@defrex/autobuild 0.10.1 → 0.12.0

package/packages/core/src/processes/dispatcher.ts

@@ -1,3 +1,8 @@
+import { ensureDispatchBudget } from './dispatch-failure-budget'
+import {
+  reduceTicketSourceHealth,
+  type TicketSourceDegradation,
+} from '../kernel/ticket-source-health'
 /**
  * The dispatcher process (SPEC §3.3, §12): watches the TicketSource for
  * Ready tickets, claims, provisions a workspace, and launches build-runners
@@ -36,6 +41,7 @@
  * validation and fallback remain here. The supervising kernel reserves each
  * execution lease before launch; the child renews that same-holder lease.
  */
+import { createHash } from 'node:crypto'
 import type { Config } from '../config/schema'
 import type { LanguageModel } from 'ai'
 import { runOrchestratorTickStep } from './orchestrator-tick'
@@ -74,6 +80,7 @@ import type {
   TicketSource,
   WorkspaceProvider,
 } from '../ports/types'
+import { TicketSourceRateLimitError } from '../ports/types'
 import type { Exec } from '../ports/workspace/git-worktree'
 import type { ArtifactMeta, BuildDigest, BuildRecord, BuildStore, Clock } from '../store/types'
 import { samplePinnedAssets } from '../store/ticket-assets'
@@ -201,7 +208,9 @@ function findCycle(
   nodes: Map<string, DependencyState>,
   explored: Set<string>,
 ): string[] | null {
-  for (const next of nodes.get(from)?.blockedBy ?? []) {
+  const node = nodes.get(from)
+  if (!node?.exists || node.resolved) return null
+  for (const next of node.blockedBy) {
     const seen = path.indexOf(next)
     if (seen !== -1) return [...path.slice(seen), next]
     if (explored.has(next)) continue
@@ -301,7 +310,7 @@ export function validateSlugCandidate(candidate: string | null | undefined): str
 /** Counts per action, for observability and tests. An idempotent re-run of
  * `tick()` over unchanged state reports all zeroes — except invalid-record,
  * in-flight-creation, and dependency fields, which are standing queue reports rather than records of
- * action. They repeat on every ready scan by design, because that is the only
+ * action. They repeat between scans and refresh on completed scans, because that is the only
  * place the source problems are visible without provider inspection. */
 export interface TickReport {
   /** Janitor (§15.7): builds completed as merged. */
@@ -354,13 +363,15 @@ export interface TickReport {
   /** Standing queue depth: ready tickets still waiting after this tick —
    * excludes tickets already embodied by an active build, and ones that left
    * the queue this tick (dispatched, bounced, or claimed elsewhere). Like the
-   * invalid/dependency fields it re-reports on every ready scan. */
+   * invalid/dependency fields it repeats between completed scans. */
   queued: number
   /** Ready tickets withheld while Autobuild's own external creation is still
    * between durable reservation and settled blocker recording. */
   creationWithheld: number
   /** One line per creation hold, with Harvest run/proposal provenance. */
   creationDiagnostics: string[]
+  /** Ready tickets whose dependency reads failed rather than yielding a verdict. */
+  dependencyCheckFailed: number
   /** Dependency gate (§13): ready tickets held back by unresolved blockers. */
   dependencyBlocked: number
   /** One line per held ticket naming its unresolved blockers — the operator's
@@ -410,6 +421,7 @@ export function emptyTickReport(): TickReport {
     queued: 0,
     creationWithheld: 0,
     creationDiagnostics: [],
+    dependencyCheckFailed: 0,
     dependencyBlocked: 0,
     dependencyDiagnostics: [],
     harvestStarted: 0,
@@ -654,7 +666,15 @@ export class Dispatcher {
     return this.repoOrigin
   }
   private readonly leaseTtlMs: number
-  private readonly doneState: string
+  private get doneState(): string {
+    return (
+      this.deps.opts?.doneState ??
+      (this.deps.config.tickets.source === 'hosted'
+        ? this.deps.config.tickets.doneState
+        : undefined) ??
+      'Done'
+    )
+  }
   private readonly slugNamingTimeoutMs: number
   private readonly maxHarvestRecoveryAttempts: number
   private readonly provisionStaleMs: number
@@ -684,7 +704,6 @@ export class Dispatcher {
         ? deps.store
         : new RepoViewStore(deps.store, { repo: deps.repo })
     this.leaseTtlMs = deps.opts?.leaseTtlMs ?? 0
-    this.doneState = deps.opts?.doneState ?? 'Done'
     this.slugNamingTimeoutMs = deps.opts?.slugNamingTimeoutMs ?? DEFAULT_SLUG_NAMING_TIMEOUT_MS
     this.maxHarvestRecoveryAttempts =
       deps.opts?.maxHarvestRecoveryAttempts ?? DEFAULT_MAX_HARVEST_RECOVERY_ATTEMPTS
@@ -729,6 +748,7 @@ export class Dispatcher {
       }
     }
     const report = emptyTickReport()
+    this.restoreScan(report)
     /** Builds already launched this tick — a janitor/startup re-attach must
      * not be doubled by the sweep, nor a fresh dispatch by anything. */
     const launched = new Set<string>()
@@ -893,6 +913,81 @@ export class Dispatcher {
       .map(({ record }) => record)
   }
 
