@yemi33/minions 0.1.2355 → 0.1.2357

package/engine/lifecycle.js

@@ -1122,6 +1122,13 @@ function syncPrsFromOutput(output, agentId, meta, config, opts = {}) {
         const projScope = shared.getProjectPrScope(p);
         if (projScope && projScope === urlScope) return p;
       }
+      // W-mrchrfe100067d3a — a PR scoped to one of a project's allowlisted
+      // additionalRepoScopes (e.g. a backport PR opened against
+      // yemi33/minions from the minions-opg checkout) belongs to that
+      // project too, even though it isn't the project's primary scope.
+      for (const p of projects) {
+        if (shared.getProjectAdditionalPrScopes(p).includes(urlScope)) return p;
+      }
     }
     const evidenceText = `${outputText}\n${evidenceUrl}`;
     for (const p of projects) {
@@ -3047,6 +3054,71 @@ function clearBuildFixIneffective(target) {
   return true;
 }
 
+// #764 — PR-level circuit breaker for the WORKTREE_PREFLIGHT
+// branch-held-externally failure class (engine.js `_failBranchHeldByExternalWorktree`).
+// That failure already stamps the WI `agentRetryable: false`, which stops the
+// immediate quarantine-recovery-loop storm for that one dispatch instance, but
+// it carries no memory at the PR level — the human-feedback / review / build /
+// conflict fix dispatch pollers see the PR is still `pendingFix` (or has
+// coalesced feedback) and re-dispatch a brand-new work item next cooldown
+// window, forever, until a human manually releases the branch. Mirrors the
+// `_buildFixIneffective` shape (see `recordBuildFixIneffective` above) so the
+// dashboard/pause-inspection conventions stay consistent, but is keyed on the
+// holder path + branch rather than a head SHA — the signal that should clear
+// this pause is "the holder no longer holds the branch", not "a new commit
+// landed" (see `engine.js#isWorktreeHeldPauseSuppressed`, which performs that
+// live re-check and calls `clearWorktreeHeldPause` when the holder has moved
+// on).
+function recordWorktreeHeldPause(target, { holderPath, isProjectRoot, branch, dispatchItem } = {}) {
+  if (!target) return null;
+  const now = ts();
+  const prior = target._worktreeHeldPaused && typeof target._worktreeHeldPaused === 'object'
+    ? target._worktreeHeldPaused : null;
+  target._worktreeHeldPaused = {
+    holderPath: holderPath || null,
+    isProjectRoot: !!isProjectRoot,
+    branch: branch || null,
+    since: prior?.since || now,
+    lastAt: now,
+    dispatchId: dispatchItem?.id || null,
+    reason: isProjectRoot
+      ? `Branch ${branch || '(unknown)'} is held by the project root (${holderPath}). PR-driven review/fix automation is paused until the root releases the branch.`
+      : `Branch ${branch || '(unknown)'} is held by an external worktree at ${holderPath} the engine can't reach. PR-driven review/fix automation is paused until that worktree releases the branch.`,
+  };
+  if (!prior) {
+    try {
+      const prNumber = target.prNumber || shared.getPrNumber(target) || target.id || 'unknown';
+      const noteBody = `# Worktree-held pause — PR automation stopped: ${target.id || prNumber}\n\n`
+        + `**PR:** ${target.url || target.id || '(unknown)'}\n`
+        + `**Branch:** ${branch || target.branch || '(unknown)'}\n`
+        + `**Holder:** ${holderPath || '(unknown)'}${isProjectRoot ? ' (project root)' : ' (external worktree)'}\n\n`
+        + `A WORKTREE_PREFLIGHT dispatch failed because this branch is checked out ${isProjectRoot ? 'at the project root' : 'in an external worktree'} the engine can't reach. `
+        + `Review/human-feedback/build-fix/merge-conflict automation for this PR is now paused so the poller stops re-dispatching against the same unresolved cause every cooldown window (issue #764).\n\n`
+        + `**Recovery:** ${isProjectRoot ? `\`git -C ${holderPath} checkout <mainBranch>\` to release the branch` : 'finish or remove the external worktree holding this branch'} — the engine auto-clears this pause the next time it detects the holder no longer holds the branch.\n`;
+      shared.writeToInbox(
+        'engine',
+        `worktree-held-paused-${prNumber}`,
+        noteBody,
+        null,
+        { wi: dispatchItem?.meta?.item?.id || null, pr: target.id || null },
+      );
+    } catch (err) {
+      log('warn', `worktree-held-paused inbox alert for ${target.id || '(unknown)'}: ${err.message}`);
+    }
+  }
+  return target._worktreeHeldPaused;
+}
+
+// Clears the `_worktreeHeldPaused` circuit breaker (issue #764) so PR-driven
+// review/fix dispatch can resume. Returns true when a record was actually
+// removed so callers (the dashboard resume endpoint, engine.js's live
+// re-check) can distinguish "cleared" from "nothing to clear".
+function clearWorktreeHeldPause(target) {
+  if (!target?._worktreeHeldPaused) return false;
+  delete target._worktreeHeldPaused;
+  return true;
+}
+
 function clearPrNoOpFixAttempt(target, cause) {
   if (!target?._noOpFixes || !target._noOpFixes[cause]) return;
   delete target._noOpFixes[cause];
@@ -6611,16 +6683,25 @@ function pruneScopeMismatchDuplicatePrs(config) {
   const projects = shared.getProjects(config) || [];
   if (projects.length === 0) return { pruned: 0, relocated: 0, scanned: 0 };
 
