@defrex/autobuild 0.10.1 → 0.11.0

package/README.md

@@ -24,7 +24,7 @@ needs an authenticated [`gh` CLI](https://cli.github.com) or an exported
 <!-- release-install:start -->
 
 ```sh
-bun add -g @defrex/autobuild@0.10.1
+bun add -g @defrex/autobuild@0.11.0
 ```
 
 <!-- release-install:end -->

package/SPEC.md

@@ -233,6 +233,19 @@ Small, independently runnable, crash-safe:
 - **ingesters** — other outer-loop processes turning signals into proposals (§12).
 - **operator** — UI process(es); see §14.
 
+Ticket-source ready scans run immediately when no completed measurement exists,
+then every
+`ticketScanIntervalSeconds` (default 60 seconds, a positive integer). Actual
+tick spacing is the floor when the configured interval is shorter. A
+same-repository `pr.merged`, `build.completed`, or `build.aborted` fact forces
+another scan on the next tick; changed ready criteria also force a scan.
+Housekeeping keeps its ordinary tick cadence. Between scans, queue depth and
+standing diagnostics repeat the last completed measurement, including across
+process restarts. Tickets groomed directly in the tracker are picked up within
+one scan interval plus one tick when capacity permits. Observation while intake
+is off shares the cadence; an observation measurement cannot suppress a fresh
+admission scan when intake is enabled.
+
 ### 3.4 The event log spine
 
 Build processes append typed events to per-build logs; repository-scoped outer
@@ -2243,6 +2256,7 @@ ordinary boundary reload resumes.
 ```toml
 baseBranch = "main"
 capacity = 3                    # concurrent builds for this repo
+ticketScanIntervalSeconds = 60  # positive integer; ready scans, with tick spacing as floor
 forge = "github"                # builtin: github | local-git; or a plugin name
 plugins = ["./plugins/local.ts", "@acme/autobuild-plugin"]
 
@@ -2350,7 +2364,7 @@ decide where a build's effective configuration is composed from:
 |---|---|---|
 | Build-owned (pinned) | `[verify]` and `[verify.<step>]`, `[finalize]` and `[finalize.<step>]`, `[commands]`, `[workspace]` (provider and config, including `provisioning` and `runtimeProvisioning`) | The build's own branch: its branch head once it has published commits, otherwise the recorded base commit its workspace was cut from. The exact commit is recorded once per deposit in the effective-config artifact metadata — except in checkout mode when the worktree read cannot be attributed to the branch-head commit: because the worktree file has uncommitted edits, because the clean/dirty comparison could not be performed (non-git workspace or a transient git error), or because the branch head never carried the file. The deposit then records the source `worktree-dirty` and no commit, because no commit claims the worktree bytes (the build still runs them). |
 | Deployment-owned (live) | `[roles]` (runtime, model, args, alternates, per-role `sessionBudgetSeconds`) and `[policy]` (budgets, retry bounds, stall and harvest knobs) | The dispatcher's live snapshot; an accepted reload delivers these to active builds. |
-| Dispatcher-owned | `baseBranch`, `capacity`, `forge`, `plugins`, `pr`, `tickets`, `orchestrator` | The dispatcher's live snapshot; the build runner never interprets them. |
+| Dispatcher-owned | `baseBranch`, `capacity`, `ticketScanIntervalSeconds`, `forge`, `plugins`, `pr`, `tickets`, `orchestrator` | The dispatcher's live snapshot; the build runner never interprets them. |
 
 A build's pipeline definition is therefore composed from the build's own
 branch: in origin mode the dispatcher reads `autobuild.toml` at the build's

package/bin/ab-dispatch-kernel.ts

@@ -23,7 +23,7 @@ try {
 }
 
 const stop = new AbortController()
-const requestStop = (): void => stop.abort()
+const requestStop = (signal?: string): void => stop.abort(signal)
 // Keep both handlers installed through the complete graceful drain. The first
 // targeted SIGINT comes from the supervisor; later foreground-group signals
 // must not regain their default disposition inside an open claim tick.

