@yemi33/minions 0.1.2356 → 0.1.2358

package/engine/live-checkout.js

@@ -128,6 +128,21 @@
  * (signature `(absPath:string) => boolean`, defaulting to fs.existsSync).
  * Production callers omit both and the helper falls back to
  * `require('./shared').shellSafeGit` and `fs.existsSync` respectively.
+ *
+ * `checkLiveCheckoutDirty` / `checkLiveCheckoutStaleBase` (W-mrcifup2000c218a):
+ * ALLOCATION-TIME pre-dispatch counterparts to the dirty / stale-base checks
+ * above. Both are cheap, read-only, non-mutating probes engine.js calls
+ * BEFORE a live-mode work item is dispatched (in the same allocation loop
+ * that already gates on `live_checkout_busy`), so a dirty tree or a
+ * contaminated local base leaves the item pending
+ * (`_pendingReason: 'live_checkout_dirty'` / `'live_checkout_stale_base'`)
+ * instead of burning a retry (dirty, pre-fix behavior) or failing
+ * non-retryably on the first hit (stale-base, pre-fix behavior). The
+ * in-spawn guards documented above (inside `prepareLiveCheckout`, surfaced by
+ * spawnAgent) remain in place as a defense-in-depth fallback for the race
+ * window between this probe and the actual git operations inside spawnAgent
+ * — they should now fire rarely, as the exception path rather than the
+ * common path.
  */
 
 'use strict';
@@ -1205,6 +1220,130 @@ async function prepareLiveCheckout(opts = {}) {
   return { ok: true, branch: branchName, created: true, originalRef, originalRefType };
 }
 