-  // Map project name -> canonical scope so we can find which project IS the
-  // correctly-scoped owner for a given mismatch record.
+  // Map project name -> canonical scope(s) so we can find which project IS
+  // the correctly-scoped owner for a given mismatch record. Includes
+  // additionalRepoScopes (W-mrchrfe100067d3a) so a stale `_invalidProjectScope`
+  // stamp left over from before a project opted into a secondary scope (or
+  // any record from another host that hasn't been re-normalized yet) maps
+  // back to the project that now allowlists it, instead of relocating to a
+  // nonexistent project or getting stuck unresolved.
   const scopeByProject = new Map();
   const projectByScope = new Map();
   for (const p of projects) {
     if (!p || !p.name) continue;
     const sc = shared.getProjectPrScope(p);
-    if (!sc) continue;
-    scopeByProject.set(p.name, sc);
-    projectByScope.set(sc, p);
+    if (sc) {
+      scopeByProject.set(p.name, sc);
+      if (!projectByScope.has(sc)) projectByScope.set(sc, p);
+    }
+    for (const additionalScope of shared.getProjectAdditionalPrScopes(p)) {
+      if (!projectByScope.has(additionalScope)) projectByScope.set(additionalScope, p);
+    }
   }
 
   // Index all PRs by canonical id across all projects (post-_scope decoration).
@@ -6995,6 +7076,13 @@ module.exports = {
   // Issue #671 — exported so dashboard.js can clear the build-fix-ineffective
   // ("infra issue suspected") pause from the resume endpoint.
   clearBuildFixIneffective,
+  // Issue #764 — PR-level circuit breaker for WORKTREE_PREFLIGHT
+  // branch-held-externally failures. Exported so engine.js can stamp the
+  // pause at dispatch-failure time and auto-clear it via the live re-check,
+  // and so dashboard.js can expose a manual clear endpoint + unit tests can
+  // exercise both paths directly.
+  recordWorktreeHeldPause,
+  clearWorktreeHeldPause,
   // W-mpx44p05000ze8d8 — exported so engine/ado.js + engine/github.js can
   // drop stale `_noOpFixes` records during their PR status poll, and so
   // unit tests can exercise the sweep helper directly.

package/engine/live-checkout.js

@@ -128,6 +128,21 @@
  * (signature `(absPath:string) => boolean`, defaulting to fs.existsSync).
  * Production callers omit both and the helper falls back to
  * `require('./shared').shellSafeGit` and `fs.existsSync` respectively.
+ *
+ * `checkLiveCheckoutDirty` / `checkLiveCheckoutStaleBase` (W-mrcifup2000c218a):
+ * ALLOCATION-TIME pre-dispatch counterparts to the dirty / stale-base checks
+ * above. Both are cheap, read-only, non-mutating probes engine.js calls
+ * BEFORE a live-mode work item is dispatched (in the same allocation loop
+ * that already gates on `live_checkout_busy`), so a dirty tree or a
+ * contaminated local base leaves the item pending
+ * (`_pendingReason: 'live_checkout_dirty'` / `'live_checkout_stale_base'`)
+ * instead of burning a retry (dirty, pre-fix behavior) or failing
+ * non-retryably on the first hit (stale-base, pre-fix behavior). The
+ * in-spawn guards documented above (inside `prepareLiveCheckout`, surfaced by
+ * spawnAgent) remain in place as a defense-in-depth fallback for the race
+ * window between this probe and the actual git operations inside spawnAgent
+ * — they should now fire rarely, as the exception path rather than the
+ * common path.
  */
 
 'use strict';
@@ -1205,6 +1220,130 @@ async function prepareLiveCheckout(opts = {}) {
   return { ok: true, branch: branchName, created: true, originalRef, originalRefType };
 }
 
