@bridge_gpt/mcp-server 0.2.9 → 0.2.10

package/build/conductor/epic-reconcile.js

@@ -1,6 +1,6 @@
 /**
  * Deterministic observed→desired reconciliation for the Epic Supervisor
- * (BAPI-408).
+ * (BAPI-408, BAPI-436).
  *
  * Executes five steps in order:
  *   1. Fold terminal signals into Postgres via CAS
@@ -9,10 +9,15 @@
  *   4. Action approved merges via C6 delegation
  *   5. Schedule post-action wait hooks
  *
+ * Dispatch is purely merge-gated (BAPI-436): dependents are dispatched only
+ * after their predecessor reaches "done", which requires a merge.succeeded
+ * signal. gate.met and run.stopped fold to the intermediate "ready_for_review"
+ * state — dependents do NOT dispatch on these signals.
+ *
  * All durable mutations go through injected seams so the logic is testable
  * without real network, ledger, or terminal access.
  */
-import { computeReadySet } from "./epic-state.js";
+import { computeReadySet, decideRemediation } from "./epic-state.js";
 import { extractMergeActionIdentityFromGateEvent } from "./merge-ledger.js";
 // ---------------------------------------------------------------------------
 // reconcileEpic
@@ -21,7 +26,7 @@ import { extractMergeActionIdentityFromGateEvent } from "./merge-ledger.js";
  * Execute the deterministic observed→desired reconciliation pass. All I/O is
  * behind injected seams; the ready-set is computed by pure code (no LLM).
  */
-export async function reconcileEpic(access, observed, plan, deps) {
+export async function reconcileEpic(access, observed, plan, deps, supervisorConfig) {
     const result = {
         signals_folded: 0,
         dispatched: 0,
@@ -43,6 +48,22 @@ export async function reconcileEpic(access, observed, plan, deps) {
         if (casResult.ok) {
             result.signals_folded += 1;
             deps.log(`[epic-reconcile] folded ${signal.signal_type} for ${signal.ticket_key} → ${signal.next_status}`);
+            // BAPI-442: fire teardown + Jira transition strictly after merge.succeeded
+            // CAS → done. Both are fail-open: errors are logged and never abort the pass.
+            if (signal.signal_type === "merge.succeeded") {
+                if (supervisorConfig?.teardown_enabled && deps.teardownSeam) {
+                    await deps.teardownSeam(observed.epic_key, signal.ticket_key).catch((e) => {
+                        const safeMsg = e instanceof Error ? e.constructor.name : "teardown error";
+                        deps.log(`[epic-reconcile] teardown error for ${signal.ticket_key}: ${safeMsg}`);
+                    });
+                }
+                if (deps.jiraTransitionSeam) {
+                    await deps.jiraTransitionSeam(observed.epic_key, signal.ticket_key).catch((e) => {
+                        const safeMsg = e instanceof Error ? e.constructor.name : "jira error";
+                        deps.log(`[epic-reconcile] jira-transition error for ${signal.ticket_key}: ${safeMsg}`);
+                    });
+                }
+            }
         }
         else {
             // CAS conflict: another tick already advanced this ticket — non-fatal
@@ -61,8 +82,24 @@ export async function reconcileEpic(access, observed, plan, deps) {
     }
     // Step 2: Compute the ready-set (pure — never calls LLM)
     const readySet = computeReadySet(plan, observed.ticket_statuses);
-    // Step 3: Dispatch each ready ticket idempotently
+    // Step 3: Dispatch each ready ticket idempotently.