+/**
+ * checkLiveCheckoutDirty — W-mrcifup2000c218a
+ *
+ * Cheap, read-only, NON-MUTATING pre-dispatch probe for a dirty live-checkout
+ * working tree. Mirrors prepareLiveCheckout's Step 1 dirty check (same
+ * `git status --porcelain=v1 -b` command, same porcelain parsing, same
+ * auto-cleanable-artifact allowance) but never deletes anything and never
+ * throws on a git failure — callers use this at ALLOCATION time (before a WI
+ * is dispatched) to decide whether to leave the item pending
+ * (`_pendingReason: 'live_checkout_dirty'`) instead of spawning it only to
+ * have prepareLiveCheckout refuse it after the fact.
+ *
+ * Intentionally permissive on ambiguity: if the `git status` probe itself
+ * fails (transient error), or every dirty entry is an auto-cleanable build
+ * artifact (which prepareLiveCheckout's spawn-time auto-clean step will
+ * delete before it ever re-checks dirtiness), this reports `dirty:false` so
+ * allocation does not block on a condition that resolves itself inside the
+ * spawn path. The in-spawn guard (engine.js ~line 2617) remains the
+ * authoritative check for the race window between this probe and the actual
+ * git operations inside spawnAgent.
+ *
+ * @param {object} opts
+ * @param {string} opts.localPath        operator checkout root (git cwd)
+ * @param {object} [opts.gitOpts]        extra execFile opts merged into cwd
+ * @param {boolean} [opts.skipDirtyCheck] #522: opt out entirely (GVFS repos)
+ * @param {function} [opts._git]         test seam; defaults to shellSafeGit
+ * @returns {Promise<{dirty:boolean, dirtyFiles?:string[], branchInfo?:string, autoCleanable?:boolean, error?:string}>}
+ */
+async function checkLiveCheckoutDirty(opts = {}) {
+  const { localPath, gitOpts, skipDirtyCheck, _git } = opts;
+  if (skipDirtyCheck) return { dirty: false };
+  if (!localPath || typeof localPath !== 'string') return { dirty: false };
+  const git = (typeof _git === 'function') ? _git : shared.shellSafeGit;
+  const baseOpts = { cwd: localPath, maxBuffer: LIVE_CHECKOUT_GIT_MAX_BUFFER, ...(gitOpts || {}) };
+  let statusRaw;
+  try {
+    statusRaw = await git(['status', '--porcelain=v1', '-b'], baseOpts);
+  } catch (e) {
+    // A probe failure is not proof of a dirty tree — don't block allocation
+    // on it. spawnAgent's own dirty check (with its LIVE_CHECKOUT_FAILED
+    // classification) is the authoritative fallback for a real git failure.
+    return { dirty: false, error: e.message };
+  }
+  const lines = (typeof statusRaw === 'string' ? statusRaw : '')
+    .split(/\r?\n/)
+    .map((line) => line.replace(/\s+$/, ''))
+    .filter((line) => line.length > 0);
+  const branchInfo = lines.find((line) => line.startsWith('## ')) || '';
+  const dirtyFiles = lines.filter((line) => !line.startsWith('## '));
+  if (dirtyFiles.length === 0) return { dirty: false, branchInfo };
+  const cleanablePaths = _collectAutoCleanablePaths(dirtyFiles);
+  if (cleanablePaths) return { dirty: false, branchInfo, autoCleanable: true };
+  return { dirty: true, dirtyFiles, branchInfo };
+}
+
+/**
+ * checkLiveCheckoutStaleBase — W-mrcifup2000c218a
+ *
+ * Cheap, read-only, NON-MUTATING, fetch-free pre-dispatch probe for the
+ * STALE-BASE GUARD condition (W-mr98op8w000ma4ad). Mirrors prepareLiveCheckout's
+ * Step 4d divergence check (same `git rev-list --count origin/<mainRef>..<mainRef>`
+ * comparison) so allocation-time callers can detect a contaminated local base
+ * BEFORE dispatching, instead of burning a non-retryable terminal failure after
+ * the fact. Never fetches, never resets, never mutates anything.
+ *
+ * Scope mirrors prepareLiveCheckout exactly: only relevant when a NEW branch
+ * would be forked (an existing local `branchName` checkout is unaffected by
+ * this class of contamination), when HEAD sits on `mainRef` itself, and when
+ * `origin/<mainRef>` is present locally to compare against. `allowNonMainBase`
+ * (PR-targeted / shared-branch continuations) short-circuits to `stale:false`
+ * — those dispatches intentionally build on a non-main branch and opt out of
+ * this guard, same as prepareLiveCheckout.
+ *
+ * @param {object} opts
+ * @param {string} opts.localPath          operator checkout root (git cwd)
+ * @param {string} opts.mainRef            project base branch name
+ * @param {object} [opts.gitOpts]          extra execFile opts merged into cwd
+ * @param {boolean} [opts.allowNonMainBase] opt out (PR-targeted/shared-branch)
+ * @param {function} [opts._git]           test seam; defaults to shellSafeGit
+ * @returns {Promise<{stale:boolean, ahead?:number, mainRef?:string, localMainSha?:string, originMainSha?:string}>}
+ */
+async function checkLiveCheckoutStaleBase(opts = {}) {
+  const { localPath, mainRef, gitOpts, allowNonMainBase, _git } = opts;
+  if (allowNonMainBase) return { stale: false };
+  if (!localPath || typeof localPath !== 'string') return { stale: false };
+  if (!mainRef || typeof mainRef !== 'string') return { stale: false };
+  const git = (typeof _git === 'function') ? _git : shared.shellSafeGit;
+  const baseOpts = { cwd: localPath, maxBuffer: LIVE_CHECKOUT_GIT_MAX_BUFFER, ...(gitOpts || {}) };
+  let curBranch = '';
+  try {
+    const raw = await git(['symbolic-ref', '-q', '--short', 'HEAD'], baseOpts);
+    curBranch = (typeof raw === 'string' ? raw : '').trim();
+  } catch {
+    // Detached HEAD or probe error — out of scope for this guard (the
+    // mid-operation/detached-HEAD preflight is a separate concern, still
+    // handled in-spawn only).
+    return { stale: false };
+  }
+  if (!curBranch || curBranch !== mainRef) return { stale: false };
+  let originMainSha = '';
+  try {
+    const originRaw = await git(['rev-parse', '--verify', '--quiet', `refs/remotes/origin/${mainRef}`], baseOpts);
+    originMainSha = (typeof originRaw === 'string' ? originRaw : '').trim();
+  } catch {
+    return { stale: false }; // no remote-tracking ref → ambiguous, skip (local-only/no-remote repo)
+  }
+  if (!originMainSha) return { stale: false };
+  let aheadCount = -1;
+  try {
+    const cntRaw = await git(['rev-list', '--count', `refs/remotes/origin/${mainRef}..${mainRef}`], baseOpts);
+    aheadCount = parseInt((typeof cntRaw === 'string' ? cntRaw : '').trim(), 10);
+    if (Number.isNaN(aheadCount)) aheadCount = -1;
+  } catch {
+    aheadCount = -1; // rev-list failed → transient/ambiguous; don't block on it
+  }
+  if (aheadCount <= 0) return { stale: false };
+  let localMainSha = '';
+  try {
+    const localRaw = await git(['rev-parse', '--verify', '--quiet', `refs/heads/${mainRef}`], baseOpts);
+    localMainSha = (typeof localRaw === 'string' ? localRaw : '').trim();
+  } catch { /* best-effort — informational only */ }
+  return { stale: true, ahead: aheadCount, mainRef, localMainSha, originMainSha };
+}
+
 /**
  * restoreLiveCheckoutAtDispatchEnd — P-d9e6b2c4
  *
@@ -1723,6 +1862,8 @@ async function maybeRestoreLiveCheckoutFromRecord(opts = {}) {
 
 module.exports = {
   prepareLiveCheckout,
+  checkLiveCheckoutDirty,
+  checkLiveCheckoutStaleBase,
   restoreLiveCheckoutAtDispatchEnd,
   resolveLiveCheckoutAutoStash,
   performLiveCheckoutAutoStash,

package/engine/pipeline.js

@@ -77,6 +77,23 @@ function getPipelineRuns() {
   return safeJsonObj(PIPELINE_RUNS_PATH);
 }
 
