@bridge_gpt/mcp-server 0.2.9 → 0.2.12

package/build/conductor/epic-runtime.js

@@ -17,16 +17,20 @@
  * All durable mutations go through the injectable seams that call the sibling
  * Epic Run TS client (already available in bridge-api-client.ts as of BAPI-407).
  */
-import { resolveConductorBridgeApiAccess, claimEpicSupervisionLease, fetchEpicRunState, advanceEpicTicketStatus, createEpicTicketStatus, recordEpicDispatch, transitionEpicDispatch, fetchParseStatus, triggerRepositoryParse, getEpicPlan, buildEpicDispatchKey, } from "./bridge-api-client.js";
+import { spawnSync } from "child_process";
+import { resolveConductorBridgeApiAccess, claimEpicSupervisionLease, fetchEpicRunState, advanceEpicTicketStatus, createEpicTicketStatus, recordEpicDispatch, transitionEpicDispatch, fetchParseStatus, triggerRepositoryParse, getEpicPlan, buildEpicDispatchKey, fetchEffectiveSupervisorConfig, fetchEffectiveSupervisorSetup, fetchPrReviewStatus, remediateEpicTicket, deletePullRequestBranch, transitionJiraStatus, } from "./bridge-api-client.js";
 import { processGateMetMerge } from "./supervisor-merge.js";
-import { rebuildObservedState, } from "./epic-state.js";
+import { rebuildObservedState, extractWorkerLiveness, } from "./epic-state.js";
 import { reconcileEpic } from "./epic-reconcile.js";
+import { buildSupervisorRemediationWorkerMessage } from "./supervisor-message-relay.js";
+import { sendWorkerMessage } from "./store.js";
 import { hashPlan } from "./plan.js";
-import { pollConductorEvents } from "./store.js";
+import { pollConductorEvents, POLL_LIMIT_MAX } from "./store.js";
 import { dispatchSupervisorNotification } from "./supervisor-notification.js";
 import { makeSupervisorIdempotencyKey } from "./supervisor-ledger.js";
 import { createDefaultStartTicketsDeps, orchestrateStartTickets } from "../start-tickets.js";
 import { orchestrateReviewTickets } from "../review-tickets.js";
+import { createStartTicketsConductorContext, provisionConductorHooksForRows, emitStartTicketsRunStarted, } from "../start-tickets-conductor.js";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -46,7 +50,7 @@ function defaultLeaseOwner() {
 async function defaultEscalateOnce(epicKey, reason) {
     process.stderr.write(`[epic-tick] ESCALATION epic=${epicKey} reason=${reason}\n`);
 }
-async function defaultDispatchSeam(_epicKey, ticketKey) {
+async function defaultDispatchSeam(_epicKey, ticketKey, _attempt = 0) {
     throw new Error(`dispatch seam not wired for ticket ${ticketKey}`);
 }
 async function defaultPostActionWaitSeam(_epicKey, _ticketKey) {
@@ -71,9 +75,13 @@ export async function runEpicTick(options, deps = {}) {
     const errorLog = deps.errorLog ?? ((msg) => process.stderr.write(`${msg}\n`));
     const escalateOnce = deps.escalateOnce ?? defaultEscalateOnce;
     const dispatchSeam = deps.dispatchSeam ?? defaultDispatchSeam;
+    // BAPI-445: optional review dispatch seam. When absent the spec re-review
+    // sequencing gate stays off (a ready ticket dispatches implementation directly).
+    const dispatchReviewSeamFn = deps.dispatchReviewSeam;
     const processMergeFn = deps.processMerge ?? processGateMetMerge;
     const postActionWaitSeam = deps.postActionWaitSeam ?? defaultPostActionWaitSeam;
-    const fetchLocalEvents = deps.fetchLocalEvents ?? ((_key) => []);
+    const fetchLocalEvents = deps.fetchLocalEvents ??
