@yemi33/minions 0.1.2284 → 0.1.2285

package/engine/lifecycle.js

@@ -767,10 +767,17 @@ function syncPrdItemStatus(itemId, status, sourcePlan) {
       // safeJsonNoRestore so an archived PRD's .backup sidecar can't resurrect
       // the active PRD just because a done WI still references it.
       const plan = safeJsonNoRestore(fpath);
+      // Frozen PRDs (paused/rejected/awaiting-approval/completed) must not have
+      // their item statuses mutated by a late-arriving WI status update — that
+      // would silently flip a paused/rejected PRD's items and feed the
+      // materializer. Mirrors the guard reconcilePrdStatuses already has.
+      if (_PRD_FROZEN_STATUSES.has(plan?.status)) continue;
       const feature = plan?.missing_features?.find(f => f.id === itemId);
       if (!feature || feature.status === status) continue;
       let updated = false;
       mutateJsonFileLocked(fpath, (fresh) => {
+        // Re-check under the lock — status may have frozen between peek and lock.
+        if (_PRD_FROZEN_STATUSES.has(fresh?.status)) return fresh;
         const f = fresh?.missing_features?.find(x => x.id === itemId);
         if (f && f.status !== status) {
           f.status = status;

package/engine/shared.js

@@ -1328,7 +1328,12 @@ function forEachPidFile(callback) {
 function neutralizeJsonBackupSidecar(filePath, inertData = { status: 'archived' }) {
   const backupPath = filePath + '.backup';
   try {
-    fs.unlinkSync(backupPath);
+    // Retry the unlink — on Windows a transient EPERM/EBUSY (AV scanner, lagging
+    // OS handle, indexer) otherwise leaves the .backup sidecar in place, and the
+    // next by-name safeJson() resurrects the just-deleted PRD from it. _retryFsOp
+    // rethrows non-retryable codes (e.g. ENOENT) immediately, so the absent path
+    // below still fires for an already-missing sidecar.
+    _retryFsOp(() => fs.unlinkSync(backupPath), `neutralize backup ${path.basename(backupPath)}`);
     return { ok: true, action: 'removed', backupPath };
   } catch (unlinkErr) {
     if (unlinkErr.code === 'ENOENT') return { ok: true, action: 'absent', backupPath };

package/engine.js

@@ -9304,6 +9304,26 @@ let tickCount = 0;
 // In-memory cache of plan filenames confirmed completed — avoids redundant
 // checkPlanCompletion calls.  Cleared automatically on engine restart.
 const completedPlanCache = new Set();
+// Filenames where a live PRD shares a basename with an archived PRD but diverges
+// (different source_plan / introduces new work). We refuse to auto-purge those
+// and warn once instead of every tick. (RC4 — footgun #7 collision protection.)
+const _ghostPurgeCollisionWarned = new Set();
+
+// True when a live PRD that shares a basename with an archived one is merely a
+// stale echo of the archive (a .backup ghost-restore), safe to purge. False when
+// it's a genuinely distinct re-opened PRD that must NOT be silently deleted.
+// Conservative: if either file is unreadable we fall back to the legacy
+// "purge the ghost" behavior so we don't regress resurrection cleanup.
+function _isGhostPrdRestore(live, archived) {
+  if (!live || !archived) return true;
+  const ls = live.source_plan || live.sourcePlan;
+  const as = archived.source_plan || archived.sourcePlan;
+  if (ls && as && ls !== as) return false; // different plan identity → real PRD
+  const archivedIds = new Set((archived.missing_features || []).map(f => f && f.id).filter(Boolean));
+  const hasNewWork = (live.missing_features || []).some(f => f && f.id && !archivedIds.has(f.id));
+  if (hasNewWork) return false; // introduces work the archive never had → real PRD
+  return true; // same identity, no new work → stale echo → ghost
+}
 let lastWatchCheckAt = 0;
 let lastPrStatusPollAt = 0;
 let lastPrCommentsPollAt = 0;
@@ -9722,11 +9742,26 @@ async function tickInner() {
       for (const file of prdFiles) {
         if (completedPlanCache.has(file)) continue;
         if (fs.existsSync(path.join(PRD_DIR, 'archive', file))) {
-          // Orphaned backup restore — plan is already archived. Purge the ghost copy.
-          try { fs.unlinkSync(path.join(PRD_DIR, file)); } catch { }
-          try { fs.unlinkSync(path.join(PRD_DIR, file + '.backup')); } catch { }
-          completedPlanCache.add(file);
-          continue;
+          // A live PRD basename also exists in the archive. Historically this was
+          // unconditionally treated as an orphaned .backup ghost-restore and purged
+          // — but a re-opened plan can legitimately create a NEW live PRD sharing
+          // an archived basename (footgun #7). Identity-check before deleting so we
+          // never silently destroy a real divergent PRD.
+          const liveP = safeJsonNoRestore(path.join(PRD_DIR, file));
+          const archP = safeJsonNoRestore(path.join(PRD_DIR, 'archive', file));
+          if (_isGhostPrdRestore(liveP, archP)) {
+            // Orphaned backup restore — plan is already archived. Purge the ghost copy.
+            try { fs.unlinkSync(path.join(PRD_DIR, file)); } catch { }
+            shared.neutralizeJsonBackupSidecar(path.join(PRD_DIR, file));
+            completedPlanCache.add(file);
+            continue;
+          }
+          // Divergent live PRD — do NOT delete. Warn once and fall through to the
+          // normal completion handling below so it's treated as a real PRD.
+          if (!_ghostPurgeCollisionWarned.has(file)) {
+            log('warn', `PRD ${file} shares a basename with an archived PRD but diverges (different source_plan or new work) — NOT purging; resolve the collision manually`);
+            _ghostPurgeCollisionWarned.add(file);
+          }
         }
         const plan = safeJson(path.join(PRD_DIR, file));
         if (plan && plan.missing_features) {
@@ -10446,6 +10481,7 @@ module.exports = {
   materializeSpecsAsWorkItems, // exported for testing (P-f7-git-log)
   reservePrdFilename, // exported for testing (P-9b7e5d3c)
   sweepStaleArchivedPrdBackups, // exported for testing
+  _isGhostPrdRestore, // exported for testing (RC4 — ghost-purge identity check)
 
   // Shared helpers (used by lifecycle.js and tests)
   reconcileItemsWithPrs, detectDependencyCycles,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2284",
+  "version": "0.1.2285",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"