+  private async sourceCondition(
+    next?: TicketSourceDegradation,
+    successfulOperation?: 'ready-scan' | 'dependency-check',
+  ): Promise<void> {
+    await this.store.refreshJournal()
+    const current = reduceTicketSourceHealth(this.store.recordedJournal())
+    if (next !== undefined && current?.cause === next.cause && current.source === next.source) {
+      if (
+        next.cause === 'rate-limited' &&
+        next.operation === 'dependency-check' &&
+        current.operation !== 'dependency-check'
+      ) {
+        await this.store.appendRepo(this.deps.repo, {
+          actor: DISPATCHER,
+          type: 'dispatcher.ticket-source-dependency-limited',
+          payload: { source: current.source },
+        })
+      }
+      return
+    }
+    if (
+      next === undefined &&
+      current?.operation === 'dependency-check' &&
+      successfulOperation !== 'dependency-check'
+    )
+      return
+    if (current !== undefined) {
+      await this.store.appendRepo(this.deps.repo, {
+        actor: DISPATCHER,
+        type: 'dispatcher.ticket-source-recovered',
+        payload: { source: current.source, cause: current.cause, operation: current.operation },
+      })
+    }
+    if (next !== undefined) {
+      await this.store.ensureRepo(this.deps.repo)
+      await this.store.appendRepo(this.deps.repo, {
+        actor: DISPATCHER,
+        type: 'dispatcher.ticket-source-degraded',
+        payload: next,
+      })
+    }
+  }
+
+  private async sourceFailure(
+    error: unknown,
+    operation: 'ready-scan' | 'dependency-check',
+  ): Promise<void> {
+    const message = error instanceof Error ? error.message : String(error)
+    await this.sourceCondition(
+      error instanceof TicketSourceRateLimitError
+        ? {
+            source: error.source,
+            cause: 'rate-limited',
+            operation,
+            message,
+            resetAt: new Date(error.resetAt).toISOString(),
+          }
+        : {
+            source: this.deps.tickets.name,
+            cause: 'ready-scan-failed',
+            operation,
+            message: message || 'Ready scan failed',
+          },
+    )
+  }
+
+  private async listReady() {
+    try {
+      return await this.deps.tickets.listReady(readyCriteria(this.deps.config))
+    } catch (error) {
+      await this.sourceFailure(error, 'ready-scan')
+      throw error
+    }
+  }
+
   /** Observation-only ready listing for Store-backed frontends while intake is
    * disabled. It shares the active-ticket exclusion with dispatch but performs
    * no dependency fetch, claim, bounce, build, workspace, or launch side
@@ -910,14 +1005,109 @@ export class Dispatcher {
         activeTicketIds.add(record.ticket.id)
       }
     }
-    const listing = await this.deps.tickets.listReady(readyCriteria(this.deps.config))
+    const report = emptyTickReport()
+    this.restoreScan(report)
+    const checkpoint = await this.scanCheckpoint('observation')
+    if (checkpoint.due) {
+      await this.store.refreshJournal()
+      const listing = await this.listReady()
+      await this.store.refreshJournal()
+      report.queued = listing.tickets.filter((ticket) => !activeTicketIds.has(ticket.ref.id)).length
+      report.invalidTickets = listing.diagnostics.length
+      report.ticketDiagnostics = [...listing.diagnostics]
+      report.dependencyBlocked = 0
+      report.dependencyDiagnostics = []
+      report.creationWithheld = 0
+      report.creationDiagnostics = []
+      await this.sourceCondition(undefined, 'ready-scan')
+      await this.completeScan(checkpoint, report)
+    }
+    return {
+      queued: report.queued,
+      invalidTickets: report.invalidTickets,
+      ticketDiagnostics: report.ticketDiagnostics,
+    }
+  }
+
+  private latestScan() {
+    return this.store
+      .recordedJournal()
+      .findLast(
+        (event): event is Extract<RepositoryEvent, { type: 'dispatcher.ticket-scan-completed' }> =>
+          event.type === 'dispatcher.ticket-scan-completed',
+      )?.payload
+  }
+
+  private restoreScan(report: TickReport): void {
+    const previous = this.latestScan()
+    if (previous === undefined) return
+    for (const key of [
+      'queued',
+      'invalidTickets',
+      'dependencyBlocked',
+      'creationWithheld',
+    ] as const)
+      report[key] = previous[key]
+    for (const key of [
+      'ticketDiagnostics',
+      'dependencyDiagnostics',
+      'creationDiagnostics',
+    ] as const)
+      report[key] = [...previous[key]]
+  }
+
+  private async scanCheckpoint(mode: 'admission' | 'observation') {
+    const digest = (await this.repoBuildDigests())
+      .filter(({ digest }) => digest.readinessChangeSeq !== undefined)
+      .map(({ record, digest }) => [record.slug, digest.readinessChangeSeq] as const)
+      .sort(([a], [b]) => a.localeCompare(b))
+    const hash = (value: unknown) =>
+      createHash('sha256').update(JSON.stringify(value)).digest('hex')
+    const readinessFingerprint = hash(digest)
+    const criteriaFingerprint = hash(readyCriteria(this.deps.config))
+    const startedAt = this.deps.clock().toISOString()
+    const previous = this.latestScan()
+    const elapsed =
+      previous === undefined ? Infinity : Date.parse(startedAt) - Date.parse(previous.startedAt)
     return {
-      queued: listing.tickets.filter((ticket) => !activeTicketIds.has(ticket.ref.id)).length,
-      invalidTickets: listing.diagnostics.length,
-      ticketDiagnostics: [...listing.diagnostics],
+      startedAt,
+      mode,
+      readinessFingerprint,
+      criteriaFingerprint,
+      due:
+        previous === undefined ||
+        elapsed < 0 ||
+        elapsed >= this.deps.config.ticketScanIntervalSeconds * 1000 ||
+        previous.readinessFingerprint !== readinessFingerprint ||
+        previous.criteriaFingerprint !== criteriaFingerprint ||
+        (mode === 'admission' && previous.mode === 'observation'),
     }
   }
 