+        ((_key, _runIds) => []);
     const resolveBridgeAccess = deps.resolveBridgeAccess ?? resolveConductorBridgeApiAccess;
     const claimLeaseFn = deps.claimLease ?? claimEpicSupervisionLease;
     const fetchEpicStateFn = deps.fetchEpicState ?? fetchEpicRunState;
@@ -190,7 +198,15 @@ export async function runEpicTick(options, deps = {}) {
                 worker_count: 0,
             };
         }
-        const localEvents = fetchLocalEvents(epic_key);
+        // Scope the local-ledger read to this epic's dispatched run_ids. The shared
+        // ~/.config/bridge/events.db ledger accumulates events for every epic/worker
+        // on the machine; rebuildObservedState only folds signals whose run_id maps
+        // to one of these dispatches, so scoping the read here avoids loading the
+        // entire (up to 50K-row) ledger on every tick.
+        const dispatchedRunIds = epicRunState.dispatches
+            .map((d) => d.run_id)
+            .filter((rid) => typeof rid === "string" && rid.length > 0);
+        const localEvents = await fetchLocalEvents(epic_key, dispatchedRunIds);
         const observed = rebuildObservedState(epicRunState, localEvents, nowFn());
         workerCount = [...observed.ticket_statuses.values()].filter((s) => ACTIVE_WORKER_STATUSES.has(s)).length;
         // Step 3.5: Run post-action waits (parse-after-merge)
@@ -330,6 +346,98 @@ export async function runEpicTick(options, deps = {}) {
         }
         // Step 5: Reconcile observed→desired
         if (plan !== null) {
+            // BAPI-441: fetch the effective supervisor config (budget ceilings +
+            // liveness window) and setup (pr_bindings) once. Fail-open: if the config
+            // read fails, remediationConfig stays undefined and reconcile skips the
+            // remediation pass entirely (dispatch/merge steps unaffected).
+            let remediationConfig;
+            let livenessWindowSeconds = 120;
+            let prBindings = {};
+            try {
+                const cfg = await fetchEffectiveSupervisorConfig(access, epic_key);
+                remediationConfig = {
+                    max_remediation_attempts: cfg.max_remediation_attempts,
+                    max_remediation_no_progress_attempts: cfg.max_remediation_no_progress_attempts,
+                    auto_rereview_enabled: cfg.auto_rereview_enabled ?? false,
+                    teardown_enabled: cfg.teardown_enabled ?? false,
+                };
+                livenessWindowSeconds = cfg.worker_liveness_window_seconds;
+            }
+            catch (err) {
+                const safeMsg = err instanceof Error ? err.constructor.name : "config error";
+                errorLog(`[epic-tick] supervisor-config fetch failed (${safeMsg}); skipping remediation for epic=${epic_key}`);
+            }
+            if (remediationConfig) {
+                try {
+                    const setup = await fetchEffectiveSupervisorSetup(access, epic_key);
+                    if (setup.pr_bindings && typeof setup.pr_bindings === "object") {
+                        prBindings = setup.pr_bindings;
+                    }
+                }
+                catch (err) {
+                    const safeMsg = err instanceof Error ? err.constructor.name : "setup error";
+                    errorLog(`[epic-tick] supervisor-setup fetch failed (${safeMsg}); remediation PR resolution degraded for epic=${epic_key}`);
+                }
+            }
+            // ticket_key → dispatched run_id (the run whose heartbeat liveness reads).
+            // Seed from ticket_status.dispatch_run_id, then prefer the most-recent
+            // dispatch-ledger run_id per ticket so that after a remediation re-dispatch
+            // (a new attempt-scoped epic_dispatch row correlated with the fresh run_id)
+            // liveness tracks the NEW worker rather than the stale original.
+            const ticketRunIdMap = new Map();
+            for (const ts of epicRunState.ticket_statuses) {
+                if (ts.dispatch_run_id)
+                    ticketRunIdMap.set(ts.ticket_key, ts.dispatch_run_id);
+            }
+            // BAPI-445: split dispatch records by role. `:review`-suffixed dispatch keys
+            // are the pre-implementation spec re-review runs; they must be EXCLUDED from
+            // the implementation liveness map (so BAPI-441 remediation liveness only ever
+            // targets the implementation run) and tracked in a separate review map +
+            // per-ticket attempt counter consumed by the reviewing recovery branch.
