@yemi33/minions 0.1.2293 → 0.1.2295

package/dashboard/js/settings.js

@@ -289,32 +289,6 @@ async function openSettings() {
           '⚠ Live mode: dispatches run directly in this repo\'s checkout. Only one mutating dispatch runs at a time. Dirty working trees block dispatch — commit or stash before running.' +
         '</div>' +
       '</div>';
-    // M006 — liveValidation section (per-project hybrid mode config).
-    // Controls: type (work item type that stays serialized in live checkout)
-    // and autoDispatch (auto-create validation WI after coding WI completes).
-    // Section is rendered with reduced opacity + pointer-events:none when
-    // checkoutMode is not 'live' — it only applies in hybrid mode.
-    var lvType = (p.liveValidation && p.liveValidation.type) ? p.liveValidation.type : '';
-    var lvAutoDispatch = !!(p.liveValidation && p.liveValidation.autoDispatch);
-    var lvDisabled = (currentWtMode !== 'live');
-    var lvSectionStyle = lvDisabled
-      ? 'opacity:0.45;pointer-events:none;margin-bottom:6px'
-      : 'margin-bottom:6px';
-    var liveValidationBlock =
-      '<div data-live-validation-section="' + escHtml(p.name) + '" data-search="live validation deferred build test auto dispatch worktree" style="' + lvSectionStyle + '">' +
-        '<label style="font-size:var(--text-sm);color:var(--muted);display:block;margin-bottom:2px">Live validation (deferred build/test)' +
-          (lvDisabled ? ' <span style="font-size:var(--text-xs);opacity:0.7">(requires Live checkout)</span>' : '') +
-        '</label>' +
-        '<div style="font-size:var(--text-xs);color:var(--muted);margin-bottom:4px;line-height:1.4">' +
-          'For checkoutMode: live projects — coding agents run in worktrees; a separate dispatch validates in live checkout.' +
-        '</div>' +
-        '<input id="set-liveValidationType-' + escHtml(p.name) + '" value="' + escHtml(lvType) + '" placeholder="e.g. build-and-test" style="width:100%;padding:4px 6px;background:var(--surface);border:1px solid var(--border);border-radius:4px;color:var(--text);font-size:var(--text-md);margin-bottom:4px">' +
-        '<div style="font-size:var(--text-xs);color:var(--muted);margin-bottom:4px">Validation work item type (e.g. <code>build-and-test</code>, <code>test</code>, <code>verify</code>). Leave blank to disable.</div>' +
-        '<div style="display:flex;align-items:center;gap:8px;padding:2px 0">' +
-          '<input type="checkbox" id="set-liveValidationAutoDispatch-' + escHtml(p.name) + '"' + (lvAutoDispatch ? ' checked' : '') + ' style="accent-color:var(--blue);width:16px;height:16px;cursor:pointer">' +
-          '<label for="set-liveValidationAutoDispatch-' + escHtml(p.name) + '" style="font-size:var(--text-md);color:var(--text);cursor:pointer">Auto-dispatch validation WI after coding WI completes</label>' +
-        '</div>' +
-      '</div>';
     return '<div data-settings-project="' + escHtml(p.name) + '" data-search="project ' + escHtml(p.name.toLowerCase()) + '" style="border:1px solid var(--border);border-radius:6px;padding:10px 12px;margin-bottom:12px">' +
       '<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:8px">' +
         '<div style="font-size:var(--text-md);font-weight:600">' + escHtml(p.name) + '</div>' +
@@ -323,7 +297,6 @@ async function openSettings() {
       pathRow +
       branchGrid +
       worktreeModeBlock +
-      liveValidationBlock +
       driftNote +
       '<div style="display:flex;flex-direction:column;gap:6px;margin-top:8px">' +
       settingsToggle('Discover from PRs', 'set-ws-prs-' + p.name, p.workSources.pullRequests.enabled, 'Discovery gate: scan repo for open PRs and surface them as review tasks. Independent of ADO/GitHub polling — does not affect already-tracked PRs.') +
@@ -729,14 +702,6 @@ async function openSettings() {
       const chip = document.querySelector('[data-checkout-mode-chip="' + (window.CSS && CSS.escape ? CSS.escape(projName) : projName) + '"]');
       if (!chip) return;
       chip.style.display = (sel.value === 'live') ? '' : 'none';
-      // M006 — also toggle the liveValidation section opacity/pointer-events
-      // reactively: disabled when checkoutMode is not 'live'.
-      const lvSection = document.querySelector('[data-live-validation-section="' + (window.CSS && CSS.escape ? CSS.escape(projName) : projName) + '"]');
-      if (lvSection) {
-        const isLive = (sel.value === 'live');
-        lvSection.style.opacity = isLive ? '' : '0.45';
-        lvSection.style.pointerEvents = isLive ? '' : 'none';
-      }
     });
   });
 }
@@ -1181,20 +1146,10 @@ async function saveSettings() {
       // values.
       const wtModeInput = document.getElementById('set-checkoutMode-' + p.name);
       const wtModeValue = (wtModeInput && wtModeInput.value === 'live') ? 'live' : 'worktree';
-      // M006 — liveValidation: read type text input and autoDispatch checkbox.
-      // Empty type → send null so the server clears the field.
-      const lvTypeInput = document.getElementById('set-liveValidationType-' + p.name);
-      const lvAutoDispatchInput = document.getElementById('set-liveValidationAutoDispatch-' + p.name);
-      const lvTypeValue = lvTypeInput ? lvTypeInput.value.trim() : '';
-      const lvAutoDispatchValue = lvAutoDispatchInput ? !!lvAutoDispatchInput.checked : false;
-      const liveValidationValue = lvTypeValue
-        ? { type: lvTypeValue, autoDispatch: lvAutoDispatchValue }
-        : null;
       return {
         name: p.name,
         mainBranch: mainBranchValue || null,
         checkoutMode: wtModeValue,
-        liveValidation: liveValidationValue,
         workSources: {
           pullRequests: { enabled: document.getElementById('set-ws-prs-' + p.name)?.checked ?? true },
           workItems: { enabled: document.getElementById('set-ws-wi-' + p.name)?.checked ?? true }

package/dashboard.js

@@ -430,21 +430,6 @@ function mergeSettingsConfigUpdate(current, candidate, body, patch = {}) {
       // `worktreeMode`. Drop any stale legacy key on every settings save so a
       // migrated project never carries both fields.
       delete currentProject.worktreeMode;
-      // M006 — mirror liveValidation: check both candidateProject (modified
-      // in-memory config) and the original body update. When handleSettingsUpdate
-      // deletes the field (null or empty type sent), candidateProject won't have
-      // it but the body update will — mirror the deletion to disk.
-      if (Object.prototype.hasOwnProperty.call(candidateProject, 'liveValidation')) {
-        if (candidateProject.liveValidation && typeof candidateProject.liveValidation === 'object' && candidateProject.liveValidation.type) {
-          currentProject.liveValidation = candidateProject.liveValidation;
-        } else {
-          delete currentProject.liveValidation;
-        }
-      } else if (Object.prototype.hasOwnProperty.call(update, 'liveValidation')) {
-        // Body sent liveValidation key but handleSettingsUpdate deleted it from
-        // the in-memory config (null / empty type) — propagate to disk.
-        delete currentProject.liveValidation;
-      }
     }
   }
   shared.pruneDefaultClaudeConfig(current);
@@ -10921,11 +10906,6 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           // the per-project dropdown. resolveCheckoutMode honors the legacy
           // worktreeMode field; 'worktree' (default) or 'live'.
           checkoutMode: shared.resolveCheckoutMode(p),
-          // M006 — surface liveValidation so the Settings UI can pre-fill
-          // the type input and autoDispatch toggle. Null when not configured.
-          liveValidation: (p.liveValidation && typeof p.liveValidation === 'object' && p.liveValidation.type)
-            ? { type: p.liveValidation.type, autoDispatch: !!p.liveValidation.autoDispatch }
-            : null,
           workSources: {
             pullRequests: { enabled: p.workSources?.pullRequests?.enabled !== false, cooldownMinutes: p.workSources?.pullRequests?.cooldownMinutes ?? 30 },
             workItems: { enabled: p.workSources?.workItems?.enabled !== false, cooldownMinutes: p.workSources?.workItems?.cooldownMinutes ?? 0 }
@@ -11350,19 +11330,10 @@ What would you like to discuss or change? When you're happy, say "approve" and I
             // Drop the legacy field so a migrated project never carries both.
             delete proj.worktreeMode;
           }
-          // M006 — per-project liveValidation: { type, autoDispatch }.
-          // Only meaningful when checkoutMode is 'live'. Null / missing type
-          // clears the field; explicit object with a non-empty type persists it.
-          if (Object.prototype.hasOwnProperty.call(update, 'liveValidation')) {
-            const lv = update.liveValidation;
-            if (!lv || typeof lv !== 'object' || !lv.type || typeof lv.type !== 'string' || !lv.type.trim()) {
-              delete proj.liveValidation;
-            } else {
-              proj.liveValidation = { type: lv.type.trim(), autoDispatch: !!lv.autoDispatch };
-            }
-          }
         }
       }
+
+      shared.pruneDefaultClaudeConfig(config);
       mutateDashboardConfig(current => mergeSettingsConfigUpdate(current, config, body, _configPatch));
       // Refresh in-memory CONFIG so subsequent reads see the update
       reloadConfig();
@@ -13427,7 +13398,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     // /api/prd/regenerate removed — use /api/plans/approve which does diff-aware update
 