+  private async completeScan(
+    checkpoint: Awaited<ReturnType<Dispatcher['scanCheckpoint']>>,
+    report: TickReport,
+  ): Promise<void> {
+    await this.store.ensureRepo(this.deps.repo)
+    await this.store.appendRepo(this.deps.repo, {
+      actor: DISPATCHER,
+      type: 'dispatcher.ticket-scan-completed',
+      payload: {
+        startedAt: checkpoint.startedAt,
+        mode: checkpoint.mode,
+        readinessFingerprint: checkpoint.readinessFingerprint,
+        criteriaFingerprint: checkpoint.criteriaFingerprint,
+        queued: report.queued,
+        invalidTickets: report.invalidTickets,
+        ticketDiagnostics: report.ticketDiagnostics.slice(0, 1000),
+        dependencyBlocked: report.dependencyBlocked,
+        dependencyDiagnostics: report.dependencyDiagnostics.slice(0, 1000),
+        creationWithheld: report.creationWithheld,
+        creationDiagnostics: report.creationDiagnostics.slice(0, 1000),
+      },
+    })
+  }
+
   /** Apply the newest durable `dispatcher.auto-merge-default-set` fact to every
    * current non-terminal build of this repository: on — request consent; off —
    * cancel it. Attribution is the toggling human's own actor, exactly as if
@@ -1326,6 +1516,10 @@ export class Dispatcher {
       generation,
       seed,
       tail,
+    }).catch(() => {
+      // Detached work must never reject into the dispatcher process. Failure
+      // recording can itself fail on a store outage; durable boundaries and
+      // lease expiry let the next tick repair or retry the unfinished work.
     })
     return 'kicked'
   }
@@ -1360,6 +1554,7 @@ export class Dispatcher {
     const slug = entry.slug
     let leaseClaimed = false
     let heartbeat: ReturnType<typeof setInterval> | undefined
+    let boundary: 'workspace' | 'read' | 'dispatch' | 'launch' = 'workspace'
     const stage: EventPayload<'dispatch.failed'>['stage'] = 'workspace'
     try {
       if (entry.controller.signal.aborted) {
@@ -1424,12 +1619,19 @@ export class Dispatcher {
       await store.releaseLease(slug, entry.instance)
       leaseClaimed = false
       if (entry.controller.signal.aborted) return
+      boundary = 'read'
       const record = await store.getBuild(slug)
       if (record === null) return
-      await (input.tail === 'dispatch'
-        ? this.completeDispatchBoundaries(record, input.seed)
-        : this.deps.launchRunner(slug))
+      const queued = reduceBuild(await store.getEvents(slug)).status === 'queued'
+      boundary = input.tail === 'dispatch' || queued ? 'dispatch' : 'launch'
+      if (boundary === 'dispatch') await this.completeDispatchBoundaries(record, input.seed)
+      else await this.deps.launchRunner(slug)
     } catch (error) {
+      // Dispatch boundaries own their failure facts and exhaustion repair.
+      // A failed tail read/write leaves durable unfinished work for the next
+      // tick; it is not another provider workspace failure. Replacement
+      // runner launch errors retain the existing infrastructure-budget path.
+      if (boundary === 'read' || boundary === 'dispatch') return
       const events = await store.getEvents(slug)
       if (workspaces.recovery !== undefined) {
         const open = openWorkspace(events)
@@ -2303,6 +2505,16 @@ export class Dispatcher {
     return sha
   }
 
