@yemi33/minions 0.1.2283 → 0.1.2285

package/engine/lifecycle.js

@@ -767,10 +767,17 @@ function syncPrdItemStatus(itemId, status, sourcePlan) {
       // safeJsonNoRestore so an archived PRD's .backup sidecar can't resurrect
       // the active PRD just because a done WI still references it.
       const plan = safeJsonNoRestore(fpath);
+      // Frozen PRDs (paused/rejected/awaiting-approval/completed) must not have
+      // their item statuses mutated by a late-arriving WI status update — that
+      // would silently flip a paused/rejected PRD's items and feed the
+      // materializer. Mirrors the guard reconcilePrdStatuses already has.
+      if (_PRD_FROZEN_STATUSES.has(plan?.status)) continue;
       const feature = plan?.missing_features?.find(f => f.id === itemId);
       if (!feature || feature.status === status) continue;
       let updated = false;
       mutateJsonFileLocked(fpath, (fresh) => {
+        // Re-check under the lock — status may have frozen between peek and lock.
+        if (_PRD_FROZEN_STATUSES.has(fresh?.status)) return fresh;
         const f = fresh?.missing_features?.find(x => x.id === itemId);
         if (f && f.status !== status) {
           f.status = status;

package/engine/pipeline.js

@@ -522,15 +522,28 @@ function _findExistingPlanForMeeting(meetingIds, plansDir) {
   return slugMatch;
 }
 
-// Check if a PRD already exists for a given plan file (plan already converted)
+// Canonicalize a plan filename by stripping a trailing collision suffix
+// (`-2`, `-3`, …) that `uniquePath` appends AFTER the `-YYYY-MM-DD` date when a
+// same-name plan already exists. A pipeline run whose plan got collision-bumped
+// to `<name>-<date>-2.md` must still link to the PRD written for the canonical
+// `<name>-<date>.md` (a duplicate plan otherwise strands the PRD permanently
+// `awaiting-approval`, defeating the stage's autoApprove). Only strips the
+// suffix when the remainder ends in a full date, so real names are untouched.
+function _canonicalPlanName(planFile) {
+  return String(planFile || '').replace(/^(.*-\d{4}-\d{2}-\d{2})-\d+(\.md)$/i, '$1$2');
+}
+
+// Check if a PRD already exists for a given plan file (plan already converted).
+// Matches by canonical name so a collision-bumped plan still finds its PRD.
 function _findExistingPrdForPlan(planFile, prdDir) {
   if (!fs.existsSync(prdDir)) return null;
   const prdFiles = safeReadDir(prdDir).filter(f => f.endsWith('.json'));
+  const planKey = _canonicalPlanName(planFile);
   for (const pf of prdFiles) {
     // safeJsonNoRestore: PRDs are terminal artifacts — never restore archived
     // PRDs from a stale .backup sidecar (W-mouptdh1000h9f39).
     const prd = safeJsonNoRestore(path.join(prdDir, pf));
-    if (prd?.source_plan && path.basename(String(prd.source_plan)) === planFile) return pf;
+    if (prd?.source_plan && _canonicalPlanName(path.basename(String(prd.source_plan))) === planKey) return pf;
   }
   return null;
 }
@@ -925,10 +938,14 @@ function isStageComplete(stage, stageState, run, config) {
       const discoveredWiIds = [];
       const prdFiles = fs.existsSync(prdDir) ? safeReadDir(prdDir).filter(f => f.endsWith('.json')) : [];
       for (const planFile of plans) {
+        const planKey = _canonicalPlanName(planFile);
         for (const pf of prdFiles) {
           // safeJsonNoRestore — see _findExistingPrdForPlan above (W-mouptdh1000h9f39).
           const prd = safeJsonNoRestore(path.join(prdDir, pf));
-          if (prd?.source_plan && path.basename(String(prd.source_plan)) === planFile && !(artifacts.prds || []).includes(pf) && !discoveredPrds.includes(pf)) {
+          // Canonical match: a collision-bumped run plan (<name>-<date>-2.md)
+          // still links to the PRD written for <name>-<date>.md, so the stage's
+          // autoApprove reaches the PRD instead of stranding it awaiting-approval.
+          if (prd?.source_plan && _canonicalPlanName(path.basename(String(prd.source_plan))) === planKey && !(artifacts.prds || []).includes(pf) && !discoveredPrds.includes(pf)) {
             discoveredPrds.push(pf);
           }
         }
@@ -1244,5 +1261,5 @@ module.exports = {
   evaluateCondition, // exported for testing
   truncatePipelineContext, executeTaskStage, executePlanStage, executeScheduleStage, executeApiStage, executeMeetingStage, executeMergePrsStage, isStageComplete, resolveTemplate, // exported for testing
   _resolvePipelineProjects, // exported for testing
-  _findMeetingsInRun, _findExistingPlanForMeeting, _findExistingPrdForPlan, // exported for testing
+  _findMeetingsInRun, _findExistingPlanForMeeting, _findExistingPrdForPlan, _canonicalPlanName, // exported for testing
 };