     // Agents
-    { method: 'POST', path: '/api/pull-requests/link', desc: 'Manually link an external PR for tracking', params: 'url, title?, project?, contextOnly?, context?, workItemId?', handler: async (req, res) => {
+    { method: 'POST', path: '/api/pull-requests/link', desc: 'Manually link an external PR for tracking', params: 'url, title?, project?, contextOnly?, autoObserve? (deprecated alias for !contextOnly), context?, workItemId?', handler: async (req, res) => {
       const body = await readBody(req);
       const { url } = body;
       if (!url) return jsonReply(res, 400, { error: 'url required' });

package/docs/deprecated.json

@@ -52,6 +52,7 @@
       "LEGACY_NEEDS_REVIEW_STATUS"
     ],
     "reason": "Read-side tolerance: cleanup sweep auto-migrates four obsolete work-item / PRD status strings ('in-pr', 'implemented', 'complete', 'needs-human-review') to the canonical 'done' / 'failed' values. The aliases are no longer written anywhere in the engine; the constants exist only to repair stale on-disk values from old engine versions.",
+    "status": "active",
     "targetRemovalDate": null,
     "notes": "Keep indefinitely until telemetry / a sweep log shows zero migrations performed for 30 consecutive days across all known projects (work-items.json + prd/*.json). At that point the constants and both _migrateLegacyItem branches in engine/cleanup.js (definitions at :1165-1166; usage at :1168-1183 for work items and :1269-1272 for PRD missing_features) can be deleted. Total cost on disk today: 4 strings."
   },
@@ -76,6 +77,7 @@
       }
     ],
     "removalGate": "Telemetry: the `deprecated-config-claude` warning emitted at engine/shared.js:2492-2495 must report zero hits across all known engines for >=30 consecutive days, AND a sweep of every persisted config.json must show no `config.claude.binary` value that diverges from DEFAULT_CLAUDE.binary. Only then is the override branch in resolveBinary() (engine/runtimes/claude.js:82-86) removable, along with the `_deprecatedConfigClaudeFields` membership for `binary` and the warning emitter at engine/shared.js:2482-2496.",
+    "status": "active",
     "targetRemovalDate": null,
     "notes": "Do NOT set targetRemovalDate — removal must be signal-gated, not calendar-gated. This entry is paired with `prune-default-claude-config`: the prune strips DEFAULT-matching values but intentionally preserves user overrides, which is precisely why the override branch in claude.js stays reachable. Removing the override before the prune entry's gate clears would silently break installs that still rely on a custom binary path."
   },
@@ -120,6 +122,7 @@
       }
     ],
     "removalGate": "Telemetry: the once-per-boot deprecation log line emitted by applyLegacyCcModelMigration (via the injected logger at engine/shared.js:2407) must show zero promotion events across all known engines for >=30 consecutive days, AND a sweep of every persisted config.json must confirm no `engine.ccModel` field remains. Once both conditions hold, removal deletes the function + _resetLegacyCcModelMigrationFlag export at engine/shared.js:4977, the boot call at engine/cli.js:477, the CLAUDE.md:316 paragraph and docs/slim-ux/concepts.md:671 reference, and the tests at runtime-fleet-helpers.test.js:209-254 + :500-505 + unit.test.js:19801.",
+    "status": "active",
     "targetRemovalDate": null,
     "notes": "Do NOT set targetRemovalDate — gating is signal-based. The function is silent on no-op (returns false without logging), so the meaningful telemetry signal is the absence of the promotion log line over the sweep window, NOT the absence of function invocations (cli.js calls it every boot regardless)."
   },
@@ -162,6 +165,7 @@
       }
     ],
     "removalGate": "All direct-readers of the mirror JSON files must be confirmed routed through their respective SQL store's read helper. Specifically: (a) grep the codebase for `safeJson`, `safeJsonArr`, `safeJsonObj`, `readFileSync(...work-items.json|pull-requests.json|metrics.json|watches.json|schedule-runs.json|pipeline-runs.json|managed-processes.json|worktree-pool.json|log.json|dispatch.json...)` and confirm every hit is either (i) a test fixture that can move to the SQL helper, or (ii) intentionally documented as bypassing SQL. (b) Run the full test suite with each store's _mirrorJsonFromSql temporarily neutered (returning early before safeWrite) and confirm 0 failures — that proves no production code path depends on the mirror. Once both conditions hold, removal deletes each store's _mirrorJsonFromSql call site in shared.js (mutateWorkItems/mutatePullRequests/etc.), the corresponding _readJsonArrayFallback paths, and the JSON file gitignore entries. CLAUDE.md update can ship independently as soon as someone has bandwidth.",
+    "status": "active",
     "targetRemovalDate": null,
     "notes": "Do NOT set targetRemovalDate — gating is signal-based, not calendar-based. The mirror writes are cheap (a few KB per write, sub-ms) so there is no production cost to keeping them indefinitely; the only reason to remove them is to simplify the codebase and lock in SQL-as-the-single-source-of-truth. Order matters: when retiring a specific store's mirror, retire the corresponding CLAUDE.md mention in the same PR so the docs never claim SQL-only while a mirror still writes."
   },
@@ -216,6 +220,7 @@
       }
     ],
     "removalGate": "Telemetry: pruneDefaultClaudeConfig must return false (no mutation) for every call across all known engines for >=30 consecutive days (add an `_engine.pruneDefaultClaudeConfigStrips` counter if needed to observe this), AND the parent `config-claude-binary-override` entry must have already cleared its own gate. The dependency is strict: removing the prune while users still rely on the override branch would surface the `deprecated-config-claude` warning on every stale generated default. Once both conditions hold, removal is the function definition (engine/shared.js:3126), the export at :5673, all 5 call sites (dashboard.js:202, :9116, :9331, :9450; minions.js:385), and the tests at unit.test.js:2260-2303 + runtime-fleet-helpers.test.js:546.",
+    "status": "active",
     "targetRemovalDate": null,
     "notes": "Do NOT set targetRemovalDate — gating is signal-based AND ordered. This entry MUST NOT be removed before `config-claude-binary-override` clears its gate, otherwise installs with stale defaults will flood the deprecation channel until their next config save. The 5 call sites form a complete coverage net: load (dashboard.js:202 + minions.js:385) + save (dashboard.js:9116/9331/9450), so any code path that touches config.json runs the sanitizer."
   },
@@ -281,6 +286,7 @@
       }
     ],
     "deprecated": "2026-06-08",
+    "status": "active",
     "targetRemovalDate": null,
     "notes": "targetRemovalDate intentionally null — unlike the record-field aliases (`_contextOnly`, `_autoObserve`, `_manual`) which carry a 7-day clock, the `observe` body param is documented as a longer-lived back-compat alias. Set targetRemovalDate to a concrete future date once the dashboard UI + any client scripts are confirmed to POST `contextOnly` exclusively. Removal scope when the date is set: drop the `body.observe` fallback in dashboard.js, drop `observe` from the route registry params, and update any client still POSTing `observe`."
   },

package/docs/live-checkout-mode.md

@@ -173,60 +173,6 @@ git for-each-ref --format '%(refname:short) %(upstream:track)' refs/heads \
 
 The engine has no opinion about local branches; this hygiene is the operator's responsibility in live mode.
 
