@yemi33/minions 0.1.2285 → 0.1.2287

package/dashboard.js

@@ -37,6 +37,7 @@ const _dashboardVersion = {
 };
 const shared = require('./engine/shared');
 const queries = require('./engine/queries');
+const prdStore = require('./engine/prd-store');
 const ado = require('./engine/ado');
 const gh = require('./engine/github');
 const ghToken = require('./engine/gh-token');
@@ -429,6 +430,21 @@ function mergeSettingsConfigUpdate(current, candidate, body, patch = {}) {
       // `worktreeMode`. Drop any stale legacy key on every settings save so a
       // migrated project never carries both fields.
       delete currentProject.worktreeMode;
+      // M006 — mirror liveValidation: check both candidateProject (modified
+      // in-memory config) and the original body update. When handleSettingsUpdate
+      // deletes the field (null or empty type sent), candidateProject won't have
+      // it but the body update will — mirror the deletion to disk.
+      if (Object.prototype.hasOwnProperty.call(candidateProject, 'liveValidation')) {
+        if (candidateProject.liveValidation && typeof candidateProject.liveValidation === 'object' && candidateProject.liveValidation.type) {
+          currentProject.liveValidation = candidateProject.liveValidation;
+        } else {
+          delete currentProject.liveValidation;
+        }
+      } else if (Object.prototype.hasOwnProperty.call(update, 'liveValidation')) {
+        // Body sent liveValidation key but handleSettingsUpdate deleted it from
+        // the in-memory config (null / empty type) — propagate to disk.
+        delete currentProject.liveValidation;
+      }
     }
   }
   shared.pruneDefaultClaudeConfig(current);
@@ -1299,7 +1315,7 @@ function collectArchivedWorkItems(minionsDir = MINIONS_DIR, projects = PROJECTS)
   }
   return archived;
 }
-function linkPullRequestForTracking({ url, title, project: projectName, contextOnly, autoObserve, context, workItemId }, config = CONFIG, options = {}) {
+function linkPullRequestForTracking({ url, title, project: projectName, contextOnly, context, workItemId }, config = CONFIG, options = {}) {
   if (!url) {
     const err = new Error('url required');
     err.statusCode = 400;
@@ -1315,12 +1331,7 @@ function linkPullRequestForTracking({ url, title, project: projectName, contextO
   const linkedWorkItemId = getWorkItemIdFromPrLinkContext(context, workItemId);
   const contextText = typeof context === 'string' ? context : (context == null ? '' : JSON.stringify(context));
   const metadata = normalizePrMetadata(options.metadata);
-  // W-mq5s5ttx000j7ab8-c: canonical `contextOnly` field with `autoObserve`
-  // deprecated alias. Explicit canonical wins; otherwise fall back to the
-  // alias (autoObserve:true → contextOnly:false); otherwise default false.
-  const resolvedContextOnly = typeof contextOnly === 'boolean'
-    ? contextOnly
-    : (autoObserve === undefined ? false : !autoObserve);
+  const resolvedContextOnly = typeof contextOnly === 'boolean' ? contextOnly : false;
   const result = shared.upsertPullRequestRecord(prPath, {
     id: prId,
     prNumber: parseInt(prNum, 10) || null,
@@ -6974,7 +6985,11 @@ const server = http.createServer(async (req, res) => {
       if (!fs.existsSync(PRD_DIR)) fs.mkdirSync(PRD_DIR, { recursive: true });
 
       const planFile = 'manual-' + shared.uid() + '.json';
-      safeWrite(path.join(PRD_DIR, planFile), manualPrd.plan);
+      const manualPrdPath = path.join(PRD_DIR, planFile);
+      safeWrite(manualPrdPath, manualPrd.plan);
+      // Phase 10 step 2 — this create uses safeWrite (not mutateJsonFileLocked),
+      // so mirror to SQL explicitly. Best-effort.
+      prdStore.mirrorPrdToSql(manualPrdPath, manualPrd.plan);
       invalidatePlansCache();
       return jsonReply(res, 200, { ok: true, id: manualPrd.id, file: planFile });
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }
@@ -8022,77 +8037,103 @@ const server = http.createServer(async (req, res) => {
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }
   }
 
+  // Shared by pause + reject (and any future PRD-stop handler): stop a PRD's
+  // materialized work. Kills any active dispatch for the PRD's items, transitions
+  // every non-completed WI sourced from the PRD to `targetStatus`, AND cancels the
+  // still-running plan-to-prd regeneration WI for the PRD's source plan so it can't
+  // silently rebuild the PRD we just paused/rejected. Returns the count of WIs
+  // transitioned. Lockless reads → cleanDispatchEntries (atomic kill + remove) →
+  // mutateWorkItems, mirroring the original pause flow. (RC3 — reject had no
+  // cleanup; pause never stopped regeneration.)