package/engine/shared.js

@@ -1328,7 +1328,12 @@ function forEachPidFile(callback) {
 function neutralizeJsonBackupSidecar(filePath, inertData = { status: 'archived' }) {
   const backupPath = filePath + '.backup';
   try {
-    fs.unlinkSync(backupPath);
+    // Retry the unlink — on Windows a transient EPERM/EBUSY (AV scanner, lagging
+    // OS handle, indexer) otherwise leaves the .backup sidecar in place, and the
+    // next by-name safeJson() resurrects the just-deleted PRD from it. _retryFsOp
+    // rethrows non-retryable codes (e.g. ENOENT) immediately, so the absent path
+    // below still fires for an already-missing sidecar.
+    _retryFsOp(() => fs.unlinkSync(backupPath), `neutralize backup ${path.basename(backupPath)}`);
     return { ok: true, action: 'removed', backupPath };
   } catch (unlinkErr) {
     if (unlinkErr.code === 'ENOENT') return { ok: true, action: 'absent', backupPath };

package/engine.js

@@ -9304,6 +9304,26 @@ let tickCount = 0;
 // In-memory cache of plan filenames confirmed completed — avoids redundant
 // checkPlanCompletion calls.  Cleared automatically on engine restart.
 const completedPlanCache = new Set();
+// Filenames where a live PRD shares a basename with an archived PRD but diverges
+// (different source_plan / introduces new work). We refuse to auto-purge those
+// and warn once instead of every tick. (RC4 — footgun #7 collision protection.)
+const _ghostPurgeCollisionWarned = new Set();
+
+// True when a live PRD that shares a basename with an archived one is merely a
+// stale echo of the archive (a .backup ghost-restore), safe to purge. False when
+// it's a genuinely distinct re-opened PRD that must NOT be silently deleted.
+// Conservative: if either file is unreadable we fall back to the legacy
+// "purge the ghost" behavior so we don't regress resurrection cleanup.
+function _isGhostPrdRestore(live, archived) {
+  if (!live || !archived) return true;
+  const ls = live.source_plan || live.sourcePlan;
+  const as = archived.source_plan || archived.sourcePlan;
+  if (ls && as && ls !== as) return false; // different plan identity → real PRD
+  const archivedIds = new Set((archived.missing_features || []).map(f => f && f.id).filter(Boolean));
+  const hasNewWork = (live.missing_features || []).some(f => f && f.id && !archivedIds.has(f.id));
+  if (hasNewWork) return false; // introduces work the archive never had → real PRD
+  return true; // same identity, no new work → stale echo → ghost
+}
 let lastWatchCheckAt = 0;
 let lastPrStatusPollAt = 0;
 let lastPrCommentsPollAt = 0;
@@ -9722,11 +9742,26 @@ async function tickInner() {
       for (const file of prdFiles) {
         if (completedPlanCache.has(file)) continue;
         if (fs.existsSync(path.join(PRD_DIR, 'archive', file))) {
-          // Orphaned backup restore — plan is already archived. Purge the ghost copy.
-          try { fs.unlinkSync(path.join(PRD_DIR, file)); } catch { }
-          try { fs.unlinkSync(path.join(PRD_DIR, file + '.backup')); } catch { }
-          completedPlanCache.add(file);
-          continue;
+          // A live PRD basename also exists in the archive. Historically this was
+          // unconditionally treated as an orphaned .backup ghost-restore and purged
+          // — but a re-opened plan can legitimately create a NEW live PRD sharing
+          // an archived basename (footgun #7). Identity-check before deleting so we
+          // never silently destroy a real divergent PRD.
+          const liveP = safeJsonNoRestore(path.join(PRD_DIR, file));
+          const archP = safeJsonNoRestore(path.join(PRD_DIR, 'archive', file));
+          if (_isGhostPrdRestore(liveP, archP)) {
+            // Orphaned backup restore — plan is already archived. Purge the ghost copy.
+            try { fs.unlinkSync(path.join(PRD_DIR, file)); } catch { }
+            shared.neutralizeJsonBackupSidecar(path.join(PRD_DIR, file));
+            completedPlanCache.add(file);
+            continue;
+          }
+          // Divergent live PRD — do NOT delete. Warn once and fall through to the
+          // normal completion handling below so it's treated as a real PRD.
+          if (!_ghostPurgeCollisionWarned.has(file)) {
+            log('warn', `PRD ${file} shares a basename with an archived PRD but diverges (different source_plan or new work) — NOT purging; resolve the collision manually`);
+            _ghostPurgeCollisionWarned.add(file);
+          }
         }
         const plan = safeJson(path.join(PRD_DIR, file));
         if (plan && plan.missing_features) {
@@ -10446,6 +10481,7 @@ module.exports = {
   materializeSpecsAsWorkItems, // exported for testing (P-f7-git-log)
   reservePrdFilename, // exported for testing (P-9b7e5d3c)
   sweepStaleArchivedPrdBackups, // exported for testing
+  _isGhostPrdRestore, // exported for testing (RC4 — ghost-purge identity check)
 
   // Shared helpers (used by lifecycle.js and tests)
   reconcileItemsWithPrs, detectDependencyCycles,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2283",
+  "version": "0.1.2285",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"