package/docs/configuration.md

@@ -168,7 +168,7 @@ the branch head never carried the file — the deposit records the source
 provenance declines to attribute them to any commit. **Deployment-owned** sections — `[roles]`
 (runtime, model, args, alternates, per-role `sessionBudgetSeconds`) and
 `[policy]` — keep flowing live. **Dispatcher-owned** sections (`baseBranch`,
-`capacity`, `forge`, `plugins`, `pr`, `tickets`, `orchestrator`) configure the
+`capacity`, `ticketScanIntervalSeconds`, `forge`, `plugins`, `pr`, `tickets`, `orchestrator`) configure the
 dispatcher itself and are never interpreted by the build runner.
 
 Consequently, an accepted base-branch reload re-deposits only the
@@ -195,6 +195,7 @@ These fields hot-reload:
 | Field or table | Boundary where a new value applies |
 |---|---|
 | `baseBranch` | Next dispatch or base fallback decision; existing `build.created` facts remain immutable. |
+| `ticketScanIntervalSeconds` | Next tick; evaluates elapsed time against the new interval. |
 | `capacity` | Next dispatcher tick. |
 | `[pr]` | Next build creation. |
 | `[commands]` | Next setup, verify check, or finalize check selected for a build whose OWN branch carries it. A base-branch reload does not retarget an in-flight build. |
@@ -229,10 +230,24 @@ any table header.
 | Field | Default | Constraints | Purpose |
 |---|---:|---|---|
 | `baseBranch` | `"main"` | nonempty string | Branch used to cut builds, target PRs, and merge during reconciliation. |
+| `ticketScanIntervalSeconds` | `60` | positive integer seconds | Ticket-source ready scan cadence; tick spacing is the effective minimum. |
 | `capacity` | `1` | positive integer | Maximum concurrent nonterminal builds for this repository. Paused and blocked builds still occupy capacity. |
 | `forge` | `"github"` | nonblank string | Forge adapter name. Shipped values are `github` and `local-git`; configured plugins may register other names. |
 | `plugins` | `[]` | array of unique nonblank module specifiers | Trusted Bun plugin modules loaded by dispatch, `ab ticket`, and scoped phase CLI processes. |
 
+Ticket-source ready scans run immediately when no completed measurement exists,
+then every
+`ticketScanIntervalSeconds` (default 60 seconds, a positive integer). Actual
+tick spacing is the floor when the configured interval is shorter. A
+same-repository `pr.merged`, `build.completed`, or `build.aborted` fact forces
+another scan on the next tick; changed ready criteria also force a scan.
+Housekeeping keeps its ordinary tick cadence. Between scans, queue depth and
+standing diagnostics repeat the last completed measurement, including across
+process restarts. Tickets groomed directly in the tracker are picked up within
+one scan interval plus one tick when capacity permits. Observation while intake
+is off shares the cadence; an observation measurement cannot suppress a fresh
+admission scan when intake is enabled.
+
 ### Plugin modules
 
 <!-- config-fragment:plugins -->
@@ -313,7 +328,12 @@ without adding a runtime Autobuild dependency to the plugin. That entry point
 exports the manifest/factory types, port types, fake adapters, and reusable
 TicketSource, AgentRunner, WorkspaceProvider, Forge, BuildStore, and BlobStore
 contract suites. Adapter values may use the backward-compatible bare factory or
-carry a contract fixture descriptor. Ticket sources may also declare
+carry a contract fixture descriptor.
+TicketSource adapters must populate the required `Ticket.resolved` boolean on
+listReady, get, and create projections, using the same native lifecycle rules as
+`dependencyStates`. Plugin authors upgrading older adapters must add this field;
+ready-state membership does not imply that a ticket is unresolved. Dispatch
+reuses these facts only within the current tick. Ticket sources may also declare
 `requiredEnv`; the host checks every declared variable for a nonempty value
 before invoking the adapter factory. Plugins using Forge abort-cleanup and
 AgentRunner turn-cancellation capabilities introduced in API 1.2 should require
@@ -1259,6 +1279,15 @@ triageState = "Backlog"
 Linear credentials do not belong in this table. Set `LINEAR_API_KEY` in the
 environment or local `.env` file described below.
 
+[Linear's request budget](https://linear.app/developers/rate-limiting) is shared
+by every dispatcher and `ab ticket` command using the API key, and by other keys
+belonging to the same authenticated user. A rate-limited ready scan or dependency
+read fails the evaluation tick without new intake claims or synthetic
+dependency-blocked counts. That source instance suppresses requests until the
+reported reset time; the next call then runs normally. Missing, invalid or expired
+reset headers use a conservative 60-second cooldown. Cooldowns are local to the
+instance: processes and restarts do not coordinate their budgets.