+            const latestDispatchByTicket = new Map();
+            const reviewLatestDispatchByTicket = new Map();
+            const reviewAttemptCounts = new Map();
+            for (const d of epicRunState.dispatches) {
+                const isReview = d.dispatch_key.endsWith(":review");
+                if (isReview) {
+                    reviewAttemptCounts.set(d.ticket_key, (reviewAttemptCounts.get(d.ticket_key) ?? 0) + 1);
+                }
+                if (!d.run_id)
+                    continue;
+                const updatedAt = new Date(d.updated_at).getTime();
+                const target = isReview ? reviewLatestDispatchByTicket : latestDispatchByTicket;
+                const prev = target.get(d.ticket_key);
+                if (!prev || updatedAt >= prev.updatedAt) {
+                    target.set(d.ticket_key, { runId: d.run_id, updatedAt });
+                }
+            }
+            for (const [tk, info] of latestDispatchByTicket) {
+                ticketRunIdMap.set(tk, info.runId);
+            }
+            const reviewTicketRunIdMap = new Map();
+            for (const [tk, info] of reviewLatestDispatchByTicket) {
+                reviewTicketRunIdMap.set(tk, info.runId);
+            }
+            const resolvePrNumber = (ticketKey) => {
+                const raw = prBindings[ticketKey];
+                if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1)
+                    return raw;
+                if (raw && typeof raw === "object") {
+                    const obj = raw;
+                    const pr = obj.pr_number ?? obj.pr;
+                    if (typeof pr === "number" && Number.isInteger(pr) && pr >= 1)
+                        return pr;
+                }
+                return null;
+            };
+            const maxSeqForRun = (runId) => {
+                let maxSeq = 0;
+                for (const ev of localEvents) {
+                    if (ev.run_id === runId && ev.seq > maxSeq)
+                        maxSeq = ev.seq;
+                }
+                return maxSeq;
+            };
             const reconcileDeps = {
                 casTicketStatus: async (ek, tk, rowVersion, nextStatus, planVersion) => advanceEpicTicketStatus(access, {
                     epicKey: ek,
@@ -346,13 +454,30 @@ export async function runEpicTick(options, deps = {}) {
                         planVersion,
                     });
                 },
-                claimDispatchKey: async (ek, tk, planVersion) => recordEpicDispatch(access, {
+                claimDispatchKey: async (ek, tk, planVersion, role, attempt = 0) => recordEpicDispatch(access, {
                     epicKey: ek,
                     ticketKey: tk,
                     planVersion,
                     leaseOwner: lease_owner,
                     ttlSeconds: DEFAULT_DISPATCH_KEY_TTL_SECONDS,
+                    attempt,
+                    // BAPI-445: a review-role claim appends ":review" to the dispatch key
+                    // so the run-id maps above can separate review runs from impl runs.
+                    reviewRole: role === "review",
                 }),
+                // BAPI-445 spec re-review seams. dispatchReviewSeam is wired only when the
+                // factory provides it (gate stays off otherwise); the liveness + attempt
+                // accessors read the review-scoped maps built above.