+    //
+    // NOTE (BAPI-442): an earlier draft performed a synchronous two-phase
+    // planned → ready_for_review → ready spec re-review here — it spawned
+    // /review-ticket and then dispatched implementation in the SAME tick. That did
+    // not actually gate implementation on the review (the verdict was never
+    // consulted and the review run_id was discarded), and it overloaded the
+    // BAPI-436 "ready_for_review" (awaiting-merge) state, leaving a liveness gap
+    // if the conductor crashed between the CAS and the dispatch. That path has
+    // been removed. `auto_rereview_enabled` is reserved until real review-gating —
+    // a distinct `reviewing` status, review-run correlation, multi-tick re-entry,
+    // and a spec-review verdict signal — is built (BAPI-445). Until then a ready
+    // ticket dispatches implementation directly regardless of the flag.
     for (const ticketKey of readySet) {
+        if (supervisorConfig?.auto_rereview_enabled) {
+            deps.log(`[epic-reconcile] auto_rereview_enabled is set but review-gating is not yet ` +
+                `implemented (BAPI-445); dispatching ${ticketKey} directly`);
+        }
         let claimResult;
         try {
             claimResult = await deps.claimDispatchKey(observed.epic_key, ticketKey, observed.plan_version);
@@ -118,6 +155,86 @@ export async function reconcileEpic(access, observed, plan, deps) {
             result.warnings.push(`correlate-failed for ${ticketKey}: ${safeMsg}`);
         }
     }
+    // Step 3.5: Remediation pass (BAPI-441) — re-act on blocked tickets under
+    // budget. Keyed off the folded "blocked" status + per-ticket counters, NOT a
+    // computeReadySet change (the ready-set still returns only planned tickets).
+    // Skipped entirely unless the remediation seams + supervisorConfig are wired.
+    const remediationWired = supervisorConfig !== undefined &&
+        deps.readWorkerLiveness !== undefined &&
+        deps.remediateCas !== undefined &&
+        deps.sendNudge !== undefined &&
+        deps.resumeDispatch !== undefined;
+    if (remediationWired) {
+        const cfg = supervisorConfig;
+        const readWorkerLiveness = deps.readWorkerLiveness;
+        const sendNudge = deps.sendNudge;
+        const resumeDispatch = deps.resumeDispatch;
+        const remediateCas = deps.remediateCas;
+        for (const [ticketKey, status] of observed.ticket_statuses) {
+            if (status !== "blocked")
+                continue;
+            // Per-ticket try/catch so a single ticket's failure never aborts the pass.
+            try {
+                const counters = observed.ticket_remediation_counters?.get(ticketKey) ?? {
+                    attempts: 0,
+                    no_progress: 0,
+                };
+                const liveness = await readWorkerLiveness(observed.epic_key, ticketKey);
+                const decision = decideRemediation(counters.attempts, counters.no_progress, liveness.alive, cfg);
+                if (decision === "escalate") {
+                    await escalate(observed.epic_key, `remediation-budget-exhausted:${ticketKey}`);
+                    deps.log(`[epic-reconcile] remediation escalate ${ticketKey} ` +
+                        `(attempts=${counters.attempts} no_progress=${counters.no_progress})`);
+                    continue;
+                }
+                // The attempt being recorded is the next one (1-based).
+                const attempt = counters.attempts + 1;
+                const attemptKind = decision;
+                // The folding reason frames the nudge (message type + digest). Default to
+                // the review path when the ledger no longer carries the blocking event.
+                const reason = observed.ticket_blocked_reasons?.get(ticketKey) ?? "review.changes_requested";
+                // A nudge needs a worker to address it to. The liveness scan already
+                // resolved the worker id from the same heartbeat that proved the worker
+                // alive; if it is missing we cannot relay, so skip BEFORE recording an
+                // attempt — otherwise the CAS would burn a budget unit with nothing sent.
+                if (decision === "nudge" && !liveness.workerId) {
+                    result.warnings.push(`remediation nudge skipped for ${ticketKey}: alive worker has no worker_id`);
+                    continue;
+                }
+                // Record the attempt durably FIRST. The remediate endpoint builds the
+                // (backend-redacted) review digest for a nudge and returns it, and is
+                // idempotent (a 409 replay returns conflict, not throw). An unexpected
+                // remediate failure is absorbed as a per-ticket warning so the rest of
+                // the pass still runs (crash-replay safe).