+  function stopPlanMaterializedWork(prdFile, prdSourcePlan, opts) {
+    const targetStatus = opts.targetStatus;
+    const wiPaths = [path.join(MINIONS_DIR, 'work-items.json')];
+    for (const proj of PROJECTS) wiPaths.push(shared.projectWorkItemsPath(proj));
+
+    // Step 1: find dispatched item ids (read-only, no lock).
+    const dispatchedItemIds = new Set();
+    for (const wiPath of wiPaths) {
+      try {
+        for (const w of safeJsonArr(wiPath)) {
+          if (w.sourcePlan !== prdFile) continue;
+          if (w.completedAt || DONE_STATUSES.has(w.status)) continue;
+          if (w.status === WI_STATUS.DISPATCHED && w.id) dispatchedItemIds.add(w.id);
+        }
+      } catch { /* file may not exist */ }
+    }
+
+    // Step 2: kill active dispatches via the canonical primitive (resolves PIDs from
+    // the pid sidecar, kills outside the dispatch lock, removes via mutateDispatch).
+    if (dispatchedItemIds.size > 0) {
+      cleanDispatchEntries((d) => {
+        const itemId = d.meta?.item?.id;
+        if (itemId && dispatchedItemIds.has(itemId)) return true;
+        if (d.meta?.dispatchKey && [...dispatchedItemIds].some(id => d.meta.dispatchKey.includes(id))) return true;
+        return false;
+      });
+    }
+
+    // Step 3: transition WIs per path (each lock held briefly, no nesting).
+    let affected = 0;
+    for (const wiPath of wiPaths) {
+      try {
+        mutateWorkItems(wiPath, items => {
+          for (const w of items) {
+            if (w.sourcePlan !== prdFile) continue;
+            if (w.completedAt || DONE_STATUSES.has(w.status)) continue;
+            if (w.status !== targetStatus) affected++;
+            w.status = targetStatus;
+            if (opts.stampField) w[opts.stampField] = opts.stampValue;
+            delete w._resumedAt;
+            delete w.dispatched_at;
+            delete w.dispatched_to;
+            delete w.failReason;
+            delete w.failedAt;
+          }
+        });
+      } catch (e) { console.error('stopPlanMaterializedWork work items:', e.message); }
+    }
+
+    // Step 4: cancel the still-running plan-to-prd regeneration WI for this source
+    // plan — otherwise a pending/dispatched plan-to-prd run rebuilds the PRD we just
+    // stopped. (delete handles the DONE plan-to-prd WI separately to revert to draft.)
+    if (prdSourcePlan) {
+      try {
+        const centralPath = path.join(MINIONS_DIR, 'work-items.json');
+        mutateWorkItems(centralPath, items => {
+          for (const w of items) {
+            if (w.type === WORK_TYPE.PLAN_TO_PRD && w.planFile === prdSourcePlan &&
+                !DONE_STATUSES.has(w.status) && w.status !== WI_STATUS.CANCELLED) {
+              w.status = WI_STATUS.CANCELLED;
+              w._cancelledBy = opts.stampValue || 'prd-stopped';
+            }
+          }
+        });
+      } catch (e) { console.error('stopPlanMaterializedWork plan-to-prd:', e.message); }
+    }
+    return affected;
+  }
+
   async function handlePlansPause(req, res) {
     try {
       const body = await readBody(req);
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
       if (!body.file.endsWith('.json')) return jsonReply(res, 400, { error: 'expected a PRD JSON filename (got `' + body.file + '`). Pass prd/<plan>.json, not the source plans/<plan>.md.' });
       const planPath = resolvePlanPath(body.file);
-      mutateJsonFileLocked(planPath, (plan) => {
+      let prdSourcePlan = null;
+      const updated = mutateJsonFileLocked(planPath, (plan) => {
         if (!plan || Array.isArray(plan) || typeof plan !== 'object') plan = {};
         plan.status = 'paused';
         plan.pausedAt = new Date().toISOString();
         return plan;
       }, { defaultValue: {} });
+      prdSourcePlan = updated?.source_plan || null;
 
-      // Propagate pause to materialized work items across all projects:
-      // kill any active agent process and reset non-completed items to paused.
-      // Pattern: lockless reads → cleanDispatchEntries (atomic kill + remove) → mutateWorkItems.
-      const wiPaths = [path.join(MINIONS_DIR, 'work-items.json')];
-      for (const proj of PROJECTS) {
-        wiPaths.push(shared.projectWorkItemsPath(proj));
-      }
-      const dispatchPath = path.join(MINIONS_DIR, 'engine', 'dispatch.json');
-
-      // Step 1: Read work items (read-only, no lock) to find plan items that are dispatched.
-      const dispatchedItemIds = new Set();
-      for (const wiPath of wiPaths) {
-        try {
-          const items = safeJsonArr(wiPath);
-          for (const w of items) {
-            if (w.sourcePlan !== body.file) continue;
-            if (w.completedAt || DONE_STATUSES.has(w.status)) continue;
-            if (w.status === WI_STATUS.DISPATCHED && w.id) dispatchedItemIds.add(w.id);
-          }
-        } catch { /* file may not exist */ }
-      }
-
-      // Step 2: Route PID resolution + kill + dispatch removal through the canonical primitive.