-## Hybrid mode / deferred validation
-
-> **Requires `checkoutMode: 'live'`** — `liveValidation` is ignored when `checkoutMode` is `'worktree'` (the default).
-
-Hybrid mode lets you run *coding* work items (implement, fix, docs, …) in isolated worktrees while keeping *validation* work items (build-and-test, test, verify, …) serialized in live checkout — the setup where build caches, native toolchains, and test infrastructure only exist in one canonical checkout.
-
-### Full flow
-
-1. **Coding WI dispatched** — because `liveValidation.type` is set and this WI's type is *not* the validation type, `resolveCheckoutMode(project, workItem.type)` returns `'worktree'`. The engine creates an isolated worktree as normal, runs the agent, and pushes a PR branch.
-2. **Coding WI completes** — if `liveValidation.autoDispatch: true`, the lifecycle hook (`engine/lifecycle.js`) auto-creates a validation WI of type `liveValidation.type` targeting the same PR branch.
-3. **Validation WI dispatched** — `resolveCheckoutMode(project, 'build-and-test')` returns `'live'` (matches `liveValidation.type`). The engine runs `prepareLiveCheckout` in the operator's canonical checkout, which checks out the coding WI's branch in-place and runs the validation agent.
-4. **Validation WI completes** — `restoreLiveCheckoutAtDispatchEnd` checks the operator's tree back to the original ref.
-
-### Config snippet
-
-```jsonc
-{
-  "projects": [{
-    "name": "android-aosp",
-    "localPath": "/home/yemi/aosp",
-    "checkoutMode": "live",
-    "liveValidation": {
-      "type": "build-and-test",
-      "autoDispatch": true
-    }
-  }]
-}
-```
-
-Configure via Dashboard → Settings → Projects → **Live validation (deferred build/test)** section. The section is greyed-out when `checkoutMode` is not `'live'`.
-
-### Agent behavior contract
-
-When a coding agent is dispatched on a project with `liveValidation.autoDispatch: true`, the agent's playbook includes a note that inline build/test runs are not required:
-
-> Skip inline build and test verification steps — a separate validation dispatch will run these in the live checkout after this coding WI completes. Push the branch and report success; the validation WI handles build/test confirmation.
-
-This prevents coding agents (running in isolated worktrees) from attempting builds that may fail due to missing native toolchains, caches, or environment variables only present in the canonical checkout.
-
-### Migration guidance
-
-If your project is on `checkoutMode: live` and you want parallel coding WIs, add:
-
-```jsonc
-"liveValidation": { "type": "build-and-test", "autoDispatch": true }
-```
-
-No other config changes needed. The engine automatically:
-- Dispatches coding WIs into isolated worktrees (escaping the live-checkout cap of 1)
-- Dispatches validation WIs serially in live checkout (preserving your build environment)
-- Auto-creates validation WIs after each coding WI's PR is pushed
-
-To opt back out, clear `liveValidation` from the project config (or set to `null` via Dashboard → Settings).
-
 ## Non-goals
 
 Live-checkout mode is deliberately small. These are NOT supported and will not be added:

package/docs/named-agents.md

@@ -86,7 +86,7 @@ defaults (`WORKSPACE_MANIFEST_DEFAULTS` in `engine/shared.js`):
 
 Enforcement helpers (also in `engine/shared.js`): `validateWorkspaceManifest`,
 `resolveAgentManifest`, `agentCanUseRepo`, `agentCanUseTool`, `agentCanFetchUrl`,
-`agentMemoryScope`, `mergeManifestAllowedTools`. Today the engine actively enforces (a) the
+`mergeManifestAllowedTools`. Today the engine actively enforces (a) the
 **repo gate** at dispatch time in `engine.js spawnAgent`
 (`FAILURE_CLASS.WORKSPACE_MANIFEST_REPO`, non-retryable) and (b) the **tool merge** into the
 runtime `--allowedTools` flag at spawn time. Defaults are permissive — an agent with no

package/docs/workspace-manifests.md

@@ -31,7 +31,7 @@ A manifest lives on each agent definition under `workspace_manifest`. All fields
 | `allowed_tools` | `string[]` \| `null` | `null` (permissive) | Canonical tool-name whitelist (e.g. `Edit`, `Read`, `Bash`). Empty array = deny all. Case-sensitive. Merged into the runtime adapter's `--allowedTools` flag at spawn time. |
 | `allowed_repos` | `string[]` \| `null` | `null` (permissive) | Canonical PR-scope (`github:owner/repo`, `ado:org/proj/repo`) or bare `owner/repo`. Empty array = deny all. Case-insensitive. Enforced at dispatch time — out-of-scope dispatch fails with `failure_class: 'workspace-manifest-repo-forbidden'`. |
 | `allowed_external_urls` | `string[]` \| `null` | `null` (permissive) | Host allow-list for `web_fetch` / `web_search`. Bare host (`github.com`) = exact match; `*.example.com` = wildcard subdomain **and** apex. Empty array = deny all. Currently advisory — see "Enforcement points" below. |
-| `memory_scope` | `'private'` \| `'shared'` \| `'read-only-shared'` | `'shared'` | What slice of team knowledge the agent can read/write. Currently exposed via `shared.agentMemoryScope(agent)` for callers that want to gate inbox writes; full enforcement at the consolidation layer is future work. |
+| `memory_scope` | `'private'` \| `'shared'` \| `'read-only-shared'` | `'shared'` | What slice of team knowledge the agent can read/write. Full enforcement at the consolidation layer is future work. |
 
 ## Default behaviour & backward compatibility
 
@@ -57,21 +57,20 @@ A config that never mentions `workspace_manifest` produces the exact same dispat
 | **Spawn — tool merge** | `engine.js spawnAgent()` → `_buildAgentSpawnFlags(..., allowedTools)` | `shared.mergeManifestAllowedTools(claudeConfig.allowedTools, manifest.allowed_tools)` produces the intersection of the runtime baseline and the manifest list. Result is passed as `--allowedTools <csv>` to Claude / Copilot / Codex, so the CLI itself enforces the narrowed surface. Empty manifest list (`[]`) = deny-all. Same merge runs on the steering-resume codepath. |
 | **Agent context** | Future work (playbook.js) | Manifest can be surfaced into the agent prompt so the agent sees its declared scope. Today, `shared.resolveAgentManifest(agent)` returns the resolved struct any caller can read. |
 | **URL fetch** | Advisory today | `allowed_external_urls` is validated at config load. No runtime helper function — a future runtime adapter hook can wire URL-fetch intercepts against the manifest. |
-| **Memory scope** | Advisory today | `shared.agentMemoryScope(agent)` is available for consolidation / playbook / inbox callers. Semantics: `private` = agent only sees its own `knowledge/agents/<id>.md`; `shared` = full team knowledge (current default); `read-only-shared` = reads shared memory but should not write inbox/notes. |
+| **Memory scope** | Advisory today | `memory_scope` field is stored in the manifest (`private` = agent only sees its own `knowledge/agents/<id>.md`; `shared` = full team knowledge (current default); `read-only-shared` = reads shared memory but should not write inbox/notes). No runtime enforcement helper — full enforcement at the consolidation layer is future work. |
 
 ## Helpers (in `engine/shared.js`)
 
 ```js
 const { MEMORY_SCOPES, WORKSPACE_MANIFEST_DEFAULTS,
         validateWorkspaceManifest, resolveAgentManifest,
-        agentCanUseRepo, agentMemoryScope,
+        agentCanUseRepo,
         mergeManifestAllowedTools, formatManifestRejection } = require('./engine/shared');
 ```
 
 - `validateWorkspaceManifest(manifest)` → `{ ok, errors }`. `null`/`undefined` is valid (uses defaults).
 - `resolveAgentManifest(agent, config?)` → fresh copy of `WORKSPACE_MANIFEST_DEFAULTS` overlaid with the agent's `workspace_manifest`. Malformed manifest silently falls back to defaults; surface the error via `validateWorkspaceManifest` at config-load time.
 - `agentCanUseRepo(agent, projectOrString)` → `bool`. Accepts a project object or a string identifier (`github:owner/repo`, `ado:org/proj/repo`, or bare `owner/repo`). Case-insensitive.
-- `agentMemoryScope(agent)` → one of `MEMORY_SCOPES`. Unknown values fall back to `'shared'`.
 - `mergeManifestAllowedTools(baselineCsv, manifestArray)` → merged CSV. Intersection semantics: `null` manifest = baseline unchanged; empty array = deny-all; empty baseline + manifest = manifest as ceiling.
 - `formatManifestRejection({ agentId, kind, target, allowed })` → structured human-readable rejection string used by the dispatch repo gate.
 