+
 For a hosted backend, repository policy remains local while credentials remain
 at the service:
 
@@ -1323,7 +1352,7 @@ restart-classified as a whole.
 | `model` | — | nonblank string, required when `enabled = true` | Provider-qualified model string for the turn runner, in the same vocabulary as `[roles]` model strings (a leading `vercel-ai-gateway/` prefix is accepted and stripped). Resolved through the deployment's gateway credential. |
 | `invocationBudgetSeconds` | `240` | positive integer, clamped to 300 | Wall-clock budget for one turn invocation. A larger value is clamped — not rejected — to the 300-second hosted function limit the runner executes under (`ORCHESTRATOR_ROUTE_LIMIT_SECONDS`, the same number the operator route pins as `maxDuration`). |
 | `approvals` | see below | array of `tool` or `tool:qualifier` strings | Registry tool names whose calls suspend a turn until the operator answers. Default: `["builds.control:abort", "builds.control:discard", "builds.answer:revise-spec", "sandbox.publish", "tickets.move:ready"]`. Empty (`[]`) means none — autonomous operation. An entry naming an absent or unknown tool is **inert by design**, never a config error: the list stays stable while the registry grows, and a tool's removal cannot break parsing. A `tool:qualifier` entry applies to the named discriminator value only (for example `tickets.move:ready` approves moving a ticket to `ready`); for a tool without a discriminator, only the bare form matches. |
-| `wake` | inherits the default | array of event-type globs | The attention events a **new** session wakes for. Kept schema-optional so absent (inherit the default attention set — the build events `ab watch` filters on by default plus the repository-journal events `ab watch --repository` follows) and `[]` (never wake; message-only) stay distinct. Each glob must match at least one build or repository-journal event type, validated with the same compiler `ab watch` uses. Existing sessions never retroactively inherit; an explicit `PUT .../wake` always wins. |
+| `wake` | inherits the default | array of event-type globs | The attention events a **new** session wakes for. Kept schema-optional so absent (inherit the default attention set — the build events `ab watch` filters on by default plus the repository-journal events `ab watch` follows) and `[]` (never wake; message-only) stay distinct. Each glob must match at least one build or repository-journal event type, validated with the same compiler `ab watch` uses. Existing sessions never retroactively inherit; an explicit `PUT .../wake` always wins. |
 | `sandbox` | — | strict subtable; absence reads as the defaults | Sandbox behavior knobs. |
 
 `[orchestrator.sandbox]` fields:

package/docs/operator-api.md

@@ -184,3 +184,20 @@ The API does not expose phase-session commands, runner startup, a push or
 long-poll streaming transport, or a generic event-append operation; event
 streaming is composed client-side by `ab watch`, which polls the store's
 event reads.
+
+
+Dispatcher liveness is also visible through `ab repository status --json`:
+`dispatcher.holder` identifies the unexpired repository lease owner, independently
+of `latestRun`. Heartbeat age measures attributable renewals; tick age measures
+durable progress. Missing historical evidence is null. The liveness query uses
+bounded repository facts first, with a full-history fallback when a later
+invocation hides the holder start or the latest stop. Other state reads retain
+their bounded semantics.
+
+Repository-following `ab watch` additionally emits a read-only `dispatcher.lost`
+observation when an observed lease expires without a matching stop. JSON carries
+`observation` instead of `event`, with run, observedAt, leaseExpiresAt and available
+identity, plus the usual repo/build/state/cursor fields. It invents no durable
+sequence or actor. Retain the cursor to avoid repeat reports across invocations.
+No lease alone is not evidence of death. SIGINT, SIGHUP and SIGTERM drain dispatch,
+record the first signal in the stop fact, and release its lease before exit.

package/docs/remote-ticket-protocol.md

@@ -77,3 +77,8 @@ The shared `TicketSource` contract is normative for the database adapter and
 the hosted client/server pair. External pass-through is tested with a fake
 source behind HTTP. The existing opt-in live Linear contract remains the proof
 of Linear's GraphQL behavior; the hosted service uses that adapter unchanged.
+
+Every ticket returned by list, get, or create requires a boolean `resolved`,
+with the same source-native completion semantics as `DependencyState.resolved`.