-      // cleanDispatchEntries resolves PIDs from engine/tmp/dispatch-<id>-*/pid-<id>.pid
-      // (see shared.findDispatchPidFile), kills outside the dispatch lock, and removes the
-      // entries via mutateDispatch (SQL + JSON mirror in one atomic write).
-      // The defunct per-agent status sidecar reads/writes that used to live here are gone
-      // (engine/queries.js documents that file no longer exists).
-      if (dispatchedItemIds.size > 0) {
-        const matchFn = (d) => {
-          const itemId = d.meta?.item?.id;
-          if (itemId && dispatchedItemIds.has(itemId)) return true;
-          if (d.meta?.dispatchKey && [...dispatchedItemIds].some(id => d.meta.dispatchKey.includes(id))) return true;
-          return false;
-        };
-        cleanDispatchEntries(matchFn);
-      }
-
-      // Step 3: Mutate work-items.json per path — pause items (each lock held briefly, no nesting).
-      let reset = 0;
-      for (const wiPath of wiPaths) {
-        try {
-          mutateWorkItems(wiPath, items => {
-            for (const w of items) {
-              if (w.sourcePlan !== body.file) continue;
-              if (w.completedAt || DONE_STATUSES.has(w.status)) continue;
-              if (w.status !== WI_STATUS.PAUSED) reset++;
-              w.status = WI_STATUS.PAUSED;
-              w._pausedBy = 'prd-pause';
-              delete w._resumedAt;
-              delete w.dispatched_at;
-              delete w.dispatched_to;
-              delete w.failReason;
-              delete w.failedAt;
-            }
-          });
-        } catch (e) { console.error('reset work items:', e.message); }
-      }
+      // Propagate pause to materialized work items across all projects + cancel the
+      // plan-to-prd regeneration WI so a paused PRD can't be silently rebuilt.
+      const reset = stopPlanMaterializedWork(body.file, prdSourcePlan, {
+        targetStatus: WI_STATUS.PAUSED, stampField: '_pausedBy', stampValue: 'prd-pause',
+      });
 
       invalidateStatusCache();
       invalidatePlansCache();
@@ -8149,8 +8190,17 @@ const server = http.createServer(async (req, res) => {
         return data;
       }, { defaultValue: {} });
 
+      // RC3: reject used to flip only the PRD status — its materialized work items
+      // kept dispatching and any active agent kept running, and a pending plan-to-prd
+      // run could rebuild the PRD. Reject is terminal, so cancel the materialized WIs,
+      // kill active dispatches, and cancel the plan-to-prd regeneration WI.
+      const cancelled = stopPlanMaterializedWork(body.file, plan?.source_plan || null, {
+        targetStatus: WI_STATUS.CANCELLED, stampField: '_cancelledBy', stampValue: 'prd-rejected',
+      });
+
+      invalidateStatusCache();
       invalidatePlansCache();
-      return jsonReply(res, 200, { ok: true, status: 'rejected' });
+      return jsonReply(res, 200, { ok: true, status: 'rejected', cancelledWorkItems: cancelled });
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }
   }
 
@@ -8268,6 +8318,10 @@ const server = http.createServer(async (req, res) => {
         cleanupPlanWorktrees(body.file, planObj || {}, PROJECTS, getConfig());
       } catch (e) { console.error('plan worktree cleanup:', e.message); }
       safeUnlink(planPath);
+      // Phase 10 step 2 — a deleted PRD must also leave SQL, or the read-flip
+      // (step 3) would resurrect it from a stale mirror row. Best-effort; no-op
+      // for non-PRD paths (parsePrdPath returns null for plan .md deletes).
+      if (body.file.endsWith('.json')) prdStore.removePrdFromSql(planPath);
       // Neutralize the `.backup` sidecar so `safeJson` auto-restore can't
       // RESURRECT the PRD we just deleted (the live file is gone, but a stray
       // `prd/<plan>.json.backup` would be auto-restored on the next safeJson read
@@ -9823,6 +9877,8 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         _emitTimingLog(_lifecycle, _tSessionReady, Date.now(), 'cancelled-pre-stream');
         return resolveResult({ text: accumulated, sessionId: sessionHandle.sessionId, code: 0, usage: {}, raw: accumulated, stderr: '' });
       }
+      let poolSegmentId = 0;
+      let segmentStart = 0;
       await sessionHandle.stream(prompt, {
         systemPromptText: systemPrompt,
         onChunk: (delta) => {
@@ -9831,7 +9887,8 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           accumulated += delta;
           _touchCcLiveStream(liveState);
           liveState.text = accumulated;
-          if (liveState.writer) liveState.writer({ type: 'chunk', text: accumulated });
+          const segmentText = accumulated.slice(segmentStart);
+          if (liveState.writer) liveState.writer({ type: 'chunk', text: segmentText, segmentId: poolSegmentId });
         },
         onToolUse: (name, input, toolCallId) => {
           if (_tFirstTool == null) _tFirstTool = Date.now();
@@ -9842,6 +9899,9 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           if (Array.isArray(toolUses)) toolUses.push(entry);
           if (Array.isArray(liveState.tools)) liveState.tools.push(entry);
           if (liveState.writer) liveState.writer({ type: 'tool', name, input: _lightToolInput(safeInput), id: toolCallId || null });
+          // Advance segment tracking so the next onChunk creates a fresh segment
+          poolSegmentId++;
+          segmentStart = accumulated.length;
         },
         onToolUpdate: (toolCallId, status) => {
           _touchCcLiveStream(liveState);
@@ -10830,6 +10890,11 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           // the per-project dropdown. resolveCheckoutMode honors the legacy
           // worktreeMode field; 'worktree' (default) or 'live'.