+  private dispatchBudget(slug: string): Promise<boolean> {
+    return ensureDispatchBudget(
+      this.store,
+      this.deps.ids,
+      slug,
+      this.deps.config.policy.maxDispatchAttempts,
+      this.deps.workspaces.recovery !== undefined,
+    )
+  }
+
   // ── b. Interrupted dispatch recovery ───────────────────────────────────────
 
   /** The claim-time `build.created` payload. Assets are omitted when the ticket
@@ -2357,6 +2569,7 @@ export class Dispatcher {
   ): Promise<DispatchOutcome> {
     const store = this.store
     const { config } = this.deps
+    if (!(await this.dispatchBudget(record.slug))) return 'parked'
     let stage: EventPayload<'dispatch.failed'>['stage'] = 'create'
     try {
       let events = await store.getEvents(record.slug)
@@ -2446,8 +2659,6 @@ export class Dispatcher {
         } satisfies EventWrite<'workspace.provisioned'>)
         events = await store.getEvents(record.slug)
       }
-
-      return await this.completeDispatchBoundaries(record, seed, report, launched)
     } catch (error) {
       const events = await store.getEvents(record.slug)
       if (stage === 'workspace' && this.deps.workspaces.recovery !== undefined) {
@@ -2472,8 +2683,10 @@ export class Dispatcher {
         },
       })
       report.dispatchFailed += 1
+      await this.dispatchBudget(record.slug)
       return 'failed'
     }
+    return this.completeDispatchBoundaries(record, seed, report, launched)
   }
 
