execPath, ['-e', `setTimeout(()=>process.exit(0), ${Number(ms) || 0})`], { stdio: 'ignore' });
-        } catch { /* timeout / spawn fail — proceed anyway */ }
-      };
-    sleepFn(2000);
-  } catch { /* sleep failures should not block the retry */ }
 
-  try {
-    const removed = _removeWorktree(wtPath, gitRoot, parentDir);
-    if (removed) {
-      // Down-count the failure we recorded just before; this dispatch
-      // ultimately succeeded after the auto-reap.
-      if (projStats) { projStats.failed = Math.max(0, projStats.failed - 1); projStats.evicted++; }
-      if (result) { result.failed = Math.max(0, result.failed - 1); result.evicted++; }
-      _markStuckSuccess(resolvedPath, {
-        writeToInbox: opts.writeToInbox,
-        recoveryReason: 'holder-reap',
-        reapedPids,
-      });
-      try { shared.bumpWorktreeGcMetric('recoveredViaHolderReap'); } catch { /* optional */ }
+  // The actual removal attempt, run after the settle window.
+  function _doRetry() {
+    try {
+      const removed = _removeWorktree(wtPath, gitRoot, parentDir);
+      if (removed) {
+        // Down-count the failure we recorded just before; this dispatch
+        // ultimately succeeded after the auto-reap.
+        if (projStats) { projStats.failed = Math.max(0, projStats.failed - 1); projStats.evicted++; }
+        if (result) { result.failed = Math.max(0, result.failed - 1); result.evicted++; }
+        _markStuckSuccess(resolvedPath, {
+          writeToInbox: opts.writeToInbox,
+          recoveryReason: 'holder-reap',
+          reapedPids,
+        });
+        try { shared.bumpWorktreeGcMetric('recoveredViaHolderReap'); } catch { /* optional */ }
+        if (typeof log === 'function') {
+          log('info', `worktree-gc: removed ${wtPath} after auto-reaping holder(s) ${reapedPids.join(', ')}`);
+        }
+        return true;
+      }
+    } catch (retryErr) {
       if (typeof log === 'function') {
-        log('info', `worktree-gc: removed ${wtPath} after auto-reaping holder(s) ${reapedPids.join(', ')}`);
+        log('warn', `worktree-gc: post-reap retry threw for ${wtPath}: ${retryErr && retryErr.message}`);
       }
-      return true;
-    }
-  } catch (retryErr) {
-    if (typeof log === 'function') {
-      log('warn', `worktree-gc: post-reap retry threw for ${wtPath}: ${retryErr && retryErr.message}`);
     }
+    return false;
   }
-  return false;
+
+  // Brief settle window for OS to release file handles from killed processes.
+  // When sleepSyncFn returns a Promise (or is absent — the production default
+  // uses Promise-based setTimeout), the retry fires asynchronously so the
+  // event loop is never blocked. When sleepSyncFn is a sync no-op (test
+  // injection), the retry fires immediately so test assertions remain sync.
+  // The production timer is .unref()'d so it never keeps a test process alive.
+  const sleepFn = typeof opts.sleepSyncFn === 'function'
+    ? opts.sleepSyncFn
+    : (ms) => new Promise(r => { const t = setTimeout(r, ms); if (t && typeof t.unref === 'function') t.unref(); });
+
+  let settled;
+  try { settled = sleepFn(2000); } catch { /* sleep init failure — fire retry anyway */ }
+
+  if (settled && typeof settled.then === 'function') {
+    // Async settle window — fire-and-forget; never blocks the event loop.
+    settled.then(() => { try { _doRetry(); } catch { /* ignore */ } }).catch(() => {});
+    return;
+  }
+
+  // Sync settle window (test injection) — fire retry immediately.
+  try { _doRetry(); } catch { /* ignore */ }
 }
 
 /**

package/engine.js

@@ -8422,7 +8422,7 @@ function discoverCentralWorkItems(config) {
           item_id: item.id,
           item_name: item.title || item.id,
           item_priority: item.priority || 'medium',
-          item_description: item.description || '',
+          item_description: shared.redactPromptDescription(item.description || ''),
           work_type: workType,
           additional_context: item.prompt ? `## Additional Context\n\n${item.prompt}` : '',
           scope_section: buildProjectContext(dispatchProjects, assignedProject, true, agent.name, agent.role),
@@ -8615,7 +8615,7 @@ function discoverCentralWorkItems(config) {
         // Ensure plans directory exists before agent tries to write
         if (!fs.existsSync(PLANS_DIR)) fs.mkdirSync(PLANS_DIR, { recursive: true });
         const planFileName = `plan-${item.id.toLowerCase()}-${dateStamp()}.md`;
-        vars.plan_content = item.title + (item.description ? '\n\n' + item.description : '');
+        vars.plan_content = shared.redactPromptDescription(item.title + (item.description ? '\n\n' + item.description : ''));
         vars.plan_title = item.title;
         vars.plan_file = planFileName;
         vars.task_description = item.title;
@@ -8642,7 +8642,7 @@ function discoverCentralWorkItems(config) {
           vars.plan_content = planFileContent;
         } else {
           if (planReadError) log('warn', `plan-to-prd: could not read plan file ${item.planFile} for ${item.id}: ${planReadError.message}`);
-          vars.plan_content = item.description || '';
+          vars.plan_content = shared.redactPromptDescription(item.description || '');
         }
         vars.plan_summary = (item.title || item.planFile).substring(0, 80);
         vars.plan_file = item.planFile || '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2249",
+  "version": "0.1.2251",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"