           checkoutMode: shared.resolveCheckoutMode(p),
+          // M006 — surface liveValidation so the Settings UI can pre-fill
+          // the type input and autoDispatch toggle. Null when not configured.
+          liveValidation: (p.liveValidation && typeof p.liveValidation === 'object' && p.liveValidation.type)
+            ? { type: p.liveValidation.type, autoDispatch: !!p.liveValidation.autoDispatch }
+            : null,
           workSources: {
             pullRequests: { enabled: p.workSources?.pullRequests?.enabled !== false, cooldownMinutes: p.workSources?.pullRequests?.cooldownMinutes ?? 30 },
             workItems: { enabled: p.workSources?.workItems?.enabled !== false, cooldownMinutes: p.workSources?.workItems?.cooldownMinutes ?? 0 }
@@ -11254,10 +11319,19 @@ What would you like to discuss or change? When you're happy, say "approve" and I
             // Drop the legacy field so a migrated project never carries both.
             delete proj.worktreeMode;
           }
+          // M006 — per-project liveValidation: { type, autoDispatch }.
+          // Only meaningful when checkoutMode is 'live'. Null / missing type
+          // clears the field; explicit object with a non-empty type persists it.
+          if (Object.prototype.hasOwnProperty.call(update, 'liveValidation')) {
+            const lv = update.liveValidation;
+            if (!lv || typeof lv !== 'object' || !lv.type || typeof lv.type !== 'string' || !lv.type.trim()) {
+              delete proj.liveValidation;
+            } else {
+              proj.liveValidation = { type: lv.type.trim(), autoDispatch: !!lv.autoDispatch };
+            }
+          }
         }
       }
-
-      shared.pruneDefaultClaudeConfig(config);
       mutateDashboardConfig(current => mergeSettingsConfigUpdate(current, config, body, _configPatch));
       // Refresh in-memory CONFIG so subsequent reads see the update
       reloadConfig();
@@ -13322,7 +13396,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     // /api/prd/regenerate removed — use /api/plans/approve which does diff-aware update
 
     // Agents
-    { method: 'POST', path: '/api/pull-requests/link', desc: 'Manually link an external PR for tracking', params: 'url, title?, project?, contextOnly?, autoObserve? (deprecated alias for !contextOnly), context?, workItemId?', handler: async (req, res) => {
+    { method: 'POST', path: '/api/pull-requests/link', desc: 'Manually link an external PR for tracking', params: 'url, title?, project?, contextOnly?, context?, workItemId?', handler: async (req, res) => {
       const body = await readBody(req);
       const { url } = body;
       if (!url) return jsonReply(res, 400, { error: 'url required' });

package/docs/deprecated.json

@@ -3,26 +3,10 @@
     "id": "agent-config-skills-field",
     "description": "Legacy per-agent descriptive-metadata array `agents.<id>.skills` in config.json, renamed to `agents.<id>.expertise` to remove the name collision with executable runtime/harness skills (SKILL.md). The field is metadata only (capability tags like `architecture`, `bug-fixes`); nothing in the dispatch path reads it for behavior. A read-compat shim honors the old key so operator configs still carrying `skills` (and no `expertise`) keep working.",
     "code": [
-      {
-        "file": "engine/playbook.js",
-        "lines": "950",
-        "note": "buildSystemPrompt reads `agent.expertise ?? agent.skills ?? []` for the `Expertise:` identity line"
-      },
-      {
-        "file": "engine/lifecycle.js",
-        "lines": "4620-4621",
-        "note": "pickReReviewAgentHints reads `agent.expertise` with an `agent.skills` array fallback"
-      },
-      {
-        "file": "engine/queries.js",
-        "lines": "731",
-        "note": "getAgents normalizes `expertise: a.expertise ?? a.skills ?? []` so the dashboard/settings UI always receives `expertise`"
-      },
-      {
-        "file": "dashboard.js",
-        "lines": "10708-10716",
-        "note": "settings POST accepts a legacy `updates.skills` key, persists as `config.agents[id].expertise`, and deletes the old `skills` key"
-      }
+      { "file": "engine/playbook.js", "lines": "950", "note": "buildSystemPrompt reads `agent.expertise ?? agent.skills ?? []` for the `Expertise:` identity line" },
+      { "file": "engine/lifecycle.js", "lines": "4620-4621", "note": "pickReReviewAgentHints reads `agent.expertise` with an `agent.skills` array fallback" },
+      { "file": "engine/queries.js", "lines": "731", "note": "getAgents normalizes `expertise: a.expertise ?? a.skills ?? []` so the dashboard/settings UI always receives `expertise`" },
+      { "file": "dashboard.js", "lines": "10708-10716", "note": "settings POST accepts a legacy `updates.skills` key, persists as `config.agents[id].expertise`, and deletes the old `skills` key" }