   /** The post-workspace dispatch boundaries — spec, comment, launch — shared
@@ -2494,10 +2707,13 @@ export class Dispatcher {
   ): Promise<Exclude<DispatchOutcome, 'deferred'>> {
     const store = this.store
 
+    if (!(await this.dispatchBudget(record.slug))) return 'parked'
     let stage: EventPayload<'dispatch.failed'>['stage'] = 'spec'
     let authored = false
     try {
       const events = await store.getEvents(record.slug)
+      const state = reduceBuild(events)
+      if (state.status !== 'queued' || state.discardRequest !== undefined) return 'parked'
       if (
         !events.some((event) => event.type === 'spec.imported' || event.type === 'spec.authored')
       ) {
@@ -2597,6 +2813,7 @@ export class Dispatcher {
         },
       })
       if (report !== undefined) report.dispatchFailed += 1
+      await this.dispatchBudget(record.slug)
       return 'failed'
     }
   }
@@ -2628,9 +2845,11 @@ export class Dispatcher {
       // Queued itself means runner attachment is still missing. Always enter
       // the fact-driven helper: it skips every completed boundary and retries
       // only the final launch when setup is already durable.
-      if ((await this.attemptDispatchCompletion(record, launched, report)) === 'completed') {
-        report.recovered += 1
-      }
+      const outcome = await this.attemptDispatchCompletion(record, launched, report)
+      if (outcome === 'completed') report.recovered += 1
+      // A failed boundary owns this tick's attempt; startup and lease recovery
+      // must not bypass the unfinished dispatch boundary later in the tick.
+      if (outcome === 'failed') launched.add(record.slug)
     }
   }
 
@@ -2671,6 +2890,12 @@ export class Dispatcher {
         continue
       }
 
+      if (
+        state.status === 'queued' &&
+        !state.pendingCommands.some((command) => command.command === 'abort') &&
+        !(await this.dispatchBudget(record.slug))
+      )
+        continue
       const decision = decideNextFromFacts(state, facts.log, config)
       if (decision.kind === 'wait') {
         if (decision.reason === 'blocked' && state.openEscalations.length > 0) {
@@ -2741,6 +2966,12 @@ export class Dispatcher {
       ) {
         continue
       }
+      if (
+        state.status === 'queued' &&
+        !state.pendingCommands.some((command) => command.command === 'abort') &&
+        !(await this.dispatchBudget(record.slug))
+      )
+        continue
       const decision = decideNextFromFacts(state, facts.log, this.deps.config)
       if (state.status === 'done' || state.status === 'aborted') continue
       // Raw history, read at most once and only by a branch that acts on it.
@@ -2859,6 +3090,13 @@ export class Dispatcher {
   ): Promise<void> {
     const store = this.store
     const { tickets, config } = this.deps
+    const checkpoint = await this.scanCheckpoint('admission')
+    if (!checkpoint.due) return
+    // Clear only standing measurement fields; action counters belong to this tick.
+    report.queued = report.invalidTickets = report.dependencyBlocked = report.creationWithheld = 0
+    report.ticketDiagnostics = []
+    report.dependencyDiagnostics = []
+    report.creationDiagnostics = []
     // Blocked and paused builds still occupy a slot: their workspaces and
     // pending work are live, only waiting on a human. Capacity is per repo
     // (§16.1) — another repo's builds never consume this repo's slots.
@@ -2878,9 +3116,12 @@ export class Dispatcher {
     // ready state are deduped against the active builds embodying them.
     await this.store.refreshJournal()
     const journalBeforeReady = this.store.recordedJournal()
-    const listing = await tickets.listReady(readyCriteria(config))
+    const listing = await this.listReady()
     await this.store.refreshJournal()
     const journalAfterReady = this.store.recordedJournal()
+    if (reduceTicketSourceHealth(journalAfterReady)?.cause === 'ready-scan-failed') {
+      await this.sourceCondition(undefined, 'ready-scan')
+    }
     const creationHolds = new Map(
       harvestCreationsDuringReadyScan(journalBeforeReady, journalAfterReady).map((creation) => [
         creation.creationKey.toLowerCase(),
@@ -2912,55 +3153,67 @@ export class Dispatcher {
     // still runs either way, so the standing queue-depth report stays honest —
     // this only declines to claim a ticket into a build that would immediately
     // sit held.
-    if (capacity <= 0 || paused) return
-    // One dependency-node cache per tick: blockers are commonly shared across
-    // the ready set, and a blocker's resolution must be re-read every tick
-    // (never cached across them) so a completion lands on the next pass.
-    const nodes = new Map<string, DependencyState>()
+    if (capacity <= 0 || paused) {
+      await this.sourceCondition(undefined, 'ready-scan')
+      if (!this.outOfBudget(opts)) await this.completeScan(checkpoint, report)
+      return
+    }
+    // One dependency-node cache per scan: blockers are commonly shared across
+    // the ready set. Never reuse ticket or dependency objects between scans.
+    const nodes = new Map<string, DependencyState>(
+      listing.tickets.map((ticket) => [
+        ticket.ref.id,
+        {
+          id: ticket.ref.id,
+          exists: true,
+          resolved: ticket.resolved,
+          blockedBy: [...(ticket.blockedBy ?? [])],
+        },
+      ]),
+    )
 