+/**
+ * checkLiveCheckoutDirty — W-mrcifup2000c218a
+ *
+ * Cheap, read-only, NON-MUTATING pre-dispatch probe for a dirty live-checkout
+ * working tree. Mirrors prepareLiveCheckout's Step 1 dirty check (same
+ * `git status --porcelain=v1 -b` command, same porcelain parsing, same
+ * auto-cleanable-artifact allowance) but never deletes anything and never
+ * throws on a git failure — callers use this at ALLOCATION time (before a WI
+ * is dispatched) to decide whether to leave the item pending
+ * (`_pendingReason: 'live_checkout_dirty'`) instead of spawning it only to
+ * have prepareLiveCheckout refuse it after the fact.
+ *
+ * Intentionally permissive on ambiguity: if the `git status` probe itself
+ * fails (transient error), or every dirty entry is an auto-cleanable build
+ * artifact (which prepareLiveCheckout's spawn-time auto-clean step will
+ * delete before it ever re-checks dirtiness), this reports `dirty:false` so
+ * allocation does not block on a condition that resolves itself inside the
+ * spawn path. The in-spawn guard (engine.js ~line 2617) remains the
+ * authoritative check for the race window between this probe and the actual
+ * git operations inside spawnAgent.
+ *
+ * @param {object} opts
+ * @param {string} opts.localPath        operator checkout root (git cwd)
+ * @param {object} [opts.gitOpts]        extra execFile opts merged into cwd
+ * @param {boolean} [opts.skipDirtyCheck] #522: opt out entirely (GVFS repos)
+ * @param {function} [opts._git]         test seam; defaults to shellSafeGit
+ * @returns {Promise<{dirty:boolean, dirtyFiles?:string[], branchInfo?:string, autoCleanable?:boolean, error?:string}>}
+ */
+async function checkLiveCheckoutDirty(opts = {}) {
+  const { localPath, gitOpts, skipDirtyCheck, _git } = opts;
+  if (skipDirtyCheck) return { dirty: false };
+  if (!localPath || typeof localPath !== 'string') return { dirty: false };
+  const git = (typeof _git === 'function') ? _git : shared.shellSafeGit;
+  const baseOpts = { cwd: localPath, maxBuffer: LIVE_CHECKOUT_GIT_MAX_BUFFER, ...(gitOpts || {}) };
+  let statusRaw;
+  try {
+    statusRaw = await git(['status', '--porcelain=v1', '-b'], baseOpts);
+  } catch (e) {
+    // A probe failure is not proof of a dirty tree — don't block allocation
+    // on it. spawnAgent's own dirty check (with its LIVE_CHECKOUT_FAILED
+    // classification) is the authoritative fallback for a real git failure.
+    return { dirty: false, error: e.message };
+  }
+  const lines = (typeof statusRaw === 'string' ? statusRaw : '')
+    .split(/\r?\n/)
+    .map((line) => line.replace(/\s+$/, ''))
+    .filter((line) => line.length > 0);
+  const branchInfo = lines.find((line) => line.startsWith('## ')) || '';
+  const dirtyFiles = lines.filter((line) => !line.startsWith('## '));
+  if (dirtyFiles.length === 0) return { dirty: false, branchInfo };
+  const cleanablePaths = _collectAutoCleanablePaths(dirtyFiles);
+  if (cleanablePaths) return { dirty: false, branchInfo, autoCleanable: true };
+  return { dirty: true, dirtyFiles, branchInfo };
+}
+
+/**
+ * checkLiveCheckoutStaleBase — W-mrcifup2000c218a
+ *
+ * Cheap, read-only, NON-MUTATING, fetch-free pre-dispatch probe for the
+ * STALE-BASE GUARD condition (W-mr98op8w000ma4ad). Mirrors prepareLiveCheckout's
+ * Step 4d divergence check (same `git rev-list --count origin/<mainRef>..<mainRef>`
+ * comparison) so allocation-time callers can detect a contaminated local base
+ * BEFORE dispatching, instead of burning a non-retryable terminal failure after
+ * the fact. Never fetches, never resets, never mutates anything.
+ *
+ * Scope mirrors prepareLiveCheckout exactly: only relevant when a NEW branch
+ * would be forked (an existing local `branchName` checkout is unaffected by
+ * this class of contamination), when HEAD sits on `mainRef` itself, and when
+ * `origin/<mainRef>` is present locally to compare against. `allowNonMainBase`
+ * (PR-targeted / shared-branch continuations) short-circuits to `stale:false`
+ * — those dispatches intentionally build on a non-main branch and opt out of
+ * this guard, same as prepareLiveCheckout.
+ *
+ * @param {object} opts
+ * @param {string} opts.localPath          operator checkout root (git cwd)
+ * @param {string} opts.mainRef            project base branch name
+ * @param {object} [opts.gitOpts]          extra execFile opts merged into cwd
+ * @param {boolean} [opts.allowNonMainBase] opt out (PR-targeted/shared-branch)
+ * @param {function} [opts._git]           test seam; defaults to shellSafeGit
+ * @returns {Promise<{stale:boolean, ahead?:number, mainRef?:string, localMainSha?:string, originMainSha?:string}>}
+ */
+async function checkLiveCheckoutStaleBase(opts = {}) {
+  const { localPath, mainRef, gitOpts, allowNonMainBase, _git } = opts;
+  if (allowNonMainBase) return { stale: false };
+  if (!localPath || typeof localPath !== 'string') return { stale: false };
+  if (!mainRef || typeof mainRef !== 'string') return { stale: false };
+  const git = (typeof _git === 'function') ? _git : shared.shellSafeGit;
+  const baseOpts = { cwd: localPath, maxBuffer: LIVE_CHECKOUT_GIT_MAX_BUFFER, ...(gitOpts || {}) };
+  let curBranch = '';
+  try {
+    const raw = await git(['symbolic-ref', '-q', '--short', 'HEAD'], baseOpts);
+    curBranch = (typeof raw === 'string' ? raw : '').trim();
+  } catch {
+    // Detached HEAD or probe error — out of scope for this guard (the
+    // mid-operation/detached-HEAD preflight is a separate concern, still
+    // handled in-spawn only).
+    return { stale: false };
+  }
+  if (!curBranch || curBranch !== mainRef) return { stale: false };
+  let originMainSha = '';
+  try {
+    const originRaw = await git(['rev-parse', '--verify', '--quiet', `refs/remotes/origin/${mainRef}`], baseOpts);
+    originMainSha = (typeof originRaw === 'string' ? originRaw : '').trim();
+  } catch {
+    return { stale: false }; // no remote-tracking ref → ambiguous, skip (local-only/no-remote repo)
+  }
+  if (!originMainSha) return { stale: false };
+  let aheadCount = -1;
+  try {
+    const cntRaw = await git(['rev-list', '--count', `refs/remotes/origin/${mainRef}..${mainRef}`], baseOpts);
+    aheadCount = parseInt((typeof cntRaw === 'string' ? cntRaw : '').trim(), 10);
+    if (Number.isNaN(aheadCount)) aheadCount = -1;
+  } catch {
+    aheadCount = -1; // rev-list failed → transient/ambiguous; don't block on it
+  }
+  if (aheadCount <= 0) return { stale: false };
+  let localMainSha = '';
+  try {
+    const localRaw = await git(['rev-parse', '--verify', '--quiet', `refs/heads/${mainRef}`], baseOpts);
+    localMainSha = (typeof localRaw === 'string' ? localRaw : '').trim();
+  } catch { /* best-effort — informational only */ }
+  return { stale: true, ahead: aheadCount, mainRef, localMainSha, originMainSha };
+}
+
 /**
  * restoreLiveCheckoutAtDispatchEnd — P-d9e6b2c4
  *
@@ -1723,6 +1862,8 @@ async function maybeRestoreLiveCheckoutFromRecord(opts = {}) {
 