     ],
     "removalGate": "Telemetry / a config sweep across all known engines must show no persisted `config.agents.<id>.skills` key (only `expertise`) for >=30 consecutive days, confirming every operator config has been re-saved through the dashboard (which drops the legacy key) or hand-migrated.",
     "targetRemovalDate": "2026-09-17",
@@ -47,10 +31,7 @@
   {
     "id": "legacy-done-aliases",
     "location": "engine/cleanup.js:1165-1166",
-    "constants": [
-      "LEGACY_DONE_ALIASES",
-      "LEGACY_NEEDS_REVIEW_STATUS"
-    ],
+    "constants": ["LEGACY_DONE_ALIASES", "LEGACY_NEEDS_REVIEW_STATUS"],
     "reason": "Read-side tolerance: cleanup sweep auto-migrates four obsolete work-item / PRD status strings ('in-pr', 'implemented', 'complete', 'needs-human-review') to the canonical 'done' / 'failed' values. The aliases are no longer written anywhere in the engine; the constants exist only to repair stale on-disk values from old engine versions.",
     "targetRemovalDate": null,
     "notes": "Keep indefinitely until telemetry / a sweep log shows zero migrations performed for 30 consecutive days across all known projects (work-items.json + prd/*.json). At that point the constants and both _migrateLegacyItem branches in engine/cleanup.js (definitions at :1165-1166; usage at :1168-1183 for work items and :1269-1272 for PRD missing_features) can be deleted. Total cost on disk today: 4 strings."
@@ -59,21 +40,9 @@
     "id": "config-claude-binary-override",
     "description": "Legacy `config.claude.binary` runtime-resolution override. Older `minions init` versions persisted a `config.claude.binary` field that pointed the Claude runtime at a specific binary path. The runtime adapter still honors this override on every Claude spawn; the engine emits a `deprecated-config-claude` warning at config-load time but does NOT delete the override, so the override branch in claude.js is load-bearing for any install that still carries a non-default value.",
     "code": [
-      {
-        "file": "engine/runtimes/claude.js",
-        "lines": "82-86",
-        "note": "resolveBinary() respects config.claude.binary on every Claude spawn (probes npm package dir or direct binary path)"
-      },
-      {
-        "file": "engine/shared.js",
-        "lines": "2482-2496",
-        "note": "warnings.push({ id: 'deprecated-config-claude' }) — surface-only; never deletes the override"
-      },
-      {
-        "file": "engine/shared.js",
-        "lines": "3120-3124",
-        "note": "DEFAULT_CLAUDE.binary baseline that the warning + prune logic compares against"
-      }
+      { "file": "engine/runtimes/claude.js", "lines": "82-86", "note": "resolveBinary() respects config.claude.binary on every Claude spawn (probes npm package dir or direct binary path)" },
+      { "file": "engine/shared.js", "lines": "2482-2496", "note": "warnings.push({ id: 'deprecated-config-claude' }) — surface-only; never deletes the override" },
+      { "file": "engine/shared.js", "lines": "3120-3124", "note": "DEFAULT_CLAUDE.binary baseline that the warning + prune logic compares against" }
     ],
     "removalGate": "Telemetry: the `deprecated-config-claude` warning emitted at engine/shared.js:2492-2495 must report zero hits across all known engines for >=30 consecutive days, AND a sweep of every persisted config.json must show no `config.claude.binary` value that diverges from DEFAULT_CLAUDE.binary. Only then is the override branch in resolveBinary() (engine/runtimes/claude.js:82-86) removable, along with the `_deprecatedConfigClaudeFields` membership for `binary` and the warning emitter at engine/shared.js:2482-2496.",
     "targetRemovalDate": null,
@@ -83,41 +52,13 @@
     "id": "legacy-cc-model-migration",
     "description": "applyLegacyCcModelMigration: in-memory shim that promotes legacy `engine.ccModel` to `engine.defaultModel` when defaultModel is unset, so single-model installs keep working after the runtime fleet refactor (P-3b8e5f1d). No on-disk rewrite — the persisted config.json continues to carry the legacy `ccModel` field. Called unconditionally on every engine boot from cli.start().",
     "code": [
-      {
-        "file": "engine/shared.js",
-        "lines": "2407",
-        "note": "applyLegacyCcModelMigration definition (function signature + once-per-process flag via _resetLegacyCcModelMigrationFlag)"
-      },
-      {
-        "file": "engine/cli.js",
-        "lines": "477",
-        "note": "Boot call site inside start(); wrapped in try/catch so a migration failure cannot block startup"
-      },
-      {
-        "file": "CLAUDE.md",
-        "lines": "316",
-        "note": "Architectural documentation calling out the in-memory promotion contract"
-      },
-      {
-        "file": "docs/slim-ux/concepts.md",
-        "lines": "671",