+                let casOutcome;
+                try {
+                    casOutcome = await remediateCas(observed.epic_key, ticketKey, attemptKind, reason);
+                }
+                catch (err) {
+                    const safeMsg = err instanceof Error ? err.constructor.name : "remediate error";
+                    result.warnings.push(`remediate-cas-failed for ${ticketKey} (${attemptKind}): ${safeMsg}`);
+                    continue;
+                }
+                if (casOutcome.conflict) {
+                    // Idempotency replay: the attempt was already recorded (and acted on)
+                    // on a prior tick. Do not re-act — the crash-replay self-heals here.
+                    result.warnings.push(`remediation replay swallowed for ${ticketKey} (${attemptKind})`);
+                    continue;
+                }
+                if (decision === "nudge") {
+                    await sendNudge(observed.epic_key, ticketKey, attempt, casOutcome.reviewDigest, casOutcome.truncated, reason, liveness.workerId);
+                }
+                else {
+                    await resumeDispatch(observed.epic_key, ticketKey, attempt);
+                }
+                deps.log(`[epic-reconcile] remediation ${decision} ${ticketKey} attempt=${attempt}`);
+            }
+            catch (err) {
+                const safeMsg = err instanceof Error ? err.constructor.name : "remediation error";
+                result.warnings.push(`remediation-error for ${ticketKey}: ${safeMsg}`);
+            }
+        }
+    }
     // Step 4: Action approved merges via C6 delegation
     for (const event of observed.pending_merge_events) {
         const identity = extractMergeActionIdentityFromGateEvent(event);

package/build/conductor/epic-runtime.js

@@ -17,16 +17,20 @@
  * All durable mutations go through the injectable seams that call the sibling
  * Epic Run TS client (already available in bridge-api-client.ts as of BAPI-407).
  */
-import { resolveConductorBridgeApiAccess, claimEpicSupervisionLease, fetchEpicRunState, advanceEpicTicketStatus, createEpicTicketStatus, recordEpicDispatch, transitionEpicDispatch, fetchParseStatus, triggerRepositoryParse, getEpicPlan, buildEpicDispatchKey, } from "./bridge-api-client.js";
+import { spawnSync } from "child_process";
+import { resolveConductorBridgeApiAccess, claimEpicSupervisionLease, fetchEpicRunState, advanceEpicTicketStatus, createEpicTicketStatus, recordEpicDispatch, transitionEpicDispatch, fetchParseStatus, triggerRepositoryParse, getEpicPlan, buildEpicDispatchKey, fetchEffectiveSupervisorConfig, fetchEffectiveSupervisorSetup, fetchPrReviewStatus, remediateEpicTicket, deletePullRequestBranch, transitionJiraStatus, } from "./bridge-api-client.js";
 import { processGateMetMerge } from "./supervisor-merge.js";
-import { rebuildObservedState, } from "./epic-state.js";
+import { rebuildObservedState, extractWorkerLiveness, } from "./epic-state.js";
 import { reconcileEpic } from "./epic-reconcile.js";
+import { buildSupervisorRemediationWorkerMessage } from "./supervisor-message-relay.js";
+import { sendWorkerMessage } from "./store.js";
 import { hashPlan } from "./plan.js";
-import { pollConductorEvents } from "./store.js";
+import { pollConductorEvents, POLL_LIMIT_MAX } from "./store.js";
 import { dispatchSupervisorNotification } from "./supervisor-notification.js";
 import { makeSupervisorIdempotencyKey } from "./supervisor-ledger.js";
 import { createDefaultStartTicketsDeps, orchestrateStartTickets } from "../start-tickets.js";
 import { orchestrateReviewTickets } from "../review-tickets.js";
+import { createStartTicketsConductorContext, provisionConductorHooksForRows, emitStartTicketsRunStarted, } from "../start-tickets-conductor.js";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -46,7 +50,7 @@ function defaultLeaseOwner() {
 async function defaultEscalateOnce(epicKey, reason) {
     process.stderr.write(`[epic-tick] ESCALATION epic=${epicKey} reason=${reason}\n`);
 }
-async function defaultDispatchSeam(_epicKey, ticketKey) {
+async function defaultDispatchSeam(_epicKey, ticketKey, _attempt = 0) {
     throw new Error(`dispatch seam not wired for ticket ${ticketKey}`);
 }
 async function defaultPostActionWaitSeam(_epicKey, _ticketKey) {
@@ -73,7 +77,8 @@ export async function runEpicTick(options, deps = {}) {
     const dispatchSeam = deps.dispatchSeam ?? defaultDispatchSeam;
     const processMergeFn = deps.processMerge ?? processGateMetMerge;
     const postActionWaitSeam = deps.postActionWaitSeam ?? defaultPostActionWaitSeam;
-    const fetchLocalEvents = deps.fetchLocalEvents ?? ((_key) => []);
+    const fetchLocalEvents = deps.fetchLocalEvents ??