+                dispatchReviewSeam: dispatchReviewSeamFn
+                    ? async (ek, tk, attempt = 0) => dispatchReviewSeamFn(ek, tk, attempt)
+                    : undefined,
+                readReviewWorkerLiveness: async (_ek, tk) => {
+                    const runId = reviewTicketRunIdMap.get(tk);
+                    if (!runId)
+                        return { alive: false, workerId: null };
+                    return extractWorkerLiveness(localEvents, runId, nowFn(), livenessWindowSeconds);
+                },
+                countReviewAttempts: (tk) => reviewAttemptCounts.get(tk) ?? 0,
                 correlateRunId: async (dispatchKey, runId) => {
                     await transitionEpicDispatch(access, {
                         dispatchKey,
@@ -360,13 +485,146 @@ export async function runEpicTick(options, deps = {}) {
                         runId,
                     });
                 },
-                dispatchSeam: async (ek, tk) => dispatchSeam(ek, tk),
+                dispatchSeam: async (ek, tk, attempt = 0) => dispatchSeam(ek, tk, attempt),
                 processMerge: async (acc, event) => processMergeFn(acc, event),
                 postActionWaitSeam: async (ek, tk) => postActionWaitSeam(ek, tk),
                 escalateOnce: async (ek, reason) => escalateOnce(ek, reason),
                 log,
+                // BAPI-442: teardown and Jira-transition seams (fail-open, optional).
+                teardownSeam: async (_ek, tk) => {
+                    // Resolve the PR number for the ticket.
+                    const prNumber = resolvePrNumber(tk);
+                    if (prNumber === null) {
+                        errorLog(`[epic-tick] teardown: no PR binding for ${tk}; skipping`);
+                        return;
+                    }
+                    // Fetch setup to get the expected head SHA if available; fall back to empty.
+                    let expectedSha = "";
+                    try {
+                        const setup = await fetchEffectiveSupervisorSetup(access, epic_key);
+                        const binding = (setup.pr_bindings ?? {})[tk];
+                        if (binding && typeof binding === "object") {
+                            const b = binding;
+                            if (typeof b.head_sha === "string")
+                                expectedSha = b.head_sha;
+                        }
+                    }
+                    catch {
+                        // Best-effort; proceed with empty SHA (endpoint still deletes by PR number)
+                    }
+                    try {
+                        await deletePullRequestBranch(access, prNumber, expectedSha || "");
+                        log(`[epic-tick] teardown: branch deleted for PR #${prNumber} (ticket=${tk})`);
+                    }
+                    catch (err) {
+                        const safeMsg = err instanceof Error ? err.constructor.name : "error";
+                        errorLog(`[epic-tick] teardown: branch-delete failed (${safeMsg}) for ${tk}`);
+                    }
+                    // Remove local worktree idempotently; errors are benign.
+                    try {
+                        spawnSync("git", ["worktree", "remove", "--force", tk], { stdio: "ignore" });
+                        log(`[epic-tick] teardown: worktree removed for ${tk}`);
+                    }
+                    catch {
+                        // Already removed or never created — idempotent skip.
+                    }
+                },
+                jiraTransitionSeam: async (_ek, tk) => {
+                    try {
+                        const result = await transitionJiraStatus(access, tk, "auto");
+                        if (result.status === "skipped") {
+                            log(`[epic-tick] jira-transition: no matching transition for ${tk} (skipped)`);
+                        }
+                        else {
+                            log(`[epic-tick] jira-transition: transitioned ${tk}`);
+                        }
+                    }
+                    catch (err) {
+                        const safeMsg = err instanceof Error ? err.constructor.name : "error";
+                        errorLog(`[epic-tick] jira-transition failed (${safeMsg}) for ${tk}`);
+                    }
+                },
+                // BAPI-441 remediation seams.
+                readWorkerLiveness: async (_ek, tk) => {
+                    const runId = ticketRunIdMap.get(tk);
+                    if (!runId)
+                        return { alive: false, workerId: null };
+                    return extractWorkerLiveness(localEvents, runId, nowFn(), livenessWindowSeconds);
+                },
+                remediateCas: async (ek, tk, attemptKind, reason) => {
+                    const prNumber = resolvePrNumber(tk);
+                    if (prNumber === null) {
+                        throw new Error(`remediate: no PR binding for ${tk}`);
+                    }
+                    const reviewStatus = (await fetchPrReviewStatus(access, prNumber));
+                    const headSha = reviewStatus?.detail?.head_sha ?? null;
+                    if (!headSha) {
+                        throw new Error(`remediate: no head_sha for PR ${prNumber}`);
+                    }
+                    const rowVersion = observed.ticket_row_versions.get(tk) ?? 0;
+                    // Deterministic block-state idempotency key: stable for a given durable
+                    // row_version so a same-tick retry replays (409, swallowed); advances
+                    // with the next attempt.