+    // Finish read-only evaluation before any intake claim: a later source
+    // failure must leave the entire ready set unclaimed. Publish dependency
+    // diagnostics only after the complete preflight succeeds.
+    let scanSuccessful = true
+    const verdicts = new Map<string, DependencyVerdict>()
+    const failed = new Set<string>()
     for (const ticket of ready) {
-      if (capacity <= 0) break
-      // Budget gate before the dependency fetch / claim / createBuild: the
-      // first ready read above stays (it is the standing queue-depth report);
-      // once the budget is spent no additional transport call is started, so
-      // the remaining tickets are left un-attempted for the next invocation.
-      if (this.outOfBudget(opts)) break
-
-      // Autobuild's own in-flight create gate precedes even dependency reads:
-      // the ready projection may have been captured before blocker recording.
-      // It spends no capacity and leaves queue depth unchanged.
+      if (this.outOfBudget(opts)) return
       if (withheld.has(ticket.ref.id)) continue
-
-      // The dependency gate runs FIRST — before the claim, before the spec
-      // gate. A blocked ticket must not be claimed, must not be bounced, must
-      // create no build or workspace, and must not spend capacity; it is
-      // simply not this tick's work. Note this sits *above* [tickets]'s
-      // readyLabels / readyState gate: those criteria produced `ready`, and the
-      // gate subtracts from it — labels and state can make a ticket a
-      // candidate but can never override an unresolved blocker.
-      if ((ticket.blockedBy ?? []).length > 0) {
-        let verdict: DependencyVerdict
-        try {
-          await this.loadDependencyGraph(ticket, nodes)
-          verdict = analyzeDependencies(ticket.ref.id, ticket.blockedBy ?? [], nodes)
-        } catch (error) {
-          // A broken graph is this ticket's problem, not the tick's: skip it
-          // and let unrelated eligible tickets dispatch normally.
-          verdict = {
-            unresolved: [ticket.ref.id],
-            diagnostics: [
-              `ticket ${ticket.ref.id}: dependency check failed — ${
-                error instanceof Error ? error.message : String(error)
-              }`,
-            ],
-          }
-        }
-        if (verdict.unresolved.length > 0) {
-          report.dependencyBlocked += 1
-          report.dependencyDiagnostics.push(...verdict.diagnostics)
-          continue
+      if (ticket.blockersResolved === true || (ticket.blockedBy ?? []).length === 0) continue
+      let verdict: DependencyVerdict
+      try {
+        if (!(await this.loadDependencyGraph(ticket, nodes, opts))) return
+        verdict = analyzeDependencies(ticket.ref.id, ticket.blockedBy ?? [], nodes)
+      } catch (error) {
+        if (error instanceof TicketSourceRateLimitError) {
+          await this.sourceFailure(error, 'dependency-check')
+          throw error
         }
+        scanSuccessful = false
+        failed.add(ticket.ref.id)
+        report.dependencyCheckFailed += 1
+        report.dependencyDiagnostics.push(
+          `ticket ${ticket.ref.id}: dependency check failed — ${error instanceof Error ? error.message : String(error)}`,
+        )
+        continue
+      }
+      verdicts.set(ticket.ref.id, verdict)
+    }
+    if (this.outOfBudget(opts)) return
+    if (failed.size === 0) await this.sourceCondition(undefined, 'dependency-check')
+    for (const verdict of verdicts.values()) {
+      if (verdict.unresolved.length > 0) {
+        report.dependencyBlocked += 1
+        report.dependencyDiagnostics.push(...verdict.diagnostics)
       }
+    }
+    for (const ticket of ready) {
+      if (capacity <= 0 || this.outOfBudget(opts)) break
+      if (withheld.has(ticket.ref.id)) continue
+      if (failed.has(ticket.ref.id)) continue
+      if ((verdicts.get(ticket.ref.id)?.unresolved.length ?? 0) > 0) continue
 