 module.exports = {
   prepareLiveCheckout,
+  checkLiveCheckoutDirty,
+  checkLiveCheckoutStaleBase,
   restoreLiveCheckoutAtDispatchEnd,
   resolveLiveCheckoutAutoStash,
   performLiveCheckoutAutoStash,

package/engine/pipeline.js

@@ -8,7 +8,7 @@ const fs = require('fs');
 const path = require('path');
 const shared = require('./shared');
 const queries = require('./queries');
-const { safeJson, safeJsonObj, safeJsonArr, safeJsonNoRestore, safeWrite, safeRead, safeReadDir, uid, log, ts, dateStamp, mutateJsonFileLocked, mutateWorkItems, mutatePipelineRuns, slugify, formatTranscriptEntry, WI_STATUS, WORK_TYPE, PLAN_STATUS, PR_STATUS, PIPELINE_STATUS, STAGE_TYPE, MEETING_STATUS, READ_ONLY_ROOT_TASK_TYPES, ENGINE_DEFAULTS, MINIONS_DIR } = shared;
+const { safeJson, safeJsonObj, safeJsonArr, safeJsonNoRestore, safeWrite, safeRead, safeReadDir, uid, log, ts, dateStamp, mutateJsonFileLocked, mutateWorkItems, mutatePipelineRuns, slugify, formatTranscriptEntry, WI_STATUS, WORK_TYPE, PLAN_STATUS, PR_STATUS, PIPELINE_STATUS, STAGE_TYPE, MEETING_STATUS, READ_ONLY_ROOT_TASK_TYPES, ENGINE_DEFAULTS, MINIONS_DIR, isPrdArchived } = shared;
 const routing = require('./routing');
 const http = require('http');
 const { shouldRunNow } = require('./scheduler');
@@ -501,11 +501,16 @@ function _findMeetingsInRun(run) {
   return meetings;
 }
 
-// Check if a plan already exists for a given meeting (created manually via dashboard)
-function _findExistingPlanForMeeting(meetingIds, plansDir) {
+// Check if a plan already exists for a given meeting (created manually via
+// dashboard, or previously by this same pipeline stage). `pipelineSlugPrefix`
+// (optional) is the slug a pipeline plan stage writes its files under
+// (`slugify(stage.title)`) — matching on it catches pre-existing pipeline
+// plans that predate the `**Source Meeting:**` marker below.
+function _findExistingPlanForMeeting(meetingIds, plansDir, pipelineSlugPrefix) {
   const files = safeReadDir(plansDir).filter(f => f.endsWith('.md'));
-  // Build slug prefixes for both pipeline and dashboard naming conventions
+  // Build slug prefixes for dashboard, and (optionally) pipeline naming conventions
   const slugPrefixes = [];
+  if (pipelineSlugPrefix) slugPrefixes.push(pipelineSlugPrefix);
   for (const mid of meetingIds) {
     const mtg = safeJson(path.join(MEETINGS_DIR, mid + '.json'));
     if (mtg?.title) {
@@ -537,8 +542,26 @@ function _canonicalPlanName(planFile) {
   return String(planFile || '').replace(/^(.*-\d{4}-\d{2}-\d{2})-\d+(\.md)$/i, '$1$2');
 }
 