+// W-mrcrh5hj0017d22f: SQL is the canonical (and only) work-items store post
+// Phase 9.4 — the JSON files (central work-items.json + each
+// projects/<name>/work-items.json) are passive, best-effort mirrors that can
+// legitimately lag behind a just-completed write (mirror failures are
+// swallowed by design so they never block the SQL write; see
+// work-items-store.js's `_mirrorJsonFromSql` comments). Reading those JSON
+// files directly (via safeJson/safeJsonArr) can therefore observe a work
+// item whose `status` mirrored to DONE but whose `resultSummary` write
+// hasn't landed in the mirror yet — which silently degraded stage-output
+// template substitution ({{stages.<id>.output}}) to the stage's own work
+// item id instead of its real completion text. Route every work-item read
+// in this module through the SQL-backed store so pipeline state always sees
+// the authoritative record.
+function _allWorkItems() {
+  return require('./work-items-store').readAllWorkItems();
+}
+
 function getActiveRun(pipelineId) {
   const runs = getPipelineRuns();
   const pipelineRuns = runs[pipelineId] || [];
@@ -338,12 +355,7 @@ function evaluateCondition(condition, ctx) {
     case 'noFailedItems': {
       // True when all work items created by the pipeline are done (not failed)
       if (!run) return false;
-      const wiPath = CENTRAL_WI_PATH;
-      const workItems = safeJsonArr(wiPath);
-      const allProjectWi = shared.getProjects(config).reduce((acc, p) => {
-        return acc.concat(safeJson(shared.projectWorkItemsPath(p)) || []);
-      }, []);
-      const all = [...workItems, ...allProjectWi];
+      const all = _allWorkItems();
       const pipelineWis = all.filter(w => w._pipelineRun === run.runId);
       if (pipelineWis.length === 0) return true; // no items = nothing failed
       return pipelineWis.every(w => w.status !== WI_STATUS.FAILED);
@@ -501,11 +513,16 @@ function _findMeetingsInRun(run) {
   return meetings;
 }
 
-// Check if a plan already exists for a given meeting (created manually via dashboard)
-function _findExistingPlanForMeeting(meetingIds, plansDir) {
+// Check if a plan already exists for a given meeting (created manually via
+// dashboard, or previously by this same pipeline stage). `pipelineSlugPrefix`
+// (optional) is the slug a pipeline plan stage writes its files under
+// (`slugify(stage.title)`) — matching on it catches pre-existing pipeline
+// plans that predate the `**Source Meeting:**` marker below.
+function _findExistingPlanForMeeting(meetingIds, plansDir, pipelineSlugPrefix) {
   const files = safeReadDir(plansDir).filter(f => f.endsWith('.md'));
-  // Build slug prefixes for both pipeline and dashboard naming conventions
+  // Build slug prefixes for dashboard, and (optionally) pipeline naming conventions
   const slugPrefixes = [];
+  if (pipelineSlugPrefix) slugPrefixes.push(pipelineSlugPrefix);
   for (const mid of meetingIds) {
     const mtg = safeJson(path.join(MEETINGS_DIR, mid + '.json'));
     if (mtg?.title) {
@@ -575,6 +592,18 @@ function _findExistingPrdForPlan(planFile, prdDir) {
   return null;
 }
 
+// A well-formed plan (LLM path or fallback path) always starts with a markdown
+// title and has substantive body content. Guards against `maxTurns: 1` LLM
+// calls that spend their single turn on tool-oriented preamble/narration
+// instead of the plan itself (W-mrbn0eex000265d7) — that kind of response is a
+// short mid-task fragment, not a plan, and must not be written verbatim.
+function _looksLikePlanContent(content) {
+  if (!content) return false;
+  const trimmed = content.trim();
+  if (trimmed.length < 200) return false;
+  return trimmed.startsWith('#');
+}
+
 async function executePlanStage(stage, stageState, run, config, pipeline = {}) {
   const plansDir = PLANS_DIR;
   if (!fs.existsSync(plansDir)) fs.mkdirSync(plansDir, { recursive: true });
@@ -591,7 +620,7 @@ async function executePlanStage(stage, stageState, run, config, pipeline = {}) {
   // ── Reconciliation: check if a plan already exists for a meeting in this run ──
   const meetingIds = _findMeetingsInRun(run);
   if (meetingIds.length > 0) {
-    const existingPlanFile = _findExistingPlanForMeeting(meetingIds, plansDir);
+    const existingPlanFile = _findExistingPlanForMeeting(meetingIds, plansDir, slug);
     if (existingPlanFile) {
       log('info', `Pipeline ${run.pipelineId}: reconciling plan stage — adopting existing plan "${existingPlanFile}"`);
 