+The client preserves it when remapping ticket references. Missing or non-boolean
+values fail wire validation. Client and service still require exact version matches.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defrex/autobuild",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "Agent-driven software delivery from groomed ticket to merged PR",
   "repository": {
     "type": "git",
@@ -139,8 +139,8 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.5",
-    "@defrex/autobuild-postgres-store": "0.9.0",
-    "@defrex/autobuild-vercel-sandbox": "0.9.0",
+    "@defrex/autobuild-postgres-store": "0.10.1",
+    "@defrex/autobuild-vercel-sandbox": "0.10.1",
     "@resvg/resvg-js": "2.6.2",
     "@types/bun": "^1.3.14",
     "@types/node": "^24.0.0",

package/packages/core/src/cli/binary.ts

@@ -53,7 +53,7 @@ export async function withDispatchTerminalRestore<T>(
   terminal: TerminalOut,
   run: () => Promise<T>,
   boundary: TerminalRestoreProcess = process as unknown as TerminalRestoreProcess,
-  requestStop: () => void = () => {},
+  requestStop: (signal: NodeJS.Signals) => void = () => {},
 ): Promise<T> {
   const hook =
     command === 'dispatch'
@@ -96,7 +96,7 @@ export async function runBinary(
     // cleanly at the next tick boundary (§15.6-C: in-flight leases expire and
     // a future dispatch re-attaches).
     const controller = new AbortController()
-    const onSigint = (): void => controller.abort()
+    const onSigint = (): void => controller.abort('SIGINT')
     const ownsSigint = usesGenericSessionlessSigintHandler(command)
     const terminal = processTerminal(process.stdout)
     const removeSigint = installSessionlessSigintHandler(command, onSigint)
@@ -119,7 +119,7 @@ export async function runBinary(
             ...(resolveDashboardRenderer !== undefined ? { resolveDashboardRenderer } : {}),
           }),
         process as unknown as TerminalRestoreProcess,
-        onSigint,
+        (signal) => controller.abort(signal),
       )
     } finally {
       removeSigint()

package/packages/core/src/cli/dashboard/model.ts

@@ -268,6 +268,8 @@ export interface DashboardModel {
   harvestPaused: boolean
   /** Stable row identity, never a row index. */
   selection?: DashboardSelection
+  /** Invocation-local standby identity, independent of notices and build rows. */
+  standby?: string
   /** Release courtesy, separate from transient and startup warnings so those
    * notices can never overwrite one another. Store-only frontends project it
    * from their correlated dispatcher run. */
@@ -1090,6 +1092,7 @@ interface DashboardFrameHeader {
   queued: number
   observationCount: number
   selection?: DashboardSelection
+  standby?: string
   availableUpgrade?: string
   warningLines?: readonly string[]
   resumeInput?: ResumeInputView
@@ -1125,6 +1128,7 @@ export function buildDashboardFromProjected(
     defaultAutoMerge: settings.defaultAutoMerge,
     harvestPaused: harvestProjection.harvestPaused,
     ...(header.selection !== undefined ? { selection: header.selection } : {}),
+    ...(header.standby !== undefined ? { standby: header.standby } : {}),
     ...(header.availableUpgrade !== undefined ? { availableUpgrade: header.availableUpgrade } : {}),
     ...(header.warningLines !== undefined && header.warningLines.length > 0
       ? { warningLines: header.warningLines }

package/packages/core/src/cli/dashboard/render.ts

@@ -722,6 +722,21 @@ interface DetailGeometry extends DetailBodyLayout {
   limit: number
 }
 
+function standbyLine(model: DashboardModel, color: boolean, width: number): string[] {
+  return model.standby === undefined
+    ? []
+    : [
+        truncate(
+          paint(
+            `  Dispatcher on standby: repository held by ${displayText(model.standby)}`,
+            'yellow',
+            color,
+          ),
+          width,
+        ),
+      ]
+}
+
 function upgradeNoticeLine(
   model: DashboardModel,
   color: boolean,
@@ -749,7 +764,8 @@ function detailGeometry(
   const build = model.builds.find((candidate) => candidate.slug === view.slug)
   if (build === undefined) return undefined
   const layout = detailBody(build, view, { color: false, width, height, now: 0 })
-  const topLength = 2 + (model.availableUpgrade === undefined ? 0 : 1)
+  const topLength =
+    2 + (model.standby === undefined ? 0 : 1) + (model.availableUpgrade === undefined ? 0 : 1)
   const controls =
     model.resumeInput !== undefined || model.abortConfirmation !== undefined
       ? dashboardControls(model, false, width, controlsCapacity(height, topLength))
@@ -808,6 +824,7 @@ function renderDetail(model: DashboardModel, opts: RenderOpts): string[] {
       `  status ${paint(build.status.toUpperCase(), STATUS_COLOR[build.status], color)}${paused}`,
       width,
     ),
+    ...standbyLine(model, color, width),
     ...(notice === undefined ? [] : [notice]),
   ]
   const { body } = detailBody(build, view, opts)
@@ -862,11 +879,12 @@ export function transcriptScrollLimit(
   terminalWidth: number,
   height: number,
   hasUpgradeNotice = false,
+  hasStandby = false,
 ): number {
   const contentLines = transcriptContent(presentation, dashboardContentWidth(terminalWidth)).length
-  // Transcript chrome is two header rows, the optional upgrade row, two
+  // Transcript chrome is two header rows, optional standby/upgrade rows, two
   // separators, and controls. Keep this in lockstep with renderTranscript.