+// PRD top-level statuses that indicate a genuine, materialized plan-to-prd
+// conversion (mirrors PLAN_STATUS — a PRD's status field is drawn from the
+// same enum as a plan's). 'archived' is intentionally NOT in PLAN_STATUS (it's
+// an in-place-archive-only status stamped by dashboard.js's _archivePrdPostProcess,
+// not a plan lifecycle state) but is a real status a converted-then-archived PRD
+// can carry — checked separately below via isPrdArchived so an already-archived
+// conversion isn't mistaken for a stub and re-triggered.
+const _VALID_EXISTING_PRD_STATUSES = new Set(Object.values(PLAN_STATUS));
+
 // Check if a PRD already exists for a given plan file (plan already converted).
 // Matches by canonical name so a collision-bumped plan still finds its PRD.
+//
+// A matching `source_plan` alone is not proof of a successful conversion — a
+// crashed/interrupted plan-to-prd write, or a fragment-looking LLM response
+// (the same garbage-content failure mode fixed for plan stages in PR #750),
+// can leave a stub PRD JSON with `source_plan` set but no recognized `status`
+// and no `missing_features`. Treating that stub as "already converted" would
+// permanently skip re-running plan-to-prd for a plan that never actually got
+// a usable PRD. Require both a recognized top-level status AND an array
+// `missing_features` field before counting the PRD as an existing conversion.
 function _findExistingPrdForPlan(planFile, prdDir) {
   if (!fs.existsSync(prdDir)) return null;
   const prdFiles = safeReadDir(prdDir).filter(f => f.endsWith('.json'));
@@ -547,11 +570,28 @@ function _findExistingPrdForPlan(planFile, prdDir) {
     // safeJsonNoRestore: PRDs are terminal artifacts — never restore archived
     // PRDs from a stale .backup sidecar (W-mouptdh1000h9f39).
     const prd = safeJsonNoRestore(path.join(prdDir, pf));
-    if (prd?.source_plan && _canonicalPlanName(path.basename(String(prd.source_plan))) === planKey) return pf;
+    if (!prd?.source_plan || _canonicalPlanName(path.basename(String(prd.source_plan))) !== planKey) continue;
+    if (!(_VALID_EXISTING_PRD_STATUSES.has(prd.status) || isPrdArchived(prd)) || !Array.isArray(prd.missing_features)) {
+      log('warn', `Pipeline plan-to-prd: found PRD "${pf}" for plan "${planFile}" but it lacks a valid status/missing_features (garbage/incomplete conversion) — treating plan-to-prd as not yet done`);
+      continue;
+    }
+    return pf;
   }
   return null;
 }
 
+// A well-formed plan (LLM path or fallback path) always starts with a markdown
+// title and has substantive body content. Guards against `maxTurns: 1` LLM
+// calls that spend their single turn on tool-oriented preamble/narration
+// instead of the plan itself (W-mrbn0eex000265d7) — that kind of response is a
+// short mid-task fragment, not a plan, and must not be written verbatim.
+function _looksLikePlanContent(content) {
+  if (!content) return false;
+  const trimmed = content.trim();
+  if (trimmed.length < 200) return false;
+  return trimmed.startsWith('#');
+}
+
 async function executePlanStage(stage, stageState, run, config, pipeline = {}) {
   const plansDir = PLANS_DIR;
   if (!fs.existsSync(plansDir)) fs.mkdirSync(plansDir, { recursive: true });
@@ -568,7 +608,7 @@ async function executePlanStage(stage, stageState, run, config, pipeline = {}) {
   // ── Reconciliation: check if a plan already exists for a meeting in this run ──
   const meetingIds = _findMeetingsInRun(run);
   if (meetingIds.length > 0) {
-    const existingPlanFile = _findExistingPlanForMeeting(meetingIds, plansDir);
+    const existingPlanFile = _findExistingPlanForMeeting(meetingIds, plansDir, slug);
     if (existingPlanFile) {
       log('info', `Pipeline ${run.pipelineId}: reconciling plan stage — adopting existing plan "${existingPlanFile}"`);
 
@@ -663,9 +703,11 @@ async function executePlanStage(stage, stageState, run, config, pipeline = {}) {
     });
     if (result.missingRuntime) {
       log('warn', `Pipeline plan LLM skipped: ${result.text || result.stderr || 'runtime unavailable'} — falling back to raw meeting context`);
-    } else if (result.text) {
+    } else if (result.text && _looksLikePlanContent(result.text)) {
       content = result.text;
       log('info', `Pipeline plan: LLM generated ${content.length} chars from meeting context`);
+    } else if (result.text) {
+      log('warn', `Pipeline plan LLM response looked like a fragment, not a plan (${result.text.length} chars, doesn't start with a title) — discarding and falling back to raw meeting context`);
     }
   } catch (e) { log('warn', `Pipeline plan LLM failed: ${e.message} — falling back to raw meeting context`); }
 