@@ -686,9 +715,11 @@ async function executePlanStage(stage, stageState, run, config, pipeline = {}) {
     });
     if (result.missingRuntime) {
       log('warn', `Pipeline plan LLM skipped: ${result.text || result.stderr || 'runtime unavailable'} — falling back to raw meeting context`);
-    } else if (result.text) {
+    } else if (result.text && _looksLikePlanContent(result.text)) {
       content = result.text;
       log('info', `Pipeline plan: LLM generated ${content.length} chars from meeting context`);
+    } else if (result.text) {
+      log('warn', `Pipeline plan LLM response looked like a fragment, not a plan (${result.text.length} chars, doesn't start with a title) — discarding and falling back to raw meeting context`);
     }
   } catch (e) { log('warn', `Pipeline plan LLM failed: ${e.message} — falling back to raw meeting context`); }
 
@@ -701,6 +732,14 @@ async function executePlanStage(stage, stageState, run, config, pipeline = {}) {
     if (stage.description) content += stage.description + '\n';
   }
 
+  // Stamp every source meeting so a future/duplicate invocation for this run
+  // can find this plan via `_findExistingPlanForMeeting`'s content scan — the
+  // reconciliation guard above only matches on this literal marker or a slug
+  // prefix, and generated content (LLM or fallback) never included it before.
+  if (meetingIds.length > 0) {
+    content += '\n\n---\n\n' + meetingIds.map(mid => `**Source Meeting:** ${mid}`).join('\n') + '\n';
+  }
+
   const filename = `${slug}-${dateStamp()}.md`;
   const filePath = shared.uniquePath(path.join(plansDir, filename));
   safeWrite(filePath, content);
@@ -918,13 +957,8 @@ function isStageComplete(stage, stageState, run, config) {
 
   switch (stage.type) {
     case STAGE_TYPE.TASK: {
-      // Check root + all project work-items.json (WIs may be moved to project paths)
-      const wiPath = CENTRAL_WI_PATH;
-      const workItems = safeJsonArr(wiPath);
-      const allProjectWi = shared.getProjects(config).reduce((acc, p) => {
-        return acc.concat(safeJson(shared.projectWorkItemsPath(p)) || []);
-      }, []);
-      const all = [...workItems, ...allProjectWi];
+      // Check central + all project work items (WIs may live in project scopes)
+      const all = _allWorkItems();
       const ids = artifacts.workItems || [];
       if (ids.length === 0) return false;
       return ids.every(id => {
@@ -943,12 +977,7 @@ function isStageComplete(stage, stageState, run, config) {
     }
     case STAGE_TYPE.PLAN: {
       // Plan stage completion: PRD conversion done + all materialized work items done
-      const wiPath = CENTRAL_WI_PATH;
-      const workItems = safeJsonArr(wiPath);
-      const allProjectWi = shared.getProjects(config).reduce((acc, p) => {
-        return acc.concat(safeJson(shared.projectWorkItemsPath(p)) || []);
-      }, []);
-      const all = [...workItems, ...allProjectWi];
+      const all = _allWorkItems();
 