+        ((_key, _runIds) => []);
     const resolveBridgeAccess = deps.resolveBridgeAccess ?? resolveConductorBridgeApiAccess;
     const claimLeaseFn = deps.claimLease ?? claimEpicSupervisionLease;
     const fetchEpicStateFn = deps.fetchEpicState ?? fetchEpicRunState;
@@ -190,7 +195,15 @@ export async function runEpicTick(options, deps = {}) {
                 worker_count: 0,
             };
         }
-        const localEvents = fetchLocalEvents(epic_key);
+        // Scope the local-ledger read to this epic's dispatched run_ids. The shared
+        // ~/.config/bridge/events.db ledger accumulates events for every epic/worker
+        // on the machine; rebuildObservedState only folds signals whose run_id maps
+        // to one of these dispatches, so scoping the read here avoids loading the
+        // entire (up to 50K-row) ledger on every tick.
+        const dispatchedRunIds = epicRunState.dispatches
+            .map((d) => d.run_id)
+            .filter((rid) => typeof rid === "string" && rid.length > 0);
+        const localEvents = fetchLocalEvents(epic_key, dispatchedRunIds);
         const observed = rebuildObservedState(epicRunState, localEvents, nowFn());
         workerCount = [...observed.ticket_statuses.values()].filter((s) => ACTIVE_WORKER_STATUSES.has(s)).length;
         // Step 3.5: Run post-action waits (parse-after-merge)
@@ -330,6 +343,82 @@ export async function runEpicTick(options, deps = {}) {
         }
         // Step 5: Reconcile observed→desired
         if (plan !== null) {
+            // BAPI-441: fetch the effective supervisor config (budget ceilings +
+            // liveness window) and setup (pr_bindings) once. Fail-open: if the config
+            // read fails, remediationConfig stays undefined and reconcile skips the
+            // remediation pass entirely (dispatch/merge steps unaffected).
+            let remediationConfig;
+            let livenessWindowSeconds = 120;
+            let prBindings = {};
+            try {
+                const cfg = await fetchEffectiveSupervisorConfig(access, epic_key);
+                remediationConfig = {
+                    max_remediation_attempts: cfg.max_remediation_attempts,
+                    max_remediation_no_progress_attempts: cfg.max_remediation_no_progress_attempts,
+                    auto_rereview_enabled: cfg.auto_rereview_enabled ?? false,
+                    teardown_enabled: cfg.teardown_enabled ?? false,
+                };
+                livenessWindowSeconds = cfg.worker_liveness_window_seconds;
+            }
+            catch (err) {
+                const safeMsg = err instanceof Error ? err.constructor.name : "config error";
+                errorLog(`[epic-tick] supervisor-config fetch failed (${safeMsg}); skipping remediation for epic=${epic_key}`);
+            }
+            if (remediationConfig) {
+                try {
+                    const setup = await fetchEffectiveSupervisorSetup(access, epic_key);
+                    if (setup.pr_bindings && typeof setup.pr_bindings === "object") {
+                        prBindings = setup.pr_bindings;
+                    }
+                }
+                catch (err) {
+                    const safeMsg = err instanceof Error ? err.constructor.name : "setup error";
+                    errorLog(`[epic-tick] supervisor-setup fetch failed (${safeMsg}); remediation PR resolution degraded for epic=${epic_key}`);
+                }
+            }
+            // ticket_key → dispatched run_id (the run whose heartbeat liveness reads).