@@ -678,6 +720,14 @@ async function executePlanStage(stage, stageState, run, config, pipeline = {}) {
     if (stage.description) content += stage.description + '\n';
   }
 
+  // Stamp every source meeting so a future/duplicate invocation for this run
+  // can find this plan via `_findExistingPlanForMeeting`'s content scan — the
+  // reconciliation guard above only matches on this literal marker or a slug
+  // prefix, and generated content (LLM or fallback) never included it before.
+  if (meetingIds.length > 0) {
+    content += '\n\n---\n\n' + meetingIds.map(mid => `**Source Meeting:** ${mid}`).join('\n') + '\n';
+  }
+
   const filename = `${slug}-${dateStamp()}.md`;
   const filePath = shared.uniquePath(path.join(plansDir, filename));
   safeWrite(filePath, content);
@@ -998,7 +1048,7 @@ function isStageComplete(stage, stageState, run, config) {
       if (prIds.length === 0) return true; // nothing to merge
       const projects = shared.getProjects(config);
       for (const project of projects) {
-        const prs = safeJson(shared.projectPrPath(project)) || [];
+        const prs = safeJsonArr(shared.projectPrPath(project));
         for (const prId of prIds) {
           const pr = shared.findPrRecord(prs, prId, project);
           if (pr && pr.status !== PR_STATUS.MERGED && pr.status !== PR_STATUS.ABANDONED) return false;
@@ -1150,7 +1200,7 @@ async function discoverPipelineWork(config) {
             if (meetingIds.length > 0) {
               const plansDir = PLANS_DIR;
               if (fs.existsSync(plansDir)) {
-                const existingPlan = _findExistingPlanForMeeting(meetingIds, plansDir);
+                const existingPlan = _findExistingPlanForMeeting(meetingIds, plansDir, slugify(nextPlanStage.title || 'pipeline-plan'));
                 if (existingPlan) {
                   updateRunStage(pipeline.id, activeRun.runId, stage.id, {
                     status: PIPELINE_STATUS.COMPLETED, completedAt: ts(),
@@ -1184,7 +1234,34 @@ async function discoverPipelineWork(config) {
           stageState.status = PIPELINE_STATUS.FAILED;
           anyFailed = true;
         } else if (depsReady) {
-          const result = await executeStage(stage, activeRun, pipeline, config);
+          // W-mrbn0eex000265d7: persist RUNNING BEFORE the (potentially slow,
+          // up-to-120s LLM-backed) executeStage call resolves. Plan stages in
+          // particular kick off an LLM call; the stage's persisted status
+          // previously stayed PENDING for the whole call, so a concurrent or
+          // retried invocation of discoverPipelineWork (overlapping tick, or
+          // resumed run after an engine restart mid-await) would see PENDING
+          // again and re-execute the stage, writing a second duplicate plan
+          // file. Marking RUNNING first means a re-entrant call takes the
+          // RUNNING branch above (isStageComplete) instead of re-executing.
+          updateRunStage(pipeline.id, activeRun.runId, stage.id, { status: PIPELINE_STATUS.RUNNING, startedAt: ts() });
+          stageState.status = PIPELINE_STATUS.RUNNING;
+          // W-mrbn0eex000265d7 (review follow-up): the RUNNING status above is
+          // already persisted, so if executeStage throws instead of resolving
+          // (e.g. a lock-timeout in mutateWorkItems, an fs error), an uncaught
+          // rejection would propagate out of discoverPipelineWork to the
+          // engine.js tick-phase catch, which only logs a warning — leaving
+          // this stage's persisted status stuck at RUNNING forever with no
+          // follow-up transition (previously it stayed PENDING and simply
+          // retried next tick). Catch here and route the failure through the
+          // normal FAILED path so dependents fail fast instead of the run
+          // stalling silently.
+          let result;
+          try {
+            result = await executeStage(stage, activeRun, pipeline, config);
+          } catch (e) {
+            log('warn', `Pipeline ${pipeline.id}: stage ${stage.id} threw during execution: ${e.message}`);
+            result = { status: PIPELINE_STATUS.FAILED, error: e.message };
+          }
           updateRunStage(pipeline.id, activeRun.runId, stage.id, { ...result, startedAt: ts() });
           Object.assign(stageState, result, { startedAt: ts() });
           if (result.status === PIPELINE_STATUS.RUNNING) {

package/engine/playbook.js

@@ -12,7 +12,7 @@ const queries = require('./queries');
 const { wrapUntrusted, buildSource } = require('./untrusted-fence');
 const { MINIONS_BRAND_URL } = require('./comment-format');
 