       // Check if plan-to-prd work item is done
       const prdWiIds = artifacts.workItems || [];
@@ -1021,7 +1050,7 @@ function isStageComplete(stage, stageState, run, config) {
       if (prIds.length === 0) return true; // nothing to merge
       const projects = shared.getProjects(config);
       for (const project of projects) {
-        const prs = safeJson(shared.projectPrPath(project)) || [];
+        const prs = safeJsonArr(shared.projectPrPath(project));
         for (const prId of prIds) {
           const pr = shared.findPrRecord(prs, prId, project);
           if (pr && pr.status !== PR_STATUS.MERGED && pr.status !== PR_STATUS.ABANDONED) return false;
@@ -1111,13 +1140,20 @@ async function discoverPipelineWork(config) {
           // Collect output
           let output = '';
           if (stage.type === STAGE_TYPE.TASK) {
-            const wiPath = CENTRAL_WI_PATH;
-            const workItems = safeJsonArr(wiPath);
-            const projWi = shared.getProjects(config).reduce((acc, p) => acc.concat(safeJson(shared.projectWorkItemsPath(p)) || []), []);
-            const allWi = [...workItems, ...projWi];
+            const allWi = _allWorkItems();
             output = (stageState.artifacts?.workItems || []).map(id => {
               const wi = allWi.find(w => w.id === id);
-              return wi?.resultSummary || wi?.title || id;
+              // W-mrcrh5hj0017d22f: never fall back to the stage's own work
+              // item id — a bare id substituted into {{stages.<id>.output}}
+              // produces a nonsensical downstream description (e.g.
+              // "Confirmed bugs:\nPL-mrcqpzit-verify-0-minions-opg") that
+              // pre-dispatch-eval correctly (but silently, forever) rejects.
+              // If the real resultSummary/title text isn't available yet
+              // (WI missing, or a lagged/failed mirror momentarily hides a
+              // just-completed resultSummary), fall back to an empty string
+              // — a blank substitution is harmless where an opaque id is
+              // actively misleading.
+              return wi?.resultSummary || wi?.title || '';
             }).join('\n');
           } else if (stage.type === STAGE_TYPE.MEETING) {
             const { getMeeting } = require('./meeting');
@@ -1173,7 +1209,7 @@ async function discoverPipelineWork(config) {
             if (meetingIds.length > 0) {
               const plansDir = PLANS_DIR;
               if (fs.existsSync(plansDir)) {
-                const existingPlan = _findExistingPlanForMeeting(meetingIds, plansDir);
+                const existingPlan = _findExistingPlanForMeeting(meetingIds, plansDir, slugify(nextPlanStage.title || 'pipeline-plan'));
                 if (existingPlan) {
                   updateRunStage(pipeline.id, activeRun.runId, stage.id, {
                     status: PIPELINE_STATUS.COMPLETED, completedAt: ts(),
@@ -1207,7 +1243,34 @@ async function discoverPipelineWork(config) {
           stageState.status = PIPELINE_STATUS.FAILED;
           anyFailed = true;
         } else if (depsReady) {
-          const result = await executeStage(stage, activeRun, pipeline, config);
+          // W-mrbn0eex000265d7: persist RUNNING BEFORE the (potentially slow,
+          // up-to-120s LLM-backed) executeStage call resolves. Plan stages in
+          // particular kick off an LLM call; the stage's persisted status
+          // previously stayed PENDING for the whole call, so a concurrent or
+          // retried invocation of discoverPipelineWork (overlapping tick, or
+          // resumed run after an engine restart mid-await) would see PENDING
+          // again and re-execute the stage, writing a second duplicate plan
+          // file. Marking RUNNING first means a re-entrant call takes the
+          // RUNNING branch above (isStageComplete) instead of re-executing.
+          updateRunStage(pipeline.id, activeRun.runId, stage.id, { status: PIPELINE_STATUS.RUNNING, startedAt: ts() });
+          stageState.status = PIPELINE_STATUS.RUNNING;
+          // W-mrbn0eex000265d7 (review follow-up): the RUNNING status above is
+          // already persisted, so if executeStage throws instead of resolving
+          // (e.g. a lock-timeout in mutateWorkItems, an fs error), an uncaught
+          // rejection would propagate out of discoverPipelineWork to the
+          // engine.js tick-phase catch, which only logs a warning — leaving
+          // this stage's persisted status stuck at RUNNING forever with no
+          // follow-up transition (previously it stayed PENDING and simply
+          // retried next tick). Catch here and route the failure through the
+          // normal FAILED path so dependents fail fast instead of the run
+          // stalling silently.
+          let result;
+          try {
+            result = await executeStage(stage, activeRun, pipeline, config);
+          } catch (e) {
+            log('warn', `Pipeline ${pipeline.id}: stage ${stage.id} threw during execution: ${e.message}`);
+            result = { status: PIPELINE_STATUS.FAILED, error: e.message };
+          }
           updateRunStage(pipeline.id, activeRun.runId, stage.id, { ...result, startedAt: ts() });
           Object.assign(stageState, result, { startedAt: ts() });
           if (result.status === PIPELINE_STATUS.RUNNING) {

package/engine/playbook.js

@@ -12,7 +12,7 @@ const queries = require('./queries');
 const { wrapUntrusted, buildSource } = require('./untrusted-fence');
 const { MINIONS_BRAND_URL } = require('./comment-format');
 
-const { safeJson, safeRead, getProjects, log, ts, dateStamp, truncateTextBytes, ENGINE_DEFAULTS, WI_STATUS, WORK_TYPE, PR_STATUS, DISPATCH_RESULT, getProjectOrg } = shared;
+const { safeJsonArr, safeRead, getProjects, log, ts, dateStamp, truncateTextBytes, ENGINE_DEFAULTS, WI_STATUS, WORK_TYPE, PR_STATUS, DISPATCH_RESULT, getProjectOrg } = shared;
 const { getConfig, getDispatch, getNotes, getPrs, getKnowledgeBaseIndex, AGENTS_DIR } = queries;
 
 const MINIONS_DIR = shared.MINIONS_DIR;
@@ -1060,11 +1060,12 @@ function renderPlaybook(type, vars) {
 // ─── Playbook Section Validator ──────────────────────────────────────────────
 