+            // Seed from ticket_status.dispatch_run_id, then prefer the most-recent
+            // dispatch-ledger run_id per ticket so that after a remediation re-dispatch
+            // (a new attempt-scoped epic_dispatch row correlated with the fresh run_id)
+            // liveness tracks the NEW worker rather than the stale original.
+            const ticketRunIdMap = new Map();
+            for (const ts of epicRunState.ticket_statuses) {
+                if (ts.dispatch_run_id)
+                    ticketRunIdMap.set(ts.ticket_key, ts.dispatch_run_id);
+            }
+            const latestDispatchByTicket = new Map();
+            for (const d of epicRunState.dispatches) {
+                if (!d.run_id)
+                    continue;
+                const updatedAt = new Date(d.updated_at).getTime();
+                const prev = latestDispatchByTicket.get(d.ticket_key);
+                if (!prev || updatedAt >= prev.updatedAt) {
+                    latestDispatchByTicket.set(d.ticket_key, { runId: d.run_id, updatedAt });
+                }
+            }
+            for (const [tk, info] of latestDispatchByTicket) {
+                ticketRunIdMap.set(tk, info.runId);
+            }
+            const resolvePrNumber = (ticketKey) => {
+                const raw = prBindings[ticketKey];
+                if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1)
+                    return raw;
+                if (raw && typeof raw === "object") {
+                    const obj = raw;
+                    const pr = obj.pr_number ?? obj.pr;
+                    if (typeof pr === "number" && Number.isInteger(pr) && pr >= 1)
+                        return pr;
+                }
+                return null;
+            };
+            const maxSeqForRun = (runId) => {
+                let maxSeq = 0;
+                for (const ev of localEvents) {
+                    if (ev.run_id === runId && ev.seq > maxSeq)
+                        maxSeq = ev.seq;
+                }
+                return maxSeq;
+            };
             const reconcileDeps = {
                 casTicketStatus: async (ek, tk, rowVersion, nextStatus, planVersion) => advanceEpicTicketStatus(access, {
                     epicKey: ek,
@@ -360,13 +449,146 @@ export async function runEpicTick(options, deps = {}) {
                         runId,
                     });
                 },
-                dispatchSeam: async (ek, tk) => dispatchSeam(ek, tk),
+                dispatchSeam: async (ek, tk, attempt = 0) => dispatchSeam(ek, tk, attempt),
                 processMerge: async (acc, event) => processMergeFn(acc, event),
                 postActionWaitSeam: async (ek, tk) => postActionWaitSeam(ek, tk),
                 escalateOnce: async (ek, reason) => escalateOnce(ek, reason),
                 log,
+                // BAPI-442: teardown and Jira-transition seams (fail-open, optional).
+                teardownSeam: async (_ek, tk) => {
+                    // Resolve the PR number for the ticket.
+                    const prNumber = resolvePrNumber(tk);
+                    if (prNumber === null) {
+                        errorLog(`[epic-tick] teardown: no PR binding for ${tk}; skipping`);
+                        return;
+                    }
+                    // Fetch setup to get the expected head SHA if available; fall back to empty.