+                    const idempotencyKey = `remediate:${ek}:${tk}:${rowVersion}`;
+                    const result = await remediateEpicTicket(access, {
+                        pr_number: prNumber,
+                        epic_run_id: ek,
+                        ticket_key: tk,
+                        expected_row_version: rowVersion,
+                        head_sha: headSha,
+                        idempotency_key: idempotencyKey,
+                        attempt_kind: attemptKind,
+                        reason,
+                    });
+                    if (result.conflict) {
+                        return { conflict: true, reviewDigest: null, truncated: false };
+                    }
+                    return {
+                        conflict: false,
+                        reviewDigest: result.response.review_digest,
+                        truncated: result.response.truncated,
+                    };
+                },
+                sendNudge: async (_ek, tk, attempt, reviewDigest, truncated, reason, workerId) => {
+                    const runId = ticketRunIdMap.get(tk);
+                    if (!runId)
+                        throw new Error(`nudge: no run_id for ${tk}`);
+                    // workerId is resolved by readWorkerLiveness from the same heartbeat
+                    // scan and null-checked by the reconcile pass before remediateCas, so
+                    // the two seams stay consistent and no budget is burned on a missing id.
+                    const input = buildSupervisorRemediationWorkerMessage({
+                        runId,
+                        workerId,
+                        ticketKey: tk,
+                        reason,
+                        attempt,
+                        reviewDigest: reviewDigest ?? "",
+                        truncated,
+                        causeSeq: maxSeqForRun(runId),
+                    });
+                    sendWorkerMessage(input);
+                },
+                resumeDispatch: async (ek, tk, attempt) => {
+                    // Claim an attempt-scoped pending dispatch row FIRST so the spawn's
+                    // run_spawned correlation (inside orchestrateStartTickets) has a row to
+                    // transition and the re-dispatched run_id is durably recorded against
+                    // the ticket. The claim is idempotent (lease-held/already-spawned are
+                    // returned, not thrown).
+                    await recordEpicDispatch(access, {
+                        epicKey: ek,
+                        ticketKey: tk,
+                        planVersion: plan.plan_version,
+                        leaseOwner: lease_owner,
+                        ttlSeconds: DEFAULT_DISPATCH_KEY_TTL_SECONDS,
+                        attempt,
+                    });
+                    // dispatchSeam returns the new run_id; orchestrate correlates it into
+                    // the attempt-scoped epic_dispatch row, so the next tick's liveness map
+                    // (built from the dispatch ledger) tracks the fresh worker.
+                    await dispatchSeam(ek, tk, attempt);
+                },
             };
-            const reconcileResult = await reconcileEpic(access, observed, plan, reconcileDeps);
+            const reconcileResult = await reconcileEpic(access, observed, plan, reconcileDeps, remediationConfig);
             log(`[epic-tick] reconcile done: epic=${epic_key} ` +
                 `signals=${reconcileResult.signals_folded} ` +
                 `dispatched=${reconcileResult.dispatched} ` +
@@ -494,7 +752,7 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         const planHash = hashPlan(dag);
         return { plan_hash: planHash, plan_version: response.plan_version, tickets };
     };
-    const dispatchSeam = async (ek, tk) => {
+    const dispatchSeam = async (ek, tk, attempt = 0) => {
         // Guard: fetchPlan must run before dispatchSeam so cachedPlanVersion and
         // automationMap are populated. A zero version means the factory seam was
         // wired but fetchPlan was never called — fail explicitly rather than silently
@@ -502,6 +760,12 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         if (cachedPlanVersion === 0) {
             throw new Error(`dispatchSeam called before fetchPlan for epic ${ek} ticket ${tk}; cachedPlanVersion is 0`);
         }
+        // BAPI-441: a remediation re-dispatch (attempt > 0) reuses the existing
+        // branch/worktree (resume mode) and claims an attempt-scoped dispatch key so
+        // it is not deduped against the original epic dispatch.