-        "note": "Surface-level concepts doc cross-reference"
-      },
-      {
-        "file": "test/unit.test.js",
-        "lines": "19801",
-        "note": "Source-inspection test pinning the CLAUDE.md description against the function name"
-      },
-      {
-        "file": "test/unit/runtime-fleet-helpers.test.js",
-        "lines": "209-254",
-        "note": "Behavioural unit tests (promotion, no-op when defaultModel set, no-op when ccModel unset, empty-string handling, once-only logging, null-safety)"
-      },
-      {
-        "file": "test/unit/runtime-fleet-helpers.test.js",
-        "lines": "500-505",
-        "note": "Source-inspection test pinning the cli.js boot call site"
-      }
+      { "file": "engine/shared.js", "lines": "2407", "note": "applyLegacyCcModelMigration definition (function signature + once-per-process flag via _resetLegacyCcModelMigrationFlag)" },
+      { "file": "engine/cli.js", "lines": "477", "note": "Boot call site inside start(); wrapped in try/catch so a migration failure cannot block startup" },
+      { "file": "CLAUDE.md", "lines": "316", "note": "Architectural documentation calling out the in-memory promotion contract" },
+      { "file": "docs/slim-ux/concepts.md", "lines": "671", "note": "Surface-level concepts doc cross-reference" },
+      { "file": "test/unit.test.js", "lines": "19801", "note": "Source-inspection test pinning the CLAUDE.md description against the function name" },
+      { "file": "test/unit/runtime-fleet-helpers.test.js", "lines": "209-254", "note": "Behavioural unit tests (promotion, no-op when defaultModel set, no-op when ccModel unset, empty-string handling, once-only logging, null-safety)" },
+      { "file": "test/unit/runtime-fleet-helpers.test.js", "lines": "500-505", "note": "Source-inspection test pinning the cli.js boot call site" }
     ],
     "removalGate": "Telemetry: the once-per-boot deprecation log line emitted by applyLegacyCcModelMigration (via the injected logger at engine/shared.js:2407) must show zero promotion events across all known engines for >=30 consecutive days, AND a sweep of every persisted config.json must confirm no `engine.ccModel` field remains. Once both conditions hold, removal deletes the function + _resetLegacyCcModelMigrationFlag export at engine/shared.js:4977, the boot call at engine/cli.js:477, the CLAUDE.md:316 paragraph and docs/slim-ux/concepts.md:671 reference, and the tests at runtime-fleet-helpers.test.js:209-254 + :500-505 + unit.test.js:19801.",
     "targetRemovalDate": null,
@@ -127,39 +68,14 @@
     "id": "sql-state-json-mirrors",
     "description": "Phase X.5 follow-up to the SQL state migration (commits 62bd6a2c..1111cf54, phases 0–7). Every engine state file that previously used mutateJsonFileLocked now routes through a SQL store, but each store still writes a JSON dual-write mirror after every mutation because a handful of direct-readers (a few unit tests + a couple of inline safeJson calls) have not been migrated to the SQL read path. Once those readers are confirmed routed through the SQL store (or rewritten to use the store's read helper), the mirror writers can be deleted and the JSON files retired.",
     "code": [
-      {
-        "file": "engine/dispatch-store.js",
-        "note": "_mirrorJsonFromSql + _readDispatchJsonFallback — used when SQL is empty AND JSON has content (test seeding + first-time hydrate)"
-      },
-      {
-        "file": "engine/work-items-store.js",
-        "note": "_mirrorJsonFromSql + _readJsonArrayFallback (per scope) — same fallback contract as dispatch-store"
-      },
-      {
-        "file": "engine/pull-requests-store.js",
-        "note": "_mirrorJsonFromSql + _readJsonArrayFallback (per scope)"
-      },
-      {
-        "file": "engine/logs-store.js",
-        "note": "engine/log.json mirror written by shared._flushLogBuffer's byJsonPath loop — Phase 4.5 will retire"
-      },
-      {
-        "file": "engine/metrics-store.js",
-        "note": "_mirrorJsonFromSql + _readJsonObjectFallback"
-      },
-      {
-        "file": "engine/watches-store.js",
-        "note": "_mirrorJsonFromSql + _readJsonArrayFallback"
-      },
-      {
-        "file": "engine/small-state-store.js",
-        "note": "_mirrorScheduleRunsJson, _mirrorPipelineRunsJson, _mirrorManagedProcessesJson, _mirrorWorktreePoolJson + each store's _readJson fallback path"
-      },
-      {
-        "file": "CLAUDE.md",
-        "lines": "47-66, 240-265",
-        "note": "State Files + Concurrency sections still describe JSON files as the source of truth; they describe a layered SQLite-then-mirror reality in places but the headline contract still reads as JSON-primary. Rewrite these sections to make SQL-as-source-of-truth the headline and the JSON mirrors a transitional compatibility detail."