+                    let expectedSha = "";
+                    try {
+                        const setup = await fetchEffectiveSupervisorSetup(access, epic_key);
+                        const binding = (setup.pr_bindings ?? {})[tk];
+                        if (binding && typeof binding === "object") {
+                            const b = binding;
+                            if (typeof b.head_sha === "string")
+                                expectedSha = b.head_sha;
+                        }
+                    }
+                    catch {
+                        // Best-effort; proceed with empty SHA (endpoint still deletes by PR number)
+                    }
+                    try {
+                        await deletePullRequestBranch(access, prNumber, expectedSha || "");
+                        log(`[epic-tick] teardown: branch deleted for PR #${prNumber} (ticket=${tk})`);
+                    }
+                    catch (err) {
+                        const safeMsg = err instanceof Error ? err.constructor.name : "error";
+                        errorLog(`[epic-tick] teardown: branch-delete failed (${safeMsg}) for ${tk}`);
+                    }
+                    // Remove local worktree idempotently; errors are benign.
+                    try {
+                        spawnSync("git", ["worktree", "remove", "--force", tk], { stdio: "ignore" });
+                        log(`[epic-tick] teardown: worktree removed for ${tk}`);
+                    }
+                    catch {
+                        // Already removed or never created — idempotent skip.
+                    }
+                },
+                jiraTransitionSeam: async (_ek, tk) => {
+                    try {
+                        const result = await transitionJiraStatus(access, tk, "auto");
+                        if (result.status === "skipped") {
+                            log(`[epic-tick] jira-transition: no matching transition for ${tk} (skipped)`);
+                        }
+                        else {
+                            log(`[epic-tick] jira-transition: transitioned ${tk}`);
+                        }
+                    }
+                    catch (err) {
+                        const safeMsg = err instanceof Error ? err.constructor.name : "error";
+                        errorLog(`[epic-tick] jira-transition failed (${safeMsg}) for ${tk}`);
+                    }
+                },
+                // BAPI-441 remediation seams.
+                readWorkerLiveness: async (_ek, tk) => {
+                    const runId = ticketRunIdMap.get(tk);
+                    if (!runId)
+                        return { alive: false, workerId: null };
+                    return extractWorkerLiveness(localEvents, runId, nowFn(), livenessWindowSeconds);
+                },
+                remediateCas: async (ek, tk, attemptKind, reason) => {
+                    const prNumber = resolvePrNumber(tk);
+                    if (prNumber === null) {
+                        throw new Error(`remediate: no PR binding for ${tk}`);
+                    }
+                    const reviewStatus = (await fetchPrReviewStatus(access, prNumber));
+                    const headSha = reviewStatus?.detail?.head_sha ?? null;
+                    if (!headSha) {
+                        throw new Error(`remediate: no head_sha for PR ${prNumber}`);
+                    }
+                    const rowVersion = observed.ticket_row_versions.get(tk) ?? 0;
+                    // Deterministic block-state idempotency key: stable for a given durable
+                    // row_version so a same-tick retry replays (409, swallowed); advances
+                    // with the next attempt.
+                    const idempotencyKey = `remediate:${ek}:${tk}:${rowVersion}`;
+                    const result = await remediateEpicTicket(access, {
+                        pr_number: prNumber,
+                        epic_run_id: ek,
+                        ticket_key: tk,
+                        expected_row_version: rowVersion,
+                        head_sha: headSha,
+                        idempotency_key: idempotencyKey,
+                        attempt_kind: attemptKind,
+                        reason,
+                    });
+                    if (result.conflict) {
+                        return { conflict: true, reviewDigest: null, truncated: false };
+                    }
+                    return {
+                        conflict: false,
+                        reviewDigest: result.response.review_digest,
+                        truncated: result.response.truncated,
+                    };
+                },
+                sendNudge: async (_ek, tk, attempt, reviewDigest, truncated, reason, workerId) => {
+                    const runId = ticketRunIdMap.get(tk);
+                    if (!runId)
+                        throw new Error(`nudge: no run_id for ${tk}`);
+                    // workerId is resolved by readWorkerLiveness from the same heartbeat
+                    // scan and null-checked by the reconcile pass before remediateCas, so
+                    // the two seams stay consistent and no budget is burned on a missing id.