+        const isResume = attempt > 0;
+        // The dispatch kind comes from the plan node's automation (start-tickets or
+        // review-tickets); default to start-tickets when unspecified.
         const kind = automationMap.get(tk) ?? "start-tickets";
         // Operator dry-run: when BAPI_CONDUCTOR_DISPATCH_DRY_RUN=1, dispatch resolves
         // the spawn command + model routing but opens NO terminal, creates NO worktree,
@@ -513,7 +777,7 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
             epic_key: ek,
             epic_run_id: ek,
             plan_version: cachedPlanVersion,
-            dispatch_key: buildEpicDispatchKey(ek, tk, cachedPlanVersion),
+            dispatch_key: buildEpicDispatchKey(ek, tk, cachedPlanVersion, attempt),
         };
         const deps = createDefaultStartTicketsDeps();
         let runId;
@@ -533,6 +797,14 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
             runId = result.rows[0]?.runId;
         }
         else {
+            // BAPI-409 / IH-1: epic dispatch (dispatch_key set) requires the conductor
+            // stage to mint a run_id and provision per-worker env/supervisor context.
+            // `conductorEnabled: true` alone is necessary but not sufficient — the
+            // BAPI-409 guard in orchestrateStartTickets fails closed unless the
+            // createConductorContext seam (and its siblings) is injected via the third
+            // `overrides` argument, exactly as the packaged start-tickets CLI does. The
+            // orchestrator short-circuits on dryRun before using them, so passing them
+            // unconditionally is safe; dispatchDryRun preserves the operator dry-run seam.
             const result = await orchestrateStartTickets(deps, {
                 keys: [tk],
                 epic: identity,
@@ -543,11 +815,13 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
                 refreshMain: false,
                 branchOverrides: {},
                 baseBranch: "main",
-                // Epic dispatch always uses the Conductor system (epic-tick coordinates
-                // workers through it), so the message-relay instruction must be present
-                // on epic-dispatched worker prompts regardless of the user-facing
-                // `--conductor` default.
                 conductorEnabled: true,
+                // BAPI-441: re-dispatch reuses the existing branch/worktree.
+                resumeMode: isResume,
+            }, {
+                createConductorContext: createStartTicketsConductorContext,
+                provisionConductorHooksForRows,
+                emitStartTicketsRunStarted,
             });
             if (!result.ok) {
                 throw new Error(`start-tickets dispatch failed: ${result.error}`);
@@ -564,11 +838,96 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         }
         return runId;
     };
-    const fetchLocalEvents = (_ek) => {
+    const dispatchReviewSeam = async (ek, tk, attempt = 0) => {
+        // BAPI-445: spawn the pre-implementation spec re-review as the review-tickets
+        // automation kind — ALWAYS a review, regardless of the ticket's own plan-node
+        // automation kind (which is an implementation kind). fetchPlan must have run
+        // first so cachedPlanVersion is populated (same guard as dispatchSeam).
+        if (cachedPlanVersion === 0) {
+            throw new Error(`dispatchReviewSeam called before fetchPlan for epic ${ek} ticket ${tk}; cachedPlanVersion is 0`);
+        }
+        const dispatchDryRun = process.env.BAPI_CONDUCTOR_DISPATCH_DRY_RUN === "1";
+        // Deliberately omit `dispatch_key` from the identity: the reconcile pass owns
+        // the idempotent :review key claim (recordEpicDispatch with reviewRole) and the
+        // run_spawned correlation. orchestrateReviewTickets still mints the run_id and
+        // injects BAPI_CONDUCTOR_RUN_ID into the review agent's environment, which is
+        // exactly the correlation channel the Python review orchestrator reads to stamp
+        // the spec_review.* verdict event with this review run's id (Phase 2).