 // Required structural section patterns — warn (do not throw) when absent.
-// Pluralisation: /^## Tools?\b/m matches both '## Tool' and '## Tools'.
+// Only '## Your Task' is checked: it's the one section every playbook template
+// actually implements. '## Tools' / '## Constraints' were removed (#775) —
+// no template in playbooks/ defines those headers, so the checks always
+// failed and produced 100%-failure-rate warn-level noise in engine/log.json.
 const _REQUIRED_PROMPT_SECTIONS = [
   { pattern: /^## Your Task\b/m,   label: '## Your Task' },
-  { pattern: /^## Tools?\b/m,      label: '## Tools' },
-  { pattern: /^## Constraints\b/m, label: '## Constraints' },
 ];
 
 /**
@@ -1266,7 +1267,7 @@ function buildAgentContext(agentId, config, project) {
   }
   // Also check central pull-requests.json
   try {
-    const centralPrs = safeJson(path.join(MINIONS_DIR, 'pull-requests.json')) || [];
+    const centralPrs = safeJsonArr(path.join(MINIONS_DIR, 'pull-requests.json'));
     for (const pr of centralPrs.filter(pr => pr.status === PR_STATUS.ACTIVE)) {
       if (!allPrs.some(p => p.id === pr.id)) allPrs.push({ ...pr, _project: 'central' });
     }

package/engine/queries.js

@@ -72,6 +72,25 @@ function _resetPrEnrichmentCacheForTest() {
   _prEnrichmentInFlight.clear();
 }
 
+// W-mrcs8yqk001o6893 — shared enrichment-fallback resolver. Both the prLinks
+// loop and the wi._pr fallback loop in getPrdInfo() need the SAME defensive
+// behavior when the canonical PR id has no live record in pull-requests.json
+// (e.g. it was merged and then swept by the merged-PR cleanup routine): check
+// the enrichment cache first, else synthesize PR_STATUS.ACTIVE as a
+// placeholder and kick off a fire-and-forget enrollment so the next poll
+// (within PR_ENRICHMENT_TTL_MS) resolves the real status. Previously only the
+// wi._pr loop did this (W-mq5uzmc6001d708f); the prLinks loop hardcoded
+// `pr?.status || PR_STATUS.ACTIVE` with no self-heal, so PRs reached only via
+// pr_links stayed 'active' forever once removed from pull-requests.json.
+function _resolvePrStatusWithEnrichment(pr, canonicalPrId, project, itemId) {
+  if (pr?.status) return pr.status;
+  if (!canonicalPrId) return PR_STATUS.ACTIVE;
+  const cachedStatus = _getCachedPrEnrichment(canonicalPrId);
+  if (cachedStatus) return cachedStatus;
+  _scheduleAsyncPrEnrollment(canonicalPrId, project, itemId);
+  return PR_STATUS.ACTIVE;
+}
+
 /**
  * Read the first `bytes` and last `bytes` of a file efficiently using byte offsets.
  * For files <= 2*bytes, reads the whole file. Returns { head, tail } strings.
@@ -572,15 +591,6 @@ function _buildArchiveNotesByWiMap() {
   return out;
 }
 