+                    const input = buildSupervisorRemediationWorkerMessage({
+                        runId,
+                        workerId,
+                        ticketKey: tk,
+                        reason,
+                        attempt,
+                        reviewDigest: reviewDigest ?? "",
+                        truncated,
+                        causeSeq: maxSeqForRun(runId),
+                    });
+                    sendWorkerMessage(input);
+                },
+                resumeDispatch: async (ek, tk, attempt) => {
+                    // Claim an attempt-scoped pending dispatch row FIRST so the spawn's
+                    // run_spawned correlation (inside orchestrateStartTickets) has a row to
+                    // transition and the re-dispatched run_id is durably recorded against
+                    // the ticket. The claim is idempotent (lease-held/already-spawned are
+                    // returned, not thrown).
+                    await recordEpicDispatch(access, {
+                        epicKey: ek,
+                        ticketKey: tk,
+                        planVersion: plan.plan_version,
+                        leaseOwner: lease_owner,
+                        ttlSeconds: DEFAULT_DISPATCH_KEY_TTL_SECONDS,
+                        attempt,
+                    });
+                    // dispatchSeam returns the new run_id; orchestrate correlates it into
+                    // the attempt-scoped epic_dispatch row, so the next tick's liveness map
+                    // (built from the dispatch ledger) tracks the fresh worker.
+                    await dispatchSeam(ek, tk, attempt);
+                },
             };
-            const reconcileResult = await reconcileEpic(access, observed, plan, reconcileDeps);
+            const reconcileResult = await reconcileEpic(access, observed, plan, reconcileDeps, remediationConfig);
             log(`[epic-tick] reconcile done: epic=${epic_key} ` +
                 `signals=${reconcileResult.signals_folded} ` +
                 `dispatched=${reconcileResult.dispatched} ` +
@@ -494,7 +716,7 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         const planHash = hashPlan(dag);
         return { plan_hash: planHash, plan_version: response.plan_version, tickets };
     };
-    const dispatchSeam = async (ek, tk) => {
+    const dispatchSeam = async (ek, tk, attempt = 0) => {
         // Guard: fetchPlan must run before dispatchSeam so cachedPlanVersion and
         // automationMap are populated. A zero version means the factory seam was
         // wired but fetchPlan was never called — fail explicitly rather than silently
@@ -502,6 +724,12 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         if (cachedPlanVersion === 0) {
             throw new Error(`dispatchSeam called before fetchPlan for epic ${ek} ticket ${tk}; cachedPlanVersion is 0`);
         }
+        // BAPI-441: a remediation re-dispatch (attempt > 0) reuses the existing
+        // branch/worktree (resume mode) and claims an attempt-scoped dispatch key so
+        // it is not deduped against the original epic dispatch.
+        const isResume = attempt > 0;
+        // The dispatch kind comes from the plan node's automation (start-tickets or
+        // review-tickets); default to start-tickets when unspecified.
         const kind = automationMap.get(tk) ?? "start-tickets";
         // Operator dry-run: when BAPI_CONDUCTOR_DISPATCH_DRY_RUN=1, dispatch resolves
         // the spawn command + model routing but opens NO terminal, creates NO worktree,
@@ -513,7 +741,7 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
             epic_key: ek,
             epic_run_id: ek,
             plan_version: cachedPlanVersion,
-            dispatch_key: buildEpicDispatchKey(ek, tk, cachedPlanVersion),
+            dispatch_key: buildEpicDispatchKey(ek, tk, cachedPlanVersion, attempt),
         };
         const deps = createDefaultStartTicketsDeps();
         let runId;
@@ -533,6 +761,14 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
             runId = result.rows[0]?.runId;
         }
         else {
+            // BAPI-409 / IH-1: epic dispatch (dispatch_key set) requires the conductor
+            // stage to mint a run_id and provision per-worker env/supervisor context.