+        const identity = {
+            epic_key: ek,
+            epic_run_id: ek,
+            plan_version: cachedPlanVersion,
+        };
+        const deps = createDefaultStartTicketsDeps();
+        const result = await orchestrateReviewTickets(deps, {
+            keys: [tk],
+            epic: identity,
+            agentName: "claude",
+            dryRun: dispatchDryRun,
+            maxParallel: 1,
+            auto: true,
+            // Product directive: the spec re-review is `/review-ticket --auto --rounds=2`.
+            rounds: 2,
+            reviewOverrides: {},
+        });
+        if (!result.ok) {
+            throw new Error(`spec re-review dispatch failed: ${result.error}`);
+        }
+        let runId = result.rows[0]?.runId;
+        if (!runId && dispatchDryRun) {
+            // Dry-run produced no real run_id; substitute a synthetic, attempt-scoped id
+            // so the reconcile correlate step still records the :review dispatch row.
+            runId = `dry-run:review:${ek}:${tk}:${cachedPlanVersion}:r${attempt}`;
+        }
+        if (!runId) {
+            throw new Error(`spec re-review dispatch returned no runId for ticket ${tk}`);
+        }
+        return runId;
+    };
+    const fetchLocalEvents = async (_ek, runIds) => {
         // Workers and the epic-tick process share the same local SQLite ledger
         // (~/.config/bridge/events.db). pollConductorEvents opens it read-only.
-        const result = pollConductorEvents({ data_mode: "full" });
-        return result.events;
+        //
+        // Scope the read to this epic's dispatched run_ids. The shared ledger holds
+        // events for every epic/worker on the machine (up to RETENTION_MAX_ROWS),
+        // but rebuildObservedState only folds signals whose run_id maps to one of
+        // these dispatches — so the run_ids filter pushes that scoping into SQL and
+        // avoids loading sibling-epic events on every tick. With no known run_ids
+        // (first tick before any dispatch) there is nothing to fold, so skip the
+        // read entirely.
+        //
+        // pollConductorEvents returns at most POLL_LIMIT_MAX events per call
+        // (default 100, capped at 1000) starting at `since_seq`. rebuildObservedState
+        // folds terminal signals (gate.met/run.stopped/merge.succeeded/ci.failed)
+        // ONLY from the events it is handed, so a single capped page silently hides
+        // recent terminal signals once the (scoped) result grows past one page —
+        // done-detection then breaks. Drain the COMPLETE history by paginating on the
+        // `next_seq` cursor until a short (or empty) page signals the tail.
+        if (runIds !== undefined && runIds.length === 0) {
+            return [];
+        }
+        const runIdsFilter = runIds && runIds.length > 0 ? { run_ids: [...runIds] } : undefined;
+        const events = [];
+        let sinceSeq = 1;
+        // Retention caps (retention_days/retention_max_rows) bound the ledger, but
+        // cap total iterations defensively against a non-advancing cursor.
+        const MAX_PAGES = 10_000;
+        for (let page = 0; page < MAX_PAGES; page += 1) {
+            const result = await pollConductorEvents({
+                data_mode: "full",
+                since_seq: sinceSeq,
+                limit: POLL_LIMIT_MAX,
+                filter: runIdsFilter,
+            });
+            events.push(...result.events);
+            // Stop on a short/empty page (no more rows) or a cursor that fails to
+            // advance (guards against an infinite loop).
+            if (result.count < POLL_LIMIT_MAX || result.next_seq <= sinceSeq) {
+                break;
+            }
+            sinceSeq = result.next_seq;
+        }
+        return events;
     };
     const escalateOnce = async (ek, reason) => {
         const candidate = {
@@ -620,8 +979,13 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
     return {
         fetchPlan,
         dispatchSeam,
+        dispatchReviewSeam,
         fetchLocalEvents,
         escalateOnce,
         postActionWaitSeam,
+        // BAPI-442 seams are wired at the reconcileDeps level inside runEpicTick
+        // (they need the per-tick `access` and `prBindings` closure). The factory
+        // returns the dispatchSeam with isReReview support; the other two seams are
+        // defined inline in the reconcileDeps object in runEpicTick.
     };
 }