-      }
+      { "file": "engine/dispatch-store.js", "note": "_mirrorJsonFromSql + _readDispatchJsonFallback — used when SQL is empty AND JSON has content (test seeding + first-time hydrate)" },
+      { "file": "engine/work-items-store.js", "note": "_mirrorJsonFromSql + _readJsonArrayFallback (per scope) — same fallback contract as dispatch-store" },
+      { "file": "engine/pull-requests-store.js", "note": "_mirrorJsonFromSql + _readJsonArrayFallback (per scope)" },
+      { "file": "engine/logs-store.js", "note": "engine/log.json mirror written by shared._flushLogBuffer's byJsonPath loop — Phase 4.5 will retire" },
+      { "file": "engine/metrics-store.js", "note": "_mirrorJsonFromSql + _readJsonObjectFallback" },
+      { "file": "engine/watches-store.js", "note": "_mirrorJsonFromSql + _readJsonArrayFallback" },
+      { "file": "engine/small-state-store.js", "note": "_mirrorScheduleRunsJson, _mirrorPipelineRunsJson, _mirrorManagedProcessesJson, _mirrorWorktreePoolJson + each store's _readJson fallback path" },
+      { "file": "CLAUDE.md", "lines": "47-66, 240-265", "note": "State Files + Concurrency sections still describe JSON files as the source of truth; they describe a layered SQLite-then-mirror reality in places but the headline contract still reads as JSON-primary. Rewrite these sections to make SQL-as-source-of-truth the headline and the JSON mirrors a transitional compatibility detail." }
     ],
     "removalGate": "All direct-readers of the mirror JSON files must be confirmed routed through their respective SQL store's read helper. Specifically: (a) grep the codebase for `safeJson`, `safeJsonArr`, `safeJsonObj`, `readFileSync(...work-items.json|pull-requests.json|metrics.json|watches.json|schedule-runs.json|pipeline-runs.json|managed-processes.json|worktree-pool.json|log.json|dispatch.json...)` and confirm every hit is either (i) a test fixture that can move to the SQL helper, or (ii) intentionally documented as bypassing SQL. (b) Run the full test suite with each store's _mirrorJsonFromSql temporarily neutered (returning early before safeWrite) and confirm 0 failures — that proves no production code path depends on the mirror. Once both conditions hold, removal deletes each store's _mirrorJsonFromSql call site in shared.js (mutateWorkItems/mutatePullRequests/etc.), the corresponding _readJsonArrayFallback paths, and the JSON file gitignore entries. CLAUDE.md update can ship independently as soon as someone has bandwidth.",
     "targetRemovalDate": null,
@@ -169,51 +85,15 @@
     "id": "prune-default-claude-config",
     "description": "pruneDefaultClaudeConfig: active sanitizer that strips generated `config.claude.{binary,outputFormat,allowedTools,permissionMode}` defaults from persisted config.json so the `deprecated-config-claude` warning stops tripping on stale defaults left by older `minions init` versions. Sub-cluster of `config-claude-binary-override` — the prune deliberately preserves non-default user overrides (binary/allowedTools), which is what keeps the override branch in engine/runtimes/claude.js load-bearing.",
     "code": [
-      {
-        "file": "engine/shared.js",
-        "lines": "3126",
-        "note": "pruneDefaultClaudeConfig definition: preserves non-default binary/allowedTools, always strips permissionMode + outputFormat"
-      },
-      {
-        "file": "engine/shared.js",
-        "lines": "5673",
-        "note": "Module export entry"
-      },
-      {
-        "file": "dashboard.js",
-        "lines": "202",
-        "note": "Called when loading config for the dashboard UI"
-      },
-      {
-        "file": "dashboard.js",
-        "lines": "9116",
-        "note": "Called during first config save handler"
-      },
-      {
-        "file": "dashboard.js",
-        "lines": "9331",
-        "note": "Called during second config save path"
-      },
-      {
-        "file": "dashboard.js",
-        "lines": "9450",
-        "note": "Called during third config save path"
-      },
-      {
-        "file": "minions.js",
-        "lines": "385",
-        "note": "Called during CLI init/update flow"
-      },
-      {
-        "file": "test/unit.test.js",
-        "lines": "2260-2303",
-        "note": "Behavioural unit tests (default strip, override preservation, outputFormat unconditional strip) + dashboard call-site source pin"
-      },
-      {
-        "file": "test/unit/runtime-fleet-helpers.test.js",
-        "lines": "546",
-        "note": "Source-inspection test pinning the dashboard handler call site"
-      }
+      { "file": "engine/shared.js", "lines": "3126", "note": "pruneDefaultClaudeConfig definition: preserves non-default binary/allowedTools, always strips permissionMode + outputFormat" },