-// Test/maintenance hook — drop the archive notes cache (mirrors the other
-// invalidate* helpers). Not normally needed: the cache self-heals via the
-// dir-mtime gate + TTL.
-function invalidateArchiveNotesByWiCache() {
-  _archiveNotesByWiCache = null;
-  _archiveNotesByWiCacheAt = 0;
-  _archiveNotesByWiCacheMtime = null;
-}
-
 // Build a wiId → [filename, ...] map by scanning the inbox + archive dirs.
 // Archive entries are prefixed with `archive:` so the dashboard renderer can
 // tell them apart (matches the convention already used by _artifacts.notes).
@@ -2363,7 +2373,18 @@ function getPrdInfo(config) {
     const url = buildPrUrlFromId(prId, pr, projects);
     for (const itemId of (itemIds || [])) {
       if (!prdToPr[itemId]) prdToPr[itemId] = [];
-      prdToPr[itemId].push({ id: prId, url, title: pr?.title || '', status: pr?.status || PR_STATUS.ACTIVE, _project: pr?._project || '' });
+      // W-mrcs8yqk001o6893 — when the pr_links mapping outlives the PR record
+      // (merged-PR sweep removes it from pull-requests.json but pr_links is
+      // never pruned), resolve the item's project so we can self-heal the
+      // status the same way the wi._pr fallback loop below does.
+      let itemProject = null;
+      if (!pr) {
+        const itemSource = (wiById[itemId] || allWiById[itemId] || {}).project
+          || (wiById[itemId] || allWiById[itemId] || {})._source || null;
+        itemProject = itemSource ? shared.resolveProjectSource(itemSource, projects, { allowCentral: false }).project || null : null;
+      }
+      const status = _resolvePrStatusWithEnrichment(pr, prId, itemProject, itemId);
+      prdToPr[itemId].push({ id: prId, url, title: pr?.title || '', status, _project: pr?._project || '' });
     }
   }
   // Fallback: work item _pr field for anything still missing
@@ -2379,17 +2400,8 @@ function getPrdInfo(config) {
     // exists (orphan _pr pointer), use a cached status from a prior async
     // enrollment if available, else synthesize ACTIVE and schedule a
     // fire-and-forget enrollment so the next status poll renders correctly.
-    let synthesizedStatus = pr?.status;
-    if (!pr && canonicalPrId) {
-      const cachedStatus = _getCachedPrEnrichment(canonicalPrId);
-      if (cachedStatus) {
-        synthesizedStatus = cachedStatus;
-      } else {
-        synthesizedStatus = PR_STATUS.ACTIVE;
-        _scheduleAsyncPrEnrollment(canonicalPrId, project, wi.id);
-      }
-    }
-    prdToPr[wi.id] = [{ id: pr?.id || canonicalPrId || wi._pr, url, title: pr?.title || '', status: synthesizedStatus || PR_STATUS.ACTIVE, _project: project?.name || '' }];
+    const synthesizedStatus = _resolvePrStatusWithEnrichment(pr, canonicalPrId, project, wi.id);
+    prdToPr[wi.id] = [{ id: pr?.id || canonicalPrId || wi._pr, url, title: pr?.title || '', status: synthesizedStatus, _project: project?.name || '' }];
   }
   // Aggregate sub-task PRs to decomposed parent (sub-tasks aren't PRD items but their PRs should show)
   for (const pr of allPrs) {
@@ -3422,7 +3434,7 @@ module.exports = {
   getKnowledgeBaseEntries, getKnowledgeBaseEntriesSnapshot, getKnowledgeBaseIndex,
 
   // Work items & PRD
-  getWorkItems, invalidateWorkItemsCache, invalidateArchiveNotesByWiCache, getPrdInfo,
+  getWorkItems, invalidateWorkItemsCache, getPrdInfo,
 
   // W-mq5uzmc6001d708f — test hooks for the defensive PR enrichment cache.
   _resetPrEnrichmentCacheForTest,

package/engine/shared.js

@@ -2306,8 +2306,47 @@ function runFile(file, args, opts = {}) {
   return _spawn(file, args, { windowsHide: true, ...opts });
 }
 
+// True when `p` is a UNC path (`\\server\share\...` or its forward-slash
+// form `//server/share/...`, e.g. `\\wsl.localhost\Ubuntu\...` / `\\wsl$\...`
+// for a WSL-hosted project). Windows' cmd.exe — the default shell
+// `execSync`/`exec` spawn under — refuses a UNC path as its working
+// directory ("UNC paths are not supported. Defaulting to Windows
+// directory."), which silently redirects the child's actual cwd elsewhere.
+function isUncPath(p) {
+  return typeof p === 'string' && (p.startsWith('\\\\') || p.startsWith('//'));
+}
+
+// Minimal argv tokenizer for the small, hardcoded `git ...` command strings
+// built elsewhere in this file — splits on whitespace, honoring
+// double-quoted segments (the only quoting these callers use, e.g. a branch
+// name interpolated as `"refs/heads/${branch}"`). Not a general shell
+// parser; only ever fed strings this codebase constructs itself.
+function _splitGitCommandLine(cmd) {
+  const argv = [];
+  const re = /"([^"]*)"|(\S+)/g;
+  let m;
+  while ((m = re.exec(cmd)) !== null) argv.push(m[1] !== undefined ? m[1] : m[2]);
+  return argv;
+}
+
 function execSilent(cmd, opts = {}) {
-  return _execSync(cmd, { stdio: 'pipe', windowsHide: true, ...opts });
+  const merged = { stdio: 'pipe', windowsHide: true, ...opts };
+  // W-mrcv3ky7000c2338 / opg#772 — a `git ...` shellout whose `cwd` is a UNC
+  // path (WSL-hosted project, or any other UNC-rooted checkout) would
+  // otherwise run through cmd.exe, which can't chdir into a UNC path and
+  // silently defaults to the Windows directory instead — the subsequent git
+  // command then fails with "fatal: not a git repository", and callers like
+  // cleanup.js's orphan/quarantine worktree-dir reaper have no ground truth
+  // for which worktrees are registered, so quarantined worktree husks are
+  // never reaped (unbounded disk growth). Re-parse into argv and run via
+  // execFileSync (shell:false) instead — that bypasses cmd.exe entirely and
+  // Windows' CreateProcess honors a UNC cwd correctly, exactly like
+  // shared.shellSafeGitSync / shared.removeWorktree already do.
+  if (typeof cmd === 'string' && /^git\b/.test(cmd.trim()) && isUncPath(merged.cwd)) {
+    const argv = _splitGitCommandLine(cmd);
+    return _execFileSync(argv[0], argv.slice(1), merged);
+  }
+  return _execSync(cmd, merged);
 }
 