-const { safeJson, safeRead, getProjects, log, ts, dateStamp, truncateTextBytes, ENGINE_DEFAULTS, WI_STATUS, WORK_TYPE, PR_STATUS, DISPATCH_RESULT, getProjectOrg } = shared;
+const { safeJsonArr, safeRead, getProjects, log, ts, dateStamp, truncateTextBytes, ENGINE_DEFAULTS, WI_STATUS, WORK_TYPE, PR_STATUS, DISPATCH_RESULT, getProjectOrg } = shared;
 const { getConfig, getDispatch, getNotes, getPrs, getKnowledgeBaseIndex, AGENTS_DIR } = queries;
 
 const MINIONS_DIR = shared.MINIONS_DIR;
@@ -1060,11 +1060,12 @@ function renderPlaybook(type, vars) {
 // ─── Playbook Section Validator ──────────────────────────────────────────────
 
 // Required structural section patterns — warn (do not throw) when absent.
-// Pluralisation: /^## Tools?\b/m matches both '## Tool' and '## Tools'.
+// Only '## Your Task' is checked: it's the one section every playbook template
+// actually implements. '## Tools' / '## Constraints' were removed (#775) —
+// no template in playbooks/ defines those headers, so the checks always
+// failed and produced 100%-failure-rate warn-level noise in engine/log.json.
 const _REQUIRED_PROMPT_SECTIONS = [
   { pattern: /^## Your Task\b/m,   label: '## Your Task' },
-  { pattern: /^## Tools?\b/m,      label: '## Tools' },
-  { pattern: /^## Constraints\b/m, label: '## Constraints' },
 ];
 
 /**
@@ -1266,7 +1267,7 @@ function buildAgentContext(agentId, config, project) {
   }
   // Also check central pull-requests.json
   try {
-    const centralPrs = safeJson(path.join(MINIONS_DIR, 'pull-requests.json')) || [];
+    const centralPrs = safeJsonArr(path.join(MINIONS_DIR, 'pull-requests.json'));
     for (const pr of centralPrs.filter(pr => pr.status === PR_STATUS.ACTIVE)) {
       if (!allPrs.some(p => p.id === pr.id)) allPrs.push({ ...pr, _project: 'central' });
     }

package/engine/pull-requests-store.js

@@ -64,7 +64,33 @@ function _readJsonArrayFallback(scope) {
 
 // Content-hash fingerprint per scope: same-length swaps (timestamps,
 // reviewStatus enums) collide on (mtime, size) but never on SHA-1.
-const _lastMirrorHashByScope = new Map();
+//
+// W-mrcg7j9k000ja233 (#759): this used to be an in-memory-only Map, which
+// resets to empty on every process restart. Persist it in SQL instead
+// (`pr_mirror_hashes`) so a restart can't blank out the "does JSON already
+// agree with SQL" trust state — that reset, combined with a restart landing
+// mid-flight of another process's mirror write, is exactly what let a stale
+// JSON snapshot get treated as canonical and silently wipe SQL rows for a
+// scope (see _resyncScopeIfJsonDiverged / _hydrateScopeFromJson below).
+function _getLastMirrorHash(db, scope) {
+  try {
+    const row = db.prepare('SELECT hash FROM pr_mirror_hashes WHERE scope = ?').get(scope);
+    return row ? row.hash : null;
+  } catch { return null; }
+}
+
+function _setLastMirrorHash(db, scope, hash) {
+  try {
+    db.prepare(`
+      INSERT INTO pr_mirror_hashes (scope, hash, updated_at) VALUES (?, ?, ?)
+      ON CONFLICT(scope) DO UPDATE SET hash = excluded.hash, updated_at = excluded.updated_at
+    `).run(scope, hash, Date.now());
+  } catch { /* best-effort — a missed persisted-hash write just means the next resync re-checks */ }
+}
+
+function _forgetLastMirrorHash(db, scope) {
+  try { db.prepare('DELETE FROM pr_mirror_hashes WHERE scope = ?').run(scope); } catch { /* best-effort */ }
+}
 
 const crypto = require('crypto');
 