+            // `conductorEnabled: true` alone is necessary but not sufficient — the
+            // BAPI-409 guard in orchestrateStartTickets fails closed unless the
+            // createConductorContext seam (and its siblings) is injected via the third
+            // `overrides` argument, exactly as the packaged start-tickets CLI does. The
+            // orchestrator short-circuits on dryRun before using them, so passing them
+            // unconditionally is safe; dispatchDryRun preserves the operator dry-run seam.
             const result = await orchestrateStartTickets(deps, {
                 keys: [tk],
                 epic: identity,
@@ -543,11 +779,13 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
                 refreshMain: false,
                 branchOverrides: {},
                 baseBranch: "main",
-                // Epic dispatch always uses the Conductor system (epic-tick coordinates
-                // workers through it), so the message-relay instruction must be present
-                // on epic-dispatched worker prompts regardless of the user-facing
-                // `--conductor` default.
                 conductorEnabled: true,
+                // BAPI-441: re-dispatch reuses the existing branch/worktree.
+                resumeMode: isResume,
+            }, {
+                createConductorContext: createStartTicketsConductorContext,
+                provisionConductorHooksForRows,
+                emitStartTicketsRunStarted,
             });
             if (!result.ok) {
                 throw new Error(`start-tickets dispatch failed: ${result.error}`);
@@ -564,11 +802,50 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         }
         return runId;
     };
-    const fetchLocalEvents = (_ek) => {
+    const fetchLocalEvents = (_ek, runIds) => {
         // Workers and the epic-tick process share the same local SQLite ledger
         // (~/.config/bridge/events.db). pollConductorEvents opens it read-only.
-        const result = pollConductorEvents({ data_mode: "full" });
-        return result.events;
+        //
+        // Scope the read to this epic's dispatched run_ids. The shared ledger holds
+        // events for every epic/worker on the machine (up to RETENTION_MAX_ROWS),
+        // but rebuildObservedState only folds signals whose run_id maps to one of
+        // these dispatches — so the run_ids filter pushes that scoping into SQL and
+        // avoids loading sibling-epic events on every tick. With no known run_ids
+        // (first tick before any dispatch) there is nothing to fold, so skip the
+        // read entirely.
+        //
+        // pollConductorEvents returns at most POLL_LIMIT_MAX events per call
+        // (default 100, capped at 1000) starting at `since_seq`. rebuildObservedState
+        // folds terminal signals (gate.met/run.stopped/merge.succeeded/ci.failed)
+        // ONLY from the events it is handed, so a single capped page silently hides
+        // recent terminal signals once the (scoped) result grows past one page —
+        // done-detection then breaks. Drain the COMPLETE history by paginating on the
+        // `next_seq` cursor until a short (or empty) page signals the tail.
+        if (runIds !== undefined && runIds.length === 0) {
+            return [];
+        }
+        const runIdsFilter = runIds && runIds.length > 0 ? { run_ids: [...runIds] } : undefined;
+        const events = [];
+        let sinceSeq = 1;
+        // Retention caps (retention_days/retention_max_rows) bound the ledger, but
+        // cap total iterations defensively against a non-advancing cursor.
+        const MAX_PAGES = 10_000;
+        for (let page = 0; page < MAX_PAGES; page += 1) {
+            const result = pollConductorEvents({
+                data_mode: "full",
+                since_seq: sinceSeq,
+                limit: POLL_LIMIT_MAX,
+                filter: runIdsFilter,
+            });
+            events.push(...result.events);
+            // Stop on a short/empty page (no more rows) or a cursor that fails to
+            // advance (guards against an infinite loop).
+            if (result.count < POLL_LIMIT_MAX || result.next_seq <= sinceSeq) {
+                break;
+            }
+            sinceSeq = result.next_seq;
+        }
+        return events;
     };
     const escalateOnce = async (ek, reason) => {
         const candidate = {
@@ -623,5 +900,9 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         fetchLocalEvents,
         escalateOnce,
         postActionWaitSeam,
+        // BAPI-442 seams are wired at the reconcileDeps level inside runEpicTick
+        // (they need the per-tick `access` and `prBindings` closure). The factory
+        // returns the dispatchSeam with isReReview support; the other two seams are
+        // defined inline in the reconcileDeps object in runEpicTick.
     };
 }