-  const capacity = Math.max(0, height - 5 - (hasUpgradeNotice ? 1 : 0))
+  const capacity = Math.max(0, height - 5 - (hasUpgradeNotice ? 1 : 0) - (hasStandby ? 1 : 0))
   return Math.max(0, contentLines - capacity)
 }
 
@@ -877,8 +895,15 @@ export function moveTranscriptScroll(
   current: number,
   delta: number,
   hasUpgradeNotice = false,
+  hasStandby = false,
 ): number {
-  const limit = transcriptScrollLimit(presentation, terminalWidth, height, hasUpgradeNotice)
+  const limit = transcriptScrollLimit(
+    presentation,
+    terminalWidth,
+    height,
+    hasUpgradeNotice,
+    hasStandby,
+  )
   // Clamp current first because a resize, or state from an older controller,
   // may leave it beyond the freshly wrapped viewport's end.
   return Math.max(0, Math.min(limit, Math.min(current, limit) + delta))
@@ -909,6 +934,7 @@ function renderTranscript(model: DashboardModel, opts: RenderOpts): string[] {
   const top = [
     truncate(`${paint('Transcript', 'bold', color)}  ${displayText(view.slug)}`, width),
     truncate(`  session ${displayText(view.sessionId)}`, width),
+    ...standbyLine(model, color, width),
     ...(notice === undefined ? [] : [notice]),
   ]
   const content = transcriptContent(view.transcript, width).map((line) => truncate(line, width))
@@ -948,11 +974,12 @@ export function sessionScrollLimit(
   terminalWidth: number,
   height: number,
   hasUpgradeNotice = false,
+  hasStandby = false,
 ): number {
   const contentLines = sessionContentLines(view, dashboardContentWidth(terminalWidth)).length
-  // Session chrome is two header rows, the optional upgrade row, two
+  // Session chrome is two header rows, optional standby/upgrade rows, two
   // separators, and controls — the transcript's exact arithmetic.
-  const capacity = Math.max(0, height - 5 - (hasUpgradeNotice ? 1 : 0))
+  const capacity = Math.max(0, height - 5 - (hasUpgradeNotice ? 1 : 0) - (hasStandby ? 1 : 0))
   return Math.max(0, contentLines - capacity)
 }
 
@@ -963,8 +990,9 @@ export function moveSessionScroll(
   current: number,
   delta: number,
   hasUpgradeNotice = false,
+  hasStandby = false,
 ): number {
-  const limit = sessionScrollLimit(view, terminalWidth, height, hasUpgradeNotice)
+  const limit = sessionScrollLimit(view, terminalWidth, height, hasUpgradeNotice, hasStandby)
   // Clamp current first: a resize, a feed apply, or state from an older
   // controller may leave it beyond the freshly wrapped viewport's end.