@@ -78,7 +104,24 @@ function _fileContentHash(filePath) {
 
 function _hydrateScopeFromJson(db, scope) {
   const jsonItems = _readJsonArrayFallback(scope);
+  const beforeCount = db.prepare('SELECT COUNT(*) AS n FROM pull_requests WHERE scope = ?').get(scope).n;
+  const beforeIds = db.prepare('SELECT id FROM pull_requests WHERE scope = ?').all(scope).map(r => r.id);
   db.prepare('DELETE FROM pull_requests WHERE scope = ?').run(scope);
+  // #759 — this DELETE used to be completely silent. Log every hydrate at
+  // warn level with before/after counts + the ids that are about to be
+  // dropped, so a JSON<->SQL resync that removes rows the operator didn't
+  // expect leaves a trace in engine-stdio.log instead of vanishing without
+  // explanation.
+  try {
+    const afterIds = new Set(jsonItems.filter(pr => pr && pr.id).map(pr => String(pr.id)));
+    const droppedIds = beforeIds.filter(id => !afterIds.has(id));
+    // eslint-disable-next-line no-console
+    console.warn(
+      `[pull-requests-store] _hydrateScopeFromJson(scope=${scope}): rebuilding SQL from JSON mirror — `
+      + `before=${beforeCount} row(s), after=${jsonItems.length} row(s)`
+      + (droppedIds.length ? `, dropping id(s): ${droppedIds.join(', ')}` : ''),
+    );
+  } catch { /* logging must never block the resync */ }
   if (jsonItems.length === 0) return;
   const now = Date.now();
   const ins = db.prepare(`
@@ -107,18 +150,18 @@ function _hydrateScopeFromJson(db, scope) {
 function _resyncScopeIfJsonDiverged(db, scope) {
   const jsonPath = _filePathForScope(scope);
   const currentHash = _fileContentHash(jsonPath);
-  const lastHash = _lastMirrorHashByScope.get(scope);
+  const lastHash = _getLastMirrorHash(db, scope);
   if (currentHash == null) return;
   if (lastHash != null && currentHash === lastHash) return;
   if (lastHash == null) {
     const sqlHas = db.prepare('SELECT 1 FROM pull_requests WHERE scope = ? LIMIT 1').get(scope);
     if (sqlHas) {
-      _lastMirrorHashByScope.set(scope, currentHash);
+      _setLastMirrorHash(db, scope, currentHash);
       return;
     }
   }
   _hydrateScopeFromJson(db, scope);
-  _lastMirrorHashByScope.set(scope, currentHash);
+  _setLastMirrorHash(db, scope, currentHash);
 }
 
 function readPullRequestsForScope(scope) {
@@ -253,7 +296,7 @@ function _applyPullRequestsDiff(db, diff) {
   return true;
 }
 
-function applyPullRequestsMutation(scope, mutator) {
+function applyPullRequestsMutation(scope, mutator, options = {}) {
   const { getDb, withTransaction } = require('./db');
   const db = getDb();
 
@@ -270,6 +313,23 @@ function applyPullRequestsMutation(scope, mutator) {
       : (Array.isArray(next) ? next : before);
     const diff = _computePullRequestsDiff(scope, beforeSnapshot, after);
     const wrote = _applyPullRequestsDiff(db, diff);
+    // W-mrcg7j9k000ja233 (#759) — mirror the JSON sidecar INSIDE this same
+    // SQL write transaction, BEFORE it commits, instead of after (as the
+    // caller in shared.js used to do post-return). This mirrors the fix
+    // already applied to work-items-store.js (W-mr9vcxvy000cdb4e): SQLite
+    // only allows one writer transaction at a time, so mirroring here
+    // guarantees the on-disk JSON file reflects this commit by the time it
+    // becomes visible to any other reader/writer. Without this ordering, a
+    // sibling process (dashboard vs. engine — separate Node processes, each
+    // with its own resync state) could observe the freshly committed SQL
+    // rows before the mirror file caught up, decide its own cached hash no
+    // longer matched the (still-stale) JSON file, and call
+    // _hydrateScopeFromJson — which DELETEs + reinserts the whole scope
+    // from that stale file, silently dropping the row this transaction just
+    // committed.
+    if (wrote) {
+      try { _mirrorJsonFromSql(scope, options.mirrorPath); } catch { /* best-effort — mirror failure must not block the SQL write */ }
+    }
     return { wrote, result: after };
   });
 }
@@ -293,7 +353,7 @@ function _mirrorJsonFromSql(scope, filePath) {
     const target = filePath || _filePathForScope(scope);
     shared.safeWrite(target, items);
     const h = _fileContentHash(target);
-    if (h != null) _lastMirrorHashByScope.set(scope, h);
+    if (h != null) _setLastMirrorHash(db, scope, h);
   } catch {
     // Mirror failures are non-fatal — SQL has already committed.
   }
@@ -312,7 +372,8 @@ function _mirrorJsonFromSql(scope, filePath) {
 function dropScope(scope) {
   try {
     const { getDb } = require('./db');
-    const result = getDb().prepare('DELETE FROM pull_requests WHERE scope = ?').run(scope);
+    const db = getDb();
+    const result = db.prepare('DELETE FROM pull_requests WHERE scope = ?').run(scope);
     // Mirror the work-items-store.js fix (W-mr96m3hm000fd5d7): don't blindly
     // forget the mirror-hash. _resyncScopeIfJsonDiverged treats "no recorded
     // hash" + "zero SQL rows" as a first-install hydrate and rebuilds SQL from
@@ -323,8 +384,8 @@ function dropScope(scope) {
     // actually gone, e.g. dataMode: 'purge'/'archive').
     const jsonPath = _filePathForScope(scope);
     const currentHash = _fileContentHash(jsonPath);
-    if (currentHash == null) _lastMirrorHashByScope.delete(scope);
-    else _lastMirrorHashByScope.set(scope, currentHash);
+    if (currentHash == null) _forgetLastMirrorHash(db, scope);
+    else _setLastMirrorHash(db, scope, currentHash);
     if (result && result.changes > 0) {
       try { require('./db-events').emitStateEvent('pull_requests'); } catch { /* optional */ }
     }