+      { "file": "engine/shared.js", "lines": "5673", "note": "Module export entry" },
+      { "file": "dashboard.js", "lines": "202", "note": "Called when loading config for the dashboard UI" },
+      { "file": "dashboard.js", "lines": "9116", "note": "Called during first config save handler" },
+      { "file": "dashboard.js", "lines": "9331", "note": "Called during second config save path" },
+      { "file": "dashboard.js", "lines": "9450", "note": "Called during third config save path" },
+      { "file": "minions.js", "lines": "385", "note": "Called during CLI init/update flow" },
+      { "file": "test/unit.test.js", "lines": "2260-2303", "note": "Behavioural unit tests (default strip, override preservation, outputFormat unconditional strip) + dashboard call-site source pin" },
+      { "file": "test/unit/runtime-fleet-helpers.test.js", "lines": "546", "note": "Source-inspection test pinning the dashboard handler call site" }
     ],
     "removalGate": "Telemetry: pruneDefaultClaudeConfig must return false (no mutation) for every call across all known engines for >=30 consecutive days (add an `_engine.pruneDefaultClaudeConfigStrips` counter if needed to observe this), AND the parent `config-claude-binary-override` entry must have already cleared its own gate. The dependency is strict: removing the prune while users still rely on the override branch would surface the `deprecated-config-claude` warning on every stale generated default. Once both conditions hold, removal is the function definition (engine/shared.js:3126), the export at :5673, all 5 call sites (dashboard.js:202, :9116, :9331, :9450; minions.js:385), and the tests at unit.test.js:2260-2303 + runtime-fleet-helpers.test.js:546.",
     "targetRemovalDate": null,
@@ -226,10 +106,7 @@
     "status": "removed",
     "removedDate": "2026-06-25",
     "code": [
-      {
-        "file": "engine/ado.js",
-        "note": "isAdoThrottled() arg-less branch and the global-OR fold over the per-org Map. Single call site to migrate: shared.getAdoOrgBase(project) is already in scope at every consumer."
-      }
+      { "file": "engine/ado.js", "note": "isAdoThrottled() arg-less branch and the global-OR fold over the per-org Map. Single call site to migrate: shared.getAdoOrgBase(project) is already in scope at every consumer." }
     ],
     "removalGate": "Two conditions must hold simultaneously: (a) grep `engine/ado.js` for `isAdoThrottled\\s*\\(\\s*\\)` and confirm zero arg-less call sites remain across the engine — every caller passes a concrete `orgBase` resolved via `shared.getAdoOrgBase(project)`; (b) `GET /api/diagnostics/ado-throttle` on a live engine has been observed for >=2 consecutive weeks reporting per-org keys (proves the per-org Map is populated under load and the global-OR isn't masking a regression). Once both hold, removal deletes the arg-less branch in isAdoThrottled and the global-OR fold; callers that still pass no argument become an immediate, surfaced bug rather than a silent over-throttle.",
     "targetRemovalDate": "2026-08-03",
@@ -273,13 +150,10 @@
     "id": "pr-observe-observe-body-param",
     "description": "Legacy `observe` body parameter on `POST /api/pull-requests/observe`. The W-mq5s5ttx000j7ab8 endpoint sub-WI introduces canonical `contextOnly` as the inverse (`observe: false` ⇔ `contextOnly: true`) and keeps `observe` accepted for backward compat. Registering the deprecation here so the alias has a documented removal path; the WI explicitly notes this entry is the implementer's call (it is kept for backward compat and may live longer than the underscore-prefixed record fields).",
     "code": [
-      {
-        "file": "dashboard.js",
-        "note": "POST /api/pull-requests/observe handler reads `body.contextOnly` first, then falls back to `!body.observe` for backwards compat."
-      }
+      { "file": "dashboard.js", "note": "POST /api/pull-requests/observe handler reads `body.contextOnly` first, then falls back to `!body.observe` for backwards compat." }
     ],
     "deprecated": "2026-06-08",
     "targetRemovalDate": null,
     "notes": "targetRemovalDate intentionally null — unlike the record-field aliases (`_contextOnly`, `_autoObserve`, `_manual`) which carry a 7-day clock, the `observe` body param is documented as a longer-lived back-compat alias. Set targetRemovalDate to a concrete future date once the dashboard UI + any client scripts are confirmed to POST `contextOnly` exclusively. Removal scope when the date is set: drop the `body.observe` fallback in dashboard.js, drop `observe` from the route registry params, and update any client still POSTing `observe`."
   }
-]
+]