package/engine/features.js

@@ -77,20 +77,7 @@ const FEATURES = {
     default: true,
     addedIn: '0.1.1916',
     requiredCcRuntime: 'copilot',
-  },
-  // prdReadsFromSql — Phase 10 step 3 read-flip. When ON, getPrdInfo sources its
-  // PRD list (existingPrds / verifyPrsByPlan / allPrdItems) from the SQL mirror
-  // (prds/prd_items/prd_verify_prs) after reconciling it from disk, instead of
-  // scanning prd/*.json directly. JSON stays canonical and the dual-write keeps
-  // SQL in sync; reconciliation catches PRDs written outside the chokepoint. The
-  // two code paths are proven output-equivalent by db-phase10-read-flip.test.js.
-  // Reversible: set `features.prdReadsFromSql: false` to fall back to the file
-  // scan instantly. Temporary migration gate — remove once the read-flip soaks.
-  'prdReadsFromSql': {
-    description: 'Source the dashboard PRD/plan read (getPrdInfo) from the SQL mirror instead of scanning prd/*.json. Reversible; the two paths are output-equivalent (Phase 10 step 3).',
-    default: true,
-    addedIn: '0.1.2090',
-    expires: '2026-12-01',
+    expires: '2026-09-01',
   },
   // prdJoinFromFk — Phase 10 step 4.3 render-join flip. When ON, getPrdInfo
   // resolves each PRD item to its work item via the stable SQL FK
@@ -99,8 +86,9 @@ const FEATURES = {
   // archived PRD share a feature id (footgun #7). PURELY ADDITIVE: the FK lookup
   // is tried first and falls back to the exact legacy id match for any row not
   // yet stamped, when the flag is OFF, or when SQL is unavailable — so flipping
-  // it off (or a NULL FK) reproduces current behavior byte-for-byte. Requires
-  // prdReadsFromSql (the FK only exists in SQL). Temporary migration gate.
+  // it off (or a NULL FK) reproduces current behavior byte-for-byte. The FK
+  // lives only in SQL (unconditional read source since Phase 10 step 3 was
+  // completed). Temporary migration gate.
   'prdJoinFromFk': {
     description: 'Resolve the dashboard WI↔PRD-item join via the SQL FK (work_items.prd_item_id) instead of the feature-id string match. Additive with a string-match fallback; reversible (Phase 10 step 4.3).',
     default: true,

package/engine/github.js

@@ -1935,6 +1935,9 @@ module.exports = {
   // Exported for testing
   isGitHub,
   getRepoSlug,
+  getConfiguredGitHubAuthorLogins, // exported for testing (W-mqyn73pa000333c4)
+  _commentKey, // exported for testing (W-mqyn73pa000333c4)
+  _entryCommentKey, // exported for testing (W-mqyn73pa000333c4)
   isSlugInBackoff,
   recordSlugFailure,
   resetSlugBackoff,

package/engine/lifecycle.js

@@ -60,6 +60,29 @@ function checkPlanCompletion(meta, config) {
   const workItemById = {};
   for (const w of planItems) { if (w.id) workItemById[w.id] = w; }
 
+  // Self-heal stale completion. checkPlanCompletion only ever ADVANCED a plan to
+  // `completed` — it never reverted. So a PRD that was completed and then gained
+  // a late item (e.g. a build-fix appended post-completion) or had an item
+  // regress / lose its WI got stuck `completed` forever: the materializer SKIPS
+  // `completed` PRDs (engine.js#materializePlansAsWorkItems), so the new item
+  // never materializes, and the gates below return early without clearing the
+  // flag — a permanent "completed PRD with a missing item" (the P-mqyp0006 /
+  // "Fix PR #341 failing build" incident). Re-open such a plan so the
+  // materializer recreates the missing WI and the normal completion flow resumes.
+  // Idempotent: once reverted (status active, flag cleared) the guard no-ops, so
+  // it cannot flap on subsequent scans while the item is genuinely incomplete.
+  const reopenStaleCompletedPlan = (reason) => {
+    if (plan.status !== PLAN_STATUS.COMPLETED && !plan._completionNotified) return false;
+    log('warn', `Plan ${planFile}: re-opening stale completed PRD — ${reason}`);
+    mutateJsonFileLocked(planPath, (data) => {
+      if (data.status === PLAN_STATUS.COMPLETED) data.status = PLAN_STATUS.ACTIVE;
+      delete data.completedAt;
+      data._completionNotified = false;
+      return data;
+    });
+    return true;
+  };
+
   // Check 1: every feature must have a work item (materialized)
   // Fallback: also accept features marked done directly in the PRD JSON (resolved externally)
   const unmaterialized = [...planFeatureIds].filter(id => {
@@ -69,19 +92,27 @@ function checkPlanCompletion(meta, config) {
   });
   if (unmaterialized.length > 0) {
     log('info', `Plan ${planFile}: ${unmaterialized.length}/${planFeatureIds.size} feature(s) not yet materialized as work items: ${unmaterialized.join(', ')}`);
+    reopenStaleCompletedPlan(`${unmaterialized.length} unmaterialized item(s): ${unmaterialized.join(', ')}`);
     return;
   }
 
   // Check 2: every feature must be in a terminal state (done, failed, or cancelled).
   // Failed/cancelled items are unrecoverable — waiting on them blocks the plan indefinitely.
+  // P-a2b4c6d8: when a work item EXISTS, use ONLY the work item's status — do NOT fall
+  // through to the PRD item's own status field as a shortcut. If syncPrdItemStatus stamped
+  // the PRD item 'done' ahead of the actual WI completing (race / premature write), the old
+  // fallback incorrectly passed the gate and triggered early verify WI creation. The PRD item
+  // status is only a valid fallback when NO work item has been materialized for that feature
+  // (externally-resolved items that were never dispatched).
   const notTerminal = [...planFeatureIds].filter(id => {
     const w = workItemById[id];
-    if (w && PLAN_TERMINAL_STATUSES.has(w.status)) return false;
+    if (w) return !PLAN_TERMINAL_STATUSES.has(w.status); // WI exists: trust WI status only
     const prdItem = (plan.missing_features || []).find(f => f.id === id);
     return !(prdItem && PLAN_TERMINAL_STATUSES.has(prdItem.status));
   });
   if (notTerminal.length > 0) {
     log('info', `Plan ${planFile}: waiting for ${notTerminal.length}/${planFeatureIds.size} item(s) to reach terminal state: ${notTerminal.join(', ')}`);
+    reopenStaleCompletedPlan(`${notTerminal.length} non-terminal item(s): ${notTerminal.join(', ')}`);
     return;
   }
 
@@ -815,6 +846,22 @@ function stampPrdItemWorkItemId(itemId, sourcePlan) {
   } catch (err) { log('warn', `stampPrdItemWorkItemId: ${err.message}`); }
 }
 
+function stampPrdItemPrUrl(itemId, sourcePlan, prUrl) {
+  if (!itemId || !sourcePlan || !prUrl) return;
+  try {
+    const fpath = path.join(PRD_DIR, sourcePlan);
+    if (!fs.existsSync(fpath)) return;
+    const plan = safeJsonNoRestore(fpath);
+    const feature = plan?.missing_features?.find(f => f.id === itemId);
+    if (!feature || feature.pr_url === prUrl) return;
+    mutateJsonFileLocked(fpath, (fresh) => {
+      const f = fresh?.missing_features?.find(x => x.id === itemId);
+      if (f && f.pr_url !== prUrl) f.pr_url = prUrl;
+      return fresh;
+    }, { skipWriteIfUnchanged: true });
+  } catch (err) { log('warn', `stampPrdItemPrUrl: ${err?.message || err}`); }
+}
+
 // ─── PRD Backward-Scan Reconciliation (#929, #984) ─────────────────────────
 // Proactive counterpart to syncPrdItemStatus. Scans all active PRDs and:
 // 1. Promotes "missing" items to "updated" when a done work item already exists (#929)
@@ -1088,6 +1135,7 @@ function syncPrsFromOutput(output, agentId, meta, config, opts = {}) {
       url: prUrl,
       prdItems: meta?.item?.id ? [meta.item.id] : [],
       sourcePlan: meta?.item?.sourcePlan || '',
+      prdItemId: meta?.item?.id || '',
       itemType: meta?.item?.itemType || '',
       contextOnly: shouldSyncPrAsContextOnly(meta),
     };
@@ -5834,6 +5882,25 @@ function syncPrdFromPrs(config) {
     if (totalReconciled > 0) {
       log('info', `PR sync: reconciled ${totalReconciled} work item(s) to done`);
     }
+
+    // Stamp pr_url onto PRD items for every PR that has prdItems[] + a URL (P-b3c2d4e5).
+    // This is separate from the done-reconcile loop above — we stamp pr_url as soon as
+    // we know the PR exists, regardless of merged/open status.
+    for (const pr of allPrs) {
+      if (!pr?.url || !Array.isArray(pr.prdItems) || pr.prdItems.length === 0) continue;
+      for (const itemId of pr.prdItems) {
+        if (!itemId) continue;
+        let sourcePlan = pr.sourcePlan;
+        if (!sourcePlan) {
+          for (const project of allProjects) {
+            const items = safeJsonArr(shared.projectWorkItemsPath(project));
+            const wi = items.find(w => w.id === itemId);
+            if (wi?.sourcePlan) { sourcePlan = wi.sourcePlan; break; }
+          }
+        }
+        if (sourcePlan) stampPrdItemPrUrl(itemId, sourcePlan, pr.url);
+      }
+    }
   } catch (err) {
     // Non-fatal — log and continue
     try { log('warn', `syncPrdFromPrs error: ${err?.message || err}`); } catch { /* engine not available */ }
@@ -6156,6 +6223,44 @@ function pruneScopeMismatchDuplicatePrs(config) {
   return { pruned, scanned };
 }
 