   return Math.max(0, Math.min(limit, Math.min(current, limit) + delta))
@@ -983,6 +1011,7 @@ function renderSessionView(model: DashboardModel, opts: RenderOpts): string[] {
       }`,
       width,
     ),
+    ...standbyLine(model, color, width),
     ...(notice === undefined ? [] : [notice]),
   ]
   const content = sessionContentLines(view, width).map((line) => truncate(line, width))
@@ -1417,6 +1446,7 @@ function renderDashboardContent(model: DashboardModel, opts: RenderOpts): string
   const top = [
     summary,
     toggles,
+    ...standbyLine(model, color, width),
     ...(upgradeNotice === undefined ? [] : [upgradeNotice]),
     ...warnings,
   ]

package/packages/core/src/cli/dispatch-frontend.ts

@@ -1,3 +1,4 @@
+import { StandbyIdentityResolver } from './dispatcher-liveness'
 import { configSchema, type Config } from '../config/schema'
 import { humanActor } from '../events/envelope'
 import type { RepositoryEvent } from '../events/repository'
@@ -114,6 +115,7 @@ export interface DispatchFrontendOptions {
 /** Terminal controller with a deliberately narrow wiring surface: terminal,
  * BuildStore, immutable repository identity, clock, and child supervision. */
 export class DispatchFrontend {
+  private readonly standbyResolver: StandbyIdentityResolver
   private readonly runId = crypto.randomUUID()
   private readonly clock: Clock
   private readonly region: LiveRegion
@@ -153,6 +155,7 @@ export class DispatchFrontend {
   private operatorStopRequested = false
 
   constructor(private readonly opts: DispatchFrontendOptions) {
+    this.standbyResolver = new StandbyIdentityResolver(opts.store, opts.repo)
     this.clock = opts.clock ?? systemClock
     this.keyboard = createKeyboardProtocol(
       (chunk) => opts.terminal.write(chunk),
@@ -191,6 +194,7 @@ export class DispatchFrontend {
                 this.opts.store.getRepoEvents(this.opts.repo, 0),
               )
             : await this.opts.store.getRepoEvents(this.opts.repo, 0)
+        this.standbyResolver.ingest(seed)
         this.repositorySeq = seed.at(-1)?.seq ?? 0
         this.dispatchStatus = reduceDispatchStatus(seed, this.runId)
         this.repositoryEvents.push(...seed.filter(isDashboardRepositoryEvent))
@@ -199,6 +203,7 @@ export class DispatchFrontend {
       }
       const delta = await this.opts.store.getRepoEvents(this.opts.repo, this.repositorySeq)
       if (delta.length === 0) return
+      this.standbyResolver.ingest(delta)
       this.repositorySeq = delta.at(-1)!.seq
       this.dispatchStatus = reduceDispatchStatus(delta, this.runId, this.dispatchStatus)
       this.repositoryEvents.push(...delta.filter(isDashboardRepositoryEvent))
@@ -367,10 +372,14 @@ export class DispatchFrontend {
       ...status.roleWarnings,
       ...(status.warningNotice !== undefined ? [status.warningNotice] : []),
     ]
+    const standby = this.opts.once
+      ? undefined
+      : await this.standbyResolver.refresh(this.runId, status.yieldedHolder, this.clock())
     const projected = buildDashboardFromProjected(
       snapshot.builds,
       {
         repo: this.opts.repo,
+        ...(standby !== undefined ? { standby } : {}),
         queued: status.queued ?? 0,
         activeCount: [...snapshot.states.values()].filter(
           (state) => state.status !== 'done' && state.status !== 'aborted',
@@ -409,6 +418,7 @@ export class DispatchFrontend {
         this.opts.terminal.columns,
         paintableRows(this.opts.terminal.rows),
         upgrade,
+        this.model?.standby !== undefined,
       )
       const current = view.follow ? limit : view.scroll
       const scroll = moveSessionScroll(
@@ -418,6 +428,7 @@ export class DispatchFrontend {
         current,
         delta,
         upgrade,
+        this.model?.standby !== undefined,
       )
       let follow = view.follow
       if (delta < 0 && follow && scroll < limit) follow = false
@@ -437,6 +448,7 @@ export class DispatchFrontend {
           this.view.scroll,
           delta,
           this.model?.availableUpgrade !== undefined,
+          this.model?.standby !== undefined,
         ),
       }
     } else if (this.view?.kind === 'detail' && this.model !== undefined) {
@@ -598,6 +610,7 @@ export class DispatchFrontend {
             terminal.columns,
             paintableRows(terminal.rows),