 /**
@@ -3458,6 +3497,17 @@ const ENGINE_DEFAULTS = {
   // requested/completed PRDs still flow through the normal validator path so a
   // stale PRD reopen can't smuggle in unvetted items.
   preDispatchEvalSkipPrdSourced: true,
+  // W-mrcrh5hj0017d22f — repeat-rejection cap. addToDispatchWithValidation
+  // re-runs the LLM validator on EVERY discovery tick for a WI that's still
+  // `pending` — routing to the review queue (_routeToReviewQueue) dedupes
+  // that queue but never changes the WI's own status, so an item whose
+  // description the validator will never accept (see stage-output
+  // substitution bug above) got re-evaluated forever, once per tick,
+  // invisible to the dashboard. Once the SAME (unchanged) description is
+  // rejected this many consecutive times, the WI is flipped to `failed`
+  // with FAILURE_CLASS.PRE_DISPATCH_EVAL_STUCK instead of being silently
+  // re-queued into review again.
+  preDispatchEvalMaxRejections: 5,
   completionNonceRequired: false, // P-d2a8f6c1 (agent trust boundary F8): when true, a missing `nonce` field in the completion JSON hard-fails the dispatch with failure_class:'completion-nonce-mismatch'. Default false for one release so older agents/runtime caches that haven't picked up the prompt change degrade with a warning instead of breaking. Mismatched nonces hard-fail regardless of this flag. See docs/completion-reports.md → "Trust boundary".
   autoApplyReviewVote: false, // W-mpea9fyb0010febf / P-f7splitgate: master gate for ALL engine platform vote mutations. When true, the engine (a) mirrors live platform vote state into local pull-requests.json reviewStatus, (b) re-applies its own ADO +10 approval when ADO resets votes on target-branch advance (pollPrStatus), (c) reconciles its own prior negative on a verdict flip to APPROVE (ADO resetReviewerNegativeVote / GitHub dismissPriorViewerChangesRequestedReviews), and (d) instructs ADO review agents to cast `az repos pr set-vote`. When false (default), the verdict is recorded in pull-requests.json reviewStatus from the agent's completion ONLY — informational — and Minions never cast, re-cast, or clear a platform vote/review (ADO agents post the verdict as a comment only, parity with GitHub self-approval block).
 
@@ -4919,6 +4969,7 @@ const FAILURE_CLASS = {
   OUTPUT_TRUNCATED: 'output-truncated',   // P-8e4c2a17: the agent streamed more stdout than the engine's hard capture cap (engine.js AGENT_OUTPUT_CAP_BYTES, 1MB) BEFORE the terminal `result` event arrived. The result (session id, completion block, final text) lives at the END of the stream, so it fell outside the captured window and parseOutput found nothing — the dispatch would otherwise fail as an opaque UNKNOWN and retry to death. Surfaced loudly with an actionable message; non-retryable (mechanical retry just reproduces the overflow — the agent must reduce output volume or the task must be split).
   VERIFY_MISSING_PR: 'verify-missing-pr', // W-mqsk1ip00006cbae: a verify WI exited done but no PR was attached (neither _prUrl/_pr on the item nor a matching pull-requests.json entry for the plan). Flipped to failed so the plan doesn't silently advance without an E2E PR. Retryable — agent may have phantom-crashed before pushing the branch.
   PROJECT_NOT_FOUND: 'project_not_found', // W-mqv2wsy30002e090: a work item's `project` field names a project that is not configured (resolveConfiguredProject / formatUnknownProjectError → `Project "<name>" not found. Known projects: …`). Stamped at discovery time so the dashboard PR-column renderer surfaces the red failReason snippet like other non-retryable failures instead of burying it in the Agent column. Non-retryable — operator must fix the WI's project field or configure the project.
+  PRE_DISPATCH_EVAL_STUCK: 'pre-dispatch-eval-stuck', // W-mrcrh5hj0017d22f: pre-dispatch-eval rejected the SAME (unchanged) description ENGINE_DEFAULTS.preDispatchEvalMaxRejections times in a row without the WI status ever leaving pending — previously this burned an LLM validation call every discovery tick forever with nothing surfaced to the dashboard (constant-bug-bash's file-fixes stage wedged 16+ consecutive rejections, one/minute, until a human manually cancelled it). Engine now flips the WI to failed with this class so the stalled item is visible and stops silently re-evaluating; non-retryable until the description changes.
   UNKNOWN: 'unknown',                     // Unclassified failure
 };
 
@@ -9174,6 +9225,7 @@ module.exports = {
   exec,
   execAsync,
   execSilent,
+  isUncPath,
   shellSafeGh,
   shellSafeGit,
   removeStaleIndexLock,