+// Repair helper: collapse prNumber duplicates across all project-scoped and
+// the central pull-requests file.  Called once per reconcile cycle alongside
+// pruneScopeMismatchDuplicatePrs so accumulated duplicates are cleaned up
+// without requiring a one-off migration.
+function collapseAllDuplicatePrRecords(config) {
+  config = config || getConfig();
+  const projects = shared.getProjects(config) || [];
+  let collapsed = 0;
+  let scanned = 0;
+
+  for (const project of projects) {
+    if (!project || !project.name) continue;
+    const prPath = projectPrPath(project);
+    try {
+      const result = shared.collapseDuplicatePrRecords(prPath, { project });
+      collapsed += result.collapsed || 0;
+      scanned++;
+    } catch (err) {
+      log('warn', `collapseAllDuplicatePrRecords: failed for project=${project.name}: ${err?.message || err}`);
+    }
+  }
+
+  // Central file (no project context — normalization uses URL-only scope).
+  const centralPath = path.join(MINIONS_DIR, 'pull-requests.json');
+  try {
+    const result = shared.collapseDuplicatePrRecords(centralPath, {});
+    collapsed += result.collapsed || 0;
+    scanned++;
+  } catch (err) {
+    log('warn', `collapseAllDuplicatePrRecords: failed for central file: ${err?.message || err}`);
+  }
+
+  if (collapsed > 0) {
+    log('info', `[pull-requests] collapseAllDuplicatePrRecords: collapsed ${collapsed} duplicate(s) across ${scanned} scope(s)`);
+  }
+  return { collapsed, scanned };
+}
+
 // M003 — After a coding WI completes successfully, auto-dispatch a live-validation
 // WI when project.liveValidation.autoDispatch === true and the completed item is
 // a coding WI (not the validation type itself). Skips if the coding WI has no PR.
@@ -6237,6 +6342,7 @@ module.exports = {
   reconcilePrdStatuses,
   syncPrsFromOutput,
   pruneScopeMismatchDuplicatePrs,
+  collapseAllDuplicatePrRecords,
   updatePrAfterReview,
   updatePrAfterFix,
   updatePrAfterFixError,
@@ -6304,6 +6410,7 @@ module.exports = {
   normalizePrFixBranchName,
   stampWiPrRef,
   stampPrdItemWorkItemId,
+  stampPrdItemPrUrl,
   // M003 — auto-dispatch live-validation WI after coding WI completion.
   autoDispatchLiveValidationWi,
 };

package/engine/playbook.js

@@ -394,6 +394,11 @@ const PLAYBOOK_OPTIONAL_VARS = new Set([
   // Both are optional; playbooks that don't reference them receive empty strings.
   'from_agent',
   'from_conclusion',
+  // P-mqyp0008v022w3x4 (SHERLOC) — prior explore WI resultSummary injected into
+  // fix dispatches when a completed explore WI references the fix WI. Empty string
+  // when no prior explore WI exists; the {{#prior_explore_context}} conditional
+  // in fix.md renders the section only when non-empty.
+  'prior_explore_context',
 ]);
 
 const PLAYBOOK_REQUIRED_VARS = {
@@ -1011,11 +1016,11 @@ function renderPlaybook(type, vars) {
 // ─── Playbook Section Validator ──────────────────────────────────────────────
 
 // Required structural section patterns — warn (do not throw) when absent.
-// NOTE: '## Tools' / '## Constraints' are NOT included because none of the
-// production playbooks use those headers. Only '## Your Task' is universally
-// present — it is injected by renderPlaybook via the playbook template.
+// Pluralisation: /^## Tools?\b/m matches both '## Tool' and '## Tools'.
 const _REQUIRED_PROMPT_SECTIONS = [
-  { pattern: /^## Your Task\b/m, label: '## Your Task' },
+  { pattern: /^## Your Task\b/m,   label: '## Your Task' },
+  { pattern: /^## Tools?\b/m,      label: '## Tools' },
+  { pattern: /^## Constraints\b/m, label: '## Constraints' },
 ];
 
 /**

package/engine/queries.js

@@ -2077,8 +2077,7 @@ function getWorkItems(config, opts) {
 
 // ── PRD Progress ────────────────────────────────────────────────────────────
 
-// Module-level caches for getPrdInfo() — avoids re-reading unchanged PRD files
-const _prdFileCache = new Map();       // filePath → { mtimeMs, plan }
+// Module-level caches for getPrdInfo() — avoids re-reading unchanged PRD data
 let _prdDirMtimes = { prd: 0, archive: 0 }; // directory mtimes to detect new/deleted files
 let _prdResultCache = null;            // cached final result
 let _prdResultInputHash = '';          // hash of all input mtimes to detect any change
@@ -2141,31 +2140,22 @@ function getPrdInfo(config) {
   const verifyPrsByPlan = {};
   let latestStat = null;
 
-  // Check if directory listings need refresh
-  const dirsChanged = prdDirMtime !== _prdDirMtimes.prd || archiveDirMtime !== _prdDirMtimes.archive;
+  // Check if directory listings need refresh (used by mtime hash)
   _prdDirMtimes = { prd: prdDirMtime, archive: archiveDirMtime };
 
-  // Scan active PRDs and archived PRDs (completed PRDs still need to show progress)
-  const planDirs = [
-    { dir: PRD_DIR, archived: false },
-    { dir: path.join(PRD_DIR, 'archive'), archived: true },
-  ];
-
   // Phase 10 step 4.3 — FK-based WI↔PRD-item join scaffolding. `prdItemIdByKey`
   // maps `${physicalArchived} ${filename} ${feature_id}` → prd_items.id so each
-  // PRD item carries its stable surrogate id; built below once the SQL-read
-  // decision is known. Declared here so processPrd's closure can stamp
-  // `_prdItemId` at push time. Null when the FK join is off / SQL unavailable →
-  // the per-item join falls back to the legacy feature-id string match.
+  // PRD item carries its stable surrogate id. Declared here so processPrd's
+  // closure can stamp `_prdItemId` at push time. Null when the FK join is off /
+  // SQL unavailable → the per-item join falls back to the legacy feature-id
+  // string match.
   let useFkJoin = false;
   try { useFkJoin = require('./features').isFeatureOn('prdJoinFromFk', config); } catch { /* fall back to string join */ }
   let prdItemIdByKey = null;
 
-  // Phase 10 step 3 (read-flip) — both the disk scan and the SQL-mirror source
-  // funnel each PRD through this one processor, so the consumed shape
+  // Phase 10 step 3 (read-flip complete) — both disk-write and SQL-mirror sources
+  // funnel each PRD through this one processor so the consumed shape
   // (existingPrds / verifyPrsByPlan / allPrdItems) is identical by construction.
-  // The only difference is where `plan` + `mtimeMs` come from. Equivalence of the
-  // two paths is proven by test/unit/db-phase10-read-flip.test.js.
   const processPrd = (pf, archived, plan, mtimeMs) => {
     if (!plan || !plan.missing_features) return;
     // Phase 10 step 4.2: archived-ness is the FLAG, not the directory. `archived`
@@ -2215,14 +2205,12 @@ function getPrdInfo(config) {
     }
   };
 
-  let useSqlReads = false;
-  try { useSqlReads = require('./features').isFeatureOn('prdReadsFromSql', config); } catch { /* fall back to disk */ }
-
   // Build the feature → prd_items.id map before the read loop so processPrd can
-  // stamp _prdItemId. Only when the FK join is on AND we're SQL-sourced (the FK
-  // lives only in SQL). Best-effort: any failure leaves prdItemIdByKey null and
-  // the join silently falls back to the legacy feature-id string match.
-  if (useFkJoin && useSqlReads) {
+  // stamp _prdItemId. SQL is the unconditional source (Phase 10 step 3 complete),
+  // so the FK join just needs useFkJoin. Best-effort: any failure leaves
+  // prdItemIdByKey null and the join silently falls back to the legacy
+  // feature-id string match.
+  if (useFkJoin) {
     try {
       const db = require('./db').getDb();
       const map = new Map();
@@ -2233,65 +2221,24 @@ function getPrdInfo(config) {
     } catch { prdItemIdByKey = null; }
   }
 