             this.model?.availableUpgrade !== undefined,
+            this.model?.standby !== undefined,
           )
           this.view = {
             ...next,
@@ -977,7 +990,9 @@ export class DispatchFrontend {
   private requestOperatorStop(): void {
     this.operatorStopRequested = true
     this.restorePresentationForStop()
-    void this.child?.stop()
+    void this.child?.stop(
+      typeof this.opts.signal?.reason === 'string' ? this.opts.signal.reason : undefined,
+    )
   }
 
   /** Stop terminal ownership synchronously before awaiting a kernel that may

package/packages/core/src/cli/dispatch-process.ts

@@ -25,7 +25,7 @@ export interface DispatchChildResult {
 
 export interface DispatchChildHandle {
   completed: Promise<DispatchChildResult>
-  stop(): Promise<void>
+  stop(signal?: string): Promise<void>
 }
 
 export interface DispatchSubprocess {
@@ -57,16 +57,20 @@ export interface DispatchKernelSignalBoundary {
  * one-shot handlers would expose the child to the default disposition on a
  * repeated Ctrl-C while it is still crossing an unsafe claim boundary. */
 export function installDispatchKernelSignalHandlers(
-  onStop: () => void,
+  onStop: (signal: DispatchKernelSignal) => void,
   boundary: DispatchKernelSignalBoundary = process,
 ): DispatchProcessHook {
-  for (const signal of DISPATCH_KERNEL_SIGNALS) boundary.on(signal, onStop)
+  const listeners = DISPATCH_KERNEL_SIGNALS.map((signal) => ({
+    signal,
+    listener: () => onStop(signal),
+  }))
+  for (const { signal, listener } of listeners) boundary.on(signal, listener)
   let closed = false
   return {
     close(): void {
       if (closed) return
       closed = true
-      for (const signal of DISPATCH_KERNEL_SIGNALS) boundary.removeListener(signal, onStop)
+      for (const { signal, listener } of listeners) boundary.removeListener(signal, listener)
     },
   }
 }
@@ -156,13 +160,14 @@ export function superviseDispatchChild(deps: DispatchChildSupervisorDeps): Dispa
   env[DISPATCH_CHILD_OPTIONS_ENV] = JSON.stringify(deps.options)
   const child = (deps.spawn ?? defaultSpawn)({ entrypoint, cwd: deps.cwd ?? deps.repo, env })
 
+  let requestedSignal: string | undefined
   let stopping = false
   let forced = false
   let stopPromise: Promise<void> | undefined
   // This is the sole supervisor writer of a missing stop fact. `stop()` only
   // chooses/awaits process termination, avoiding check-then-append races.
   const completed = child.exited.then(async (exitCode): Promise<DispatchChildResult> => {
-    const processSignal = child.signalCode === null ? undefined : String(child.signalCode)
+    const processSignal = child.signalCode === null ? requestedSignal : String(child.signalCode)
     const events = await deps.store.getRepoEvents(deps.repo)
     const recorded = events.findLast(
       (event) => event.type === 'dispatcher.run-stopped' && event.payload.run === deps.run,
@@ -179,7 +184,7 @@ export function superviseDispatchChild(deps: DispatchChildSupervisorDeps): Dispa
 
     const outcome: DispatchChildOutcome = forced
       ? 'forced'
-      : stopping && exitCode === 0 && processSignal === undefined
+      : stopping && exitCode === 0 && child.signalCode === null
         ? 'normal'
         : 'abnormal'
     const error =
@@ -209,11 +214,24 @@ export function superviseDispatchChild(deps: DispatchChildSupervisorDeps): Dispa
 
   return {
     completed,
-    stop(): Promise<void> {
+    stop(signal?: string): Promise<void> {
       if (stopPromise !== undefined) return stopPromise
       stopPromise = (async () => {
         if (child.exitCode !== null) return
         stopping = true
+        requestedSignal = signal
+        if (signal !== undefined) {
+          try {
+            await deps.store.appendRepo(deps.repo, {
+              actor: DISPATCHER,
+              type: 'dispatcher.stop-requested',
+              payload: { run: deps.run, signal },
+            })
+          } catch {
+            // Signal delivery must survive a transient Store failure. The
+            // kernel can still record its own abort reason after draining.
+          }
+        }
         child.kill('SIGINT')
         const timeout = deps.stopTimeoutMs ?? DEFAULT_STOP_TIMEOUT_MS
         const stopped = await Promise.race([