-  if (useSqlReads) {
-    // SQL source: reconcile the mirror from disk (catches PRDs written outside
-    // the dual-write chokepoint — plan-to-prd agent direct writes, archive
-    // moves, deletes), then read each PRD's content from SQL. Files still live on
-    // disk in this phase, so stat them for the mtime fields + `age`.
+  // Phase 10 step 3 (read-flip complete) — SQL mirror is the unconditional
+  // source. reconcilePrdsFromDisk() catches PRDs written outside the dual-write
+  // chokepoint (plan-to-prd agent direct writes, archive moves, deletes). Files
+  // still live on disk in this phase, so stat them for mtime fields + `age`.
+  const prdStore = require('./prd-store');
+  prdStore.reconcilePrdsFromDisk();
+  for (const { filename, archived, plan } of prdStore.listPrdRows()) {
     try {
-      const prdStore = require('./prd-store');
-      prdStore.reconcilePrdsFromDisk();
-      for (const { filename, archived, plan } of prdStore.listPrdRows()) {
-        try {
-          const dir = archived ? path.join(PRD_DIR, 'archive') : PRD_DIR;
-          let mtimeMs = 0;
-          try {
-            const stat = fs.statSync(path.join(dir, filename));
-            mtimeMs = stat.mtimeMs;
-            if (!latestStat || stat.mtimeMs > latestStat.mtimeMs) latestStat = stat;
-          } catch { /* file may have just moved/deleted between reconcile and read */ }
-          processPrd(filename, archived, plan, mtimeMs);
-        } catch { /* optional */ }
-      }
-    } catch {
-      // Hard SQL failure → fall back to the disk scan so the dashboard never
-      // goes blank on a transient DB problem.
-      useSqlReads = false;
-    }
-  }
-
-  if (!useSqlReads) {
-    for (const { dir, archived } of planDirs) {
+      const dir = archived ? path.join(PRD_DIR, 'archive') : PRD_DIR;
+      let mtimeMs = 0;
       try {
-        const planFiles = fs.readdirSync(dir).filter(f => f.endsWith('.json')).sort();
-        for (const pf of planFiles) {
-          try {
-            const filePath = path.join(dir, pf);
-            const stat = fs.statSync(filePath);
-            if (!latestStat || stat.mtimeMs > latestStat.mtimeMs) latestStat = stat;
-
-            // Per-file mtime cache: only re-read files that changed
-            const cached = _prdFileCache.get(filePath);
-            let plan;
-            if (cached && cached.mtimeMs === stat.mtimeMs) {
-              plan = cached.plan;
-            } else {
-              plan = readJsonNoRestore(filePath);
-              _prdFileCache.set(filePath, { mtimeMs: stat.mtimeMs, plan });
-            }
-            processPrd(pf, archived, plan, stat.mtimeMs);
-          } catch { /* optional */ }
-        }
-        // Clean stale entries from file cache when dirs changed
-        if (dirsChanged) {
-          for (const cachedPath of _prdFileCache.keys()) {
-            if (cachedPath.startsWith(dir) && !fs.existsSync(cachedPath)) _prdFileCache.delete(cachedPath);
-          }
-        }
-      } catch { /* optional */ }
-    }
+        const stat = fs.statSync(path.join(dir, filename));
+        mtimeMs = stat.mtimeMs;
+        if (!latestStat || stat.mtimeMs > latestStat.mtimeMs) latestStat = stat;
+      } catch { /* file may have just moved/deleted between reconcile and read */ }
+      processPrd(filename, archived, plan, mtimeMs);
+    } catch { /* optional */ }
   }
-
   if (allPrdItems.length === 0) return { progress: null, status: null };
 
   const items = allPrdItems;
@@ -2331,7 +2278,7 @@ function getPrdInfo(config) {
   // objects we already loaded, keyed by wi.id (first-wins, matching allWiById).
   // Best-effort: null map → the join falls back to the legacy string match.
   let wiByPrdItemId = null;
-  if (useFkJoin && useSqlReads && prdItemIdByKey) {
+  if (useFkJoin && prdItemIdByKey) {
     try {
       const db = require('./db').getDb();
       const fkByWiId = new Map();
@@ -2437,6 +2384,20 @@ function getPrdInfo(config) {
     }
   }
 
+  // Fallback (P-b6c8d0e2): PR records stamped with prdItemId/sourcePlan at sync
+  // time. When the standard prLinks chain doesn't cover a PRD item (e.g. the WI
+  // id differs from the PRD feature id, or prLinks is stale), use the PR record's
+  // own prdItemId field to ensure the PRD view shows the PR.
+  for (const pr of allPrs) {
+    const prdItemIdFromPr = typeof pr.prdItemId === 'string' ? pr.prdItemId : '';
+    if (!prdItemIdFromPr || !prdItemIdSet.has(prdItemIdFromPr)) continue;
+    if (prdToPr[prdItemIdFromPr] && prdToPr[prdItemIdFromPr].length > 0) continue; // already covered
+    if (!prdToPr[prdItemIdFromPr]) prdToPr[prdItemIdFromPr] = [];
+    const url = buildPrUrlFromId(pr.id, pr, projects);
+    prdToPr[prdItemIdFromPr].push({ id: pr.id, url, title: pr.title || '', status: pr.status || PR_STATUS.ACTIVE, _project: pr._project || '' });
+  }
+
+
   // PRD JSON status is the source of truth — kept in sync with work item by syncPrdItemStatus.
   // Map from PRD JSON values to display values (pending → missing for undispatched items)
   // Augment each item with execution metadata from the work item.
@@ -2523,7 +2484,6 @@ function getPrdInfo(config) {
 
 /** Reset PRD info cache — exported for testing */
 function resetPrdInfoCache() {
-  _prdFileCache.clear();
   _prdDirMtimes = { prd: 0, archive: 0 };
   _prdResultCache = null;
   _prdResultInputHash = '';

package/engine/shared.js

@@ -1782,6 +1782,23 @@ function _tryRouteMutateToSql(filePath, mutateFn, onWrote) {
   if (smallRoute) {
     if (!fpNorm.endsWith('/engine/' + baseName)) return null;
     const store = require('./small-state-store');
+    // Pre-warm the SQLite DB BEFORE acquiring the file lock. On the very first
+    // call from a process (or after a test-isolation MINIONS_TEST_DIR swap),
+    // getDb() opens the DB file and runs migrations — which can take tens of
+    // milliseconds on a loaded box. When 5+ concurrent processes all hit this
+    // path simultaneously, whichever one wins the file lock holds it for the
+    // entire DB-init duration. The other 4 processes each have only a 5-second
+    // timeout window to acquire the lock; if DB init exceeds that, they throw
+    // "Lock timeout" and exit 1 (observed in CI after opg#552 backport which
+    // added a new test that increases system load during parallel runs).
+    // Pre-warming here means getDb() returns the cached _db instantly when
+    // called again inside the lock, so the lock is held only for the fast
+    // SQL transaction + mirror write — not for DB initialization.
+    try {
+      require('./db').getDb();
+    } catch (e) {
+      throw new Error(`small-state-store: SQLite unavailable — ${e.message}`);
+    }
     // Hold the JSON file lock across the SQL transaction AND the mirror
     // write. The SQL transaction itself is cross-process serialized via
     // BEGIN IMMEDIATE inside the SQL store, but the JSON mirror is a
@@ -2679,21 +2696,12 @@ const CHECKOUT_MODES = Object.freeze({ WORKTREE: 'worktree', LIVE: 'live' });
 function resolveCheckoutMode(project, workItemType) {
   if (!project || typeof project !== 'object') return CHECKOUT_MODES.WORKTREE;
   const canonical = project.checkoutMode;
-  // Resolve the effective mode: canonical field first, then legacy worktreeMode fallback.
-  let effectiveMode;
-  if (canonical === CHECKOUT_MODES.LIVE || canonical === CHECKOUT_MODES.WORKTREE) {
-    effectiveMode = canonical;
-  } else if (project.worktreeMode === 'live') {
-    effectiveMode = CHECKOUT_MODES.LIVE;
-  } else {
-    effectiveMode = CHECKOUT_MODES.WORKTREE;
-  }
-  // liveValidation without an effective live mode is a misconfiguration — warn and ignore.
-  if (project.liveValidation && effectiveMode !== CHECKOUT_MODES.LIVE) {
+  // liveValidation without checkoutMode: 'live' is a misconfiguration — warn and ignore.
+  if (project.liveValidation && canonical !== CHECKOUT_MODES.LIVE) {
     log('warn', 'resolveCheckoutMode: liveValidation is set but checkoutMode is not "live" — liveValidation ignored',
       { projectName: project.name });
   }
-  if (effectiveMode === CHECKOUT_MODES.LIVE) {
+  if (canonical === CHECKOUT_MODES.LIVE) {
     // Apply liveValidation routing when the block is present and workItemType is provided.
     if (project.liveValidation && workItemType !== undefined) {
       return workItemType === project.liveValidation.type
@@ -2702,6 +2710,11 @@ function resolveCheckoutMode(project, workItemType) {
     }
     return CHECKOUT_MODES.LIVE;
   }
+  if (canonical === CHECKOUT_MODES.WORKTREE) return CHECKOUT_MODES.WORKTREE;
+  // Legacy field fallback (only consulted when checkoutMode is absent/unknown).
+  const legacy = project.worktreeMode;
+  if (legacy === 'live') return CHECKOUT_MODES.LIVE;
+  // legacy 'isolated' (and anything else) → the default worktree behavior.
   return CHECKOUT_MODES.WORKTREE;
 }
 
@@ -3643,8 +3656,14 @@ let _legacyCcModelMigrationLogged = false;
 function applyLegacyCcModelMigration(config, { logger = log } = {}) {
   if (!config || !config.engine || typeof config.engine !== 'object') return false;
   const e = config.engine;
-  if (e.defaultModel !== undefined && e.defaultModel !== null && e.defaultModel !== '') return false;
-  if (!(e.ccModel !== undefined && e.ccModel !== null && e.ccModel !== '')) return false;
+  if (e.defaultModel !== undefined && e.defaultModel !== null && e.defaultModel !== '') {
+    logger('info', 'legacy-cc-model-migration: no-op (0 records migrated), safe to schedule removal.');
+    return false;
+  }
+  if (!(e.ccModel !== undefined && e.ccModel !== null && e.ccModel !== '')) {
+    logger('info', 'legacy-cc-model-migration: no-op (0 records migrated), safe to schedule removal.');
+    return false;
+  }
   e.defaultModel = e.ccModel;
   if (!_legacyCcModelMigrationLogged) {
     _legacyCcModelMigrationLogged = true;
@@ -4860,12 +4879,6 @@ function agentCanUseRepo(agent, repoTarget) {
   return false;
 }
 
-/** Return the agent's effective memory scope. Unknown values fall back to 'shared'. */
-function agentMemoryScope(agent) {
-  const manifest = resolveAgentManifest(agent);
-  return MEMORY_SCOPES.includes(manifest.memory_scope) ? manifest.memory_scope : 'shared';
-}
-
 /**
  * Merge a manifest's `allowed_tools` list into the runtime adapter's existing
  * `allowedTools` CSV baseline. Returns the merged CSV string the runtime
@@ -7068,6 +7081,91 @@ function addPrLink(prId, itemId, { project = null, url = '', prNumber = null } =
   });
 }
 
+// Fields copied from "loser" duplicates into the winner when collapsing.
+// Additive (array-merge) fields are listed separately.
+const _DEDUP_MERGE_SCALAR_KEYS = [
+  'url', 'title', 'agent', 'branch', 'description', 'sourcePlan', 'itemType',
+  'mergedAt', 'closedAt', 'created', 'reviewStatus',
+  'minionsReview', '_automationFixCauses',
+];
+
+// Pick the "most complete" record from a list of duplicates.
+// Preference order:
+//   1. merged status (most terminal / most informative)
+//   2. record with a URL (enables live polling)
+//   3. record with more own keys (richer data)
+function _pickBestPrRecord(candidates) {
+  if (candidates.length === 1) return candidates[0];
+  const merged = candidates.filter(c => c && c.status === PR_STATUS.MERGED);
+  const pool = merged.length > 0 ? merged : candidates.filter(Boolean);
+  const withUrl = pool.filter(c => c.url);
+  const final = withUrl.length > 0 ? withUrl : pool;
+  return final.reduce((a, b) => Object.keys(b || {}).length > Object.keys(a || {}).length ? b : a);
+}
+
+// Merge non-conflicting fields from a loser duplicate into the winner.
+// Scalar fields are filled when winner is empty; prdItems are union-merged.
+function _mergeDuplicatePrInto(winner, loser) {
+  if (!winner || !loser) return;
+  for (const key of _DEDUP_MERGE_SCALAR_KEYS) {
+    if ((winner[key] == null || winner[key] === '') && loser[key] != null && loser[key] !== '') {
+      winner[key] = loser[key];
+    }
+  }
+  winner.prdItems = normalizePrLinkItems([...(winner.prdItems || []), ...(loser.prdItems || [])]);
+}
+
+/**
+ * P-e9f0a2b4 — One-time repair helper: collapse duplicate PR records that share
+ * the same `prNumber` within a single `pull-requests.json` file.
+ *
+ * Call this at engine start for every project's PR file (and the central file).
+ * Idempotent — no-op when no duplicates exist.
+ *
+ * Selection rule (matching the task spec):
+ *   1. Prefer `merged` status over any other status.
+ *   2. Among tied: prefer the record with a URL.
+ *   3. Among tied: prefer the record with more fields (richer data).
+ *   Fields unique to the losers are merged into the winner:
+ *     • scalar fields: filled only when the winner's field is empty
+ *     • prdItems: union-merged
+ *
+ * @param {string} prPath  Path to the pull-requests.json file.
+ * @param {{ project?: object|null }} opts  Optional project config for normalization.
+ * @returns {{ collapsed: number }}  Number of duplicate records removed.
+ */
+function collapseDuplicatePrRecords(prPath, { project = null } = {}) {
+  let collapsed = 0;
+  mutatePullRequests(prPath, (prs) => {
+    normalizePrRecords(prs, project);
+    // Group by prNumber.
+    const byNumber = new Map();
+    for (const pr of prs) {
+      if (!pr) continue;
+      const num = getPrNumber(pr);
+      if (num == null) continue;
+      if (!byNumber.has(num)) byNumber.set(num, []);
+      byNumber.get(num).push(pr);
+    }
+    // Identify loser records to remove (by object reference, not id, because
+    // normalization may have changed multiple records to the same canonical id).
+    const toRemove = new Set();
+    for (const [, group] of byNumber) {
+      if (group.length <= 1) continue;
+      const best = _pickBestPrRecord(group);
+      for (const dup of group) {
+        if (!dup || dup === best) continue;
+        _mergeDuplicatePrInto(best, dup);
+        toRemove.add(dup);
+        collapsed++;
+      }
+    }
+    if (toRemove.size === 0) return prs;
+    return prs.filter(pr => !toRemove.has(pr));
+  });
+  return { collapsed };
+}
+
 /**
  * Canonical PR-producing work contract helper.
  *
@@ -7121,6 +7219,26 @@ function upsertPullRequestRecord(prPath, entry, { project = null, itemId = null,
       skipped = true;
       return prs;
     }
+    // P-e9f0a2b4 — When findPrRecord returns null but multiple records share the
+    // same prNumber (e.g. cross-scope contamination or a project-config change
+    // that shifted canonical IDs), collapse the duplicates before inserting.
+    // Without this check, every subsequent upsert would append yet another record
+    // because numberMatches.length > 1 forces findPrRecord to return null.
+    if (!target && prNumber != null) {
+      const numberMatches = prs.filter(pr => pr && !pr.userDeleted && getPrNumber(pr) === prNumber);
+      if (numberMatches.length > 1) {
+        const best = _pickBestPrRecord(numberMatches);
+        const toRemoveIds = new Set(numberMatches.filter(p => p !== best).map(p => p.id));
+        for (const dup of numberMatches) {
+          if (dup === best) continue;
+          _mergeDuplicatePrInto(best, dup);
+        }
+        for (let i = prs.length - 1; i >= 0; i--) {
+          if (prs[i] && toRemoveIds.has(prs[i].id)) prs.splice(i, 1);
+        }
+        target = best; // update the surviving record instead of inserting new
+      }
+    }
     if (!target && typeof beforeInsert === 'function' && beforeInsert(prs, normalizedEntry) === false) {
       skipped = true;
       return prs;
@@ -7133,7 +7251,7 @@ function upsertPullRequestRecord(prPath, entry, { project = null, itemId = null,
       target.id = canonicalId;
       if (prNumber != null) target.prNumber = prNumber;
       const targetWasAutoManaged = isAutoManagedPrRecord(target);
-      for (const key of ['url', 'title', 'description', 'agent', 'branch', 'reviewStatus', 'status', 'created', 'sourcePlan', 'itemType']) {
+      for (const key of ['url', 'title', 'description', 'agent', 'branch', 'reviewStatus', 'status', 'created', 'sourcePlan', 'itemType', 'prdItemId']) {
         if (normalizedEntry[key] != null && normalizedEntry[key] !== '' && (target[key] == null || target[key] === '')) {
           target[key] = normalizedEntry[key];
         }
@@ -8969,7 +9087,6 @@ module.exports = {
   validateWorkspaceManifest,
   resolveAgentManifest,
   agentCanUseRepo,
-  agentMemoryScope,
   mergeManifestAllowedTools,
   formatManifestRejection,
   getProjects,
@@ -9021,6 +9138,7 @@ module.exports = {
   mergePrLinkItems, // exported for testing
   isContextOnlyPrRecord,
   upsertPullRequestRecord,
+  collapseDuplicatePrRecords, // P-e9f0a2b4 — one-time repair helper
   isAutoManagedPrRecord, // W-mq5s5ttx000j7ab8-a — exported for engine + watch-plugin gate consolidation
   autoEnrollPrFromWorkItem,
   autoEnrollPrFromFixWorkItem,

package/engine.js

@@ -168,7 +168,7 @@ const { runPostCompletionHooks, updateWorkItemStatus, syncPrdItemStatus, reconci
   syncPrsFromOutput, updatePrAfterReview, updatePrAfterFix, checkForLearnings, extractSkillsFromOutput,
   updateAgentHistory, updateMetrics, createReviewFeedbackForAuthor, parseAgentOutput, syncPrdFromPrs, persistVerifyPrsToPrd,
   isItemCompleted, classifyFailure: classifyFailureFallback, diagnoseEmptyOutput, processPendingRebases, resolveWorkItemPath,
-  mergeArtifactNotes, promoteCompletionArtifacts, pruneScopeMismatchDuplicatePrs } = require('./engine/lifecycle');
+  mergeArtifactNotes, promoteCompletionArtifacts, pruneScopeMismatchDuplicatePrs, collapseAllDuplicatePrRecords } = require('./engine/lifecycle');
 
 // ─── Diagnostics: memory + event-loop + GC sampler (P-a1b2c3d4 / P-b2c3d4e5) ─
 
@@ -6317,6 +6317,19 @@ function materializePlansAsWorkItems(config) {
         log('info', `Re-opened work item ${itemId} in ${rProjName} (cross-project, PRD item set to ${rItem.status})`);
       }
 
+      // Stamp workItemId onto each newly created PRD item immediately after WI creation (P-b3c2d4e5).
+      // Uses mutatePrdLocked so the write is protected by a file lock — not a bare safeWrite.
+      if (newlyCreatedIds.size > 0) {
+        try {
+          mutatePrdLocked(file, plan, (current) => {
+            for (const feature of (current.missing_features || [])) {
+              if (newlyCreatedIds.has(feature.id)) feature.workItemId = feature.id;
+            }
+            return current;
+          }, { skipWriteIfUnchanged: true });
+        } catch (e) { log('warn', `workItemId stamp failed for ${file}: ${e.message}`); }
+      }
+
       totalCreated += created;
     }
 
@@ -8211,6 +8224,45 @@ function normalizeAc(ac) {
  * @param {string} [options.workType] - Work type (used for ASK-specific vars)
  * @returns {{ needsReview: boolean, checkpointCount: number|null }} checkpoint side-effect info
  */
+/**
+ * SHERLOC (P-mqyp0008v022w3x4): detect prior completed explore WI that
+ * references this fix WI via its `references` array. Returns the explore
+ * WI's `resultSummary` string, or '' when none found.
+ *
+ * Lookup: scan all work items for type=explore, status=done, non-empty
+ * resultSummary, and a reference whose URL includes the fix WI's ID.
+ * The explore WI is expected to have been dispatched as a pre-localization
+ * step and to carry a back-reference to the fix WI it was researching.
+ *
+ * @param {object} item  - the fix work item being dispatched
+ * @param {object} config - engine config (passed to getWorkItems)
+ * @returns {string}
+ */
+function resolvePriorExploreContext(item, config) {
+  if (!item || !item.id) return '';
+  try {
+    const allItems = queries.getWorkItems(config, { enrich: false });
+    const candidates = allItems.filter(wi =>
+      wi.type === WORK_TYPE.EXPLORE &&
+      DONE_STATUSES.has(wi.status) &&
+      wi.resultSummary &&
+      Array.isArray(wi.references) &&
+      wi.references.some(r => r && typeof r.url === 'string' && r.url.includes(item.id))
+    );
+    if (candidates.length === 0) return '';
+    // Prefer most recently completed; fall back to most recently created.
+    candidates.sort((a, b) => {
+      const ta = a.completedAt || a.created || '';
+      const tb = b.completedAt || b.created || '';
+      return tb.localeCompare(ta);
+    });
+    return candidates[0].resultSummary || '';
+  } catch (e) {
+    log('warn', `resolvePriorExploreContext for ${item.id}: ${e.message}`);
+    return '';
+  }
+}
+
 function buildWorkItemDispatchVars(item, vars, config, options = {}) {
   const { worktreePath, includeNotes = true, workType } = options;
 
@@ -8267,6 +8319,13 @@ function buildWorkItemDispatchVars(item, vars, config, options = {}) {
     vars.notes_content = 'See the **Team Notes** section above for the latest shared team context.';
   }
 
+  // SHERLOC (P-mqyp0008v022w3x4): inject prior explore context for fix dispatches.
+  // When a completed explore WI has a reference to this fix WI, surface its
+  // resultSummary so the fix agent starts with pre-localized fault context.
+  if (workType === WORK_TYPE.FIX) {
+    vars.prior_explore_context = resolvePriorExploreContext(item, config);
+  }
+
   // Resolve implicit context references (e.g., "ripley's plan", "the latest plan")
   const resolvedCtx = resolveTaskContext(item, config);
   if (resolvedCtx.additionalContext) {
@@ -9844,6 +9903,15 @@ async function tickInner() {
       log('warn', `[pull-requests] scope-mismatch sweep error: ${err?.message || err}`);
     }
 
+    // P-e9f0a2b4 — Collapse prNumber duplicates (different canonical IDs, same
+    // prNumber) that accumulated before upsert-time dedup was added. One mutation
+    // per affected scope per reconcile tick; normally a no-op after first run.
+    try {
+      collapseAllDuplicatePrRecords(config);
+    } catch (err) {
+      log('warn', `[pull-requests] collapse-duplicates sweep error: ${err?.message || err}`);
+    }
+
     // P-6b3a9f78 — Shared-branch PR reconciler (recovery sweep). Backfills the
     // engine PR store for shared-branch plans whose aggregate remote PR exists
     // but is untracked / under-linked, so the dashboard renders the single
@@ -10300,15 +10368,12 @@ async function tickInner() {
       } else {
         // P-a3f9b205: surface the per-project live-mode gate. Order matters:
         // max_concurrency / agent_busy / branch_locked are all more specific
-        // and win when both apply. Also check the pending item's own resolved
-        // checkout mode so worktree-mode items on hybrid projects are not
-        // falsely annotated live_checkout_busy (mirrors seeding guard above).
+        // and win when both apply.
         const itemProjName = item.project || item.meta?.project?.name || null;
         if (
           itemProjName
           && !READ_ONLY_ROOT_TASK_TYPES.has(item.type)
           && postLiveProjectsInUse.has(itemProjName)
-          && shared.resolveCheckoutMode(shared.findProjectByName(shared.getProjects(config), itemProjName), item.type) === 'live'
         ) {
           reason = 'live_checkout_busy';
         }
@@ -10504,6 +10569,8 @@ module.exports = {
 
   // Shared helpers (used by lifecycle.js and tests)
   reconcileItemsWithPrs, detectDependencyCycles,
+  safePrdProjectSlug, safePrdFilenameForProject, // exported for testing (W-mqyn7joo0004079f)
+  isSoftFixDispatch, // exported for testing (W-mqyn7joo0004079f)
   areDependenciesMet, // exported for testing (P-bf04-decompose-zero-children)
   parseConflictFiles, pruneAncestorDeps, preflightMergeSimulation, // exported for testing
   resolveDependencyBranches, buildCrossRepoDepsSection, // exported for testing (P-faea3206)
@@ -10524,6 +10591,7 @@ module.exports = {
 
   // Playbooks
   renderPlaybook, validatePlaybookVars, PLAYBOOK_REQUIRED_VARS, buildWorkItemDispatchVars,
+  resolvePriorExploreContext, // exported for testing (P-mqyp0008v022w3x4 SHERLOC)
   renderProjectWorkItemPromptForAgent, // exported for testing
 
   // Timeout / Steering / Idle (re-exported from engine/timeout.js)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2293",
+  "version": "0.1.2295",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"

package/playbooks/fix.md

@@ -19,6 +19,15 @@ When `{{pr_id}}`/`{{pr_branch}}` identify an existing pull request, this is a fi
 
 {{checkpoint_context}}
 
+{{#prior_explore_context}}
+## Exploration Context
+
+A prior explore work item investigated this issue. Use this context as your starting point for fault localization:
+
+{{prior_explore_context}}
+
+{{/prior_explore_context}}
+
 ## Review Findings to Address
 
 {{review_note}}