       // Claim-before-launch (§12): losing the claim means another dispatcher
       // (or an earlier tick) owns this ticket.
@@ -3036,36 +3289,36 @@ export class Dispatcher {
       // means the remote provisioning continuation owns the rest.
       if (outcome === 'completed' || outcome === 'deferred') report.dispatched += 1
     }
+    if (scanSuccessful && !this.outOfBudget(opts)) await this.completeScan(checkpoint, report)
   }
 
   /**
-   * Close `nodes` over everything reachable from `ticket`'s blockers, so the
-   * analyzer can both gate and name a cycle. Breadth-first, one port call per
-   * level, skipping ids already cached — the common case (a blocker or two,
-   * none of them blocked themselves) is a single call.
-   *
-   * INVARIANT: `nodes` contains only states actually returned by the source.
-   * The cache is shared across the tick's tickets, so a node this ticket
-   * invents is a node the *next* ticket will trust as a fact about its own
-   * blocker. Nothing is seeded here for that reason (f_8bc9ee0c); the
-   * analyzer takes the ticket's own blockers as an argument instead, and
-   * `findCycle` closes a cycle via its path rather than the map.
-   *
-   * A provider-side cycle terminates the walk: an id already in `nodes` is
-   * never re-queued, so every reachable node is fetched exactly once.
+   * Walk unresolved branches in provider order. Listing facts and dependency
+   * reads share a tick-local cache; traversal visits are local to this root.
    */
   private async loadDependencyGraph(
     ticket: Ticket,
     nodes: Map<string, DependencyState>,
-  ): Promise<void> {
-    let frontier = [...new Set(ticket.blockedBy ?? [])].filter((id) => !nodes.has(id))
+    opts: TickOpts = {},
+  ): Promise<boolean> {
+    const visited = new Set<string>()
+    let frontier = [...new Set(ticket.blockedBy ?? [])]
     while (frontier.length > 0) {
-      const states = await this.deps.tickets.dependencyStates(frontier)
-      for (const state of states) nodes.set(state.id, state)
-      frontier = [...new Set(states.flatMap((state) => state.blockedBy))].filter(
-        (id) => !nodes.has(id),
-      )
+      if (this.outOfBudget(opts)) return false
+      const uncached = frontier.filter((id) => !nodes.has(id))
+      if (uncached.length > 0) {
+        const states = await this.deps.tickets.dependencyStates(uncached)
+        for (const state of states) nodes.set(state.id, state)
+      }
+      const next: string[] = []
+      for (const id of frontier) {
+        visited.add(id)
+        const node = nodes.get(id)
+        if (node?.exists && !node.resolved) next.push(...node.blockedBy)
+      }
+      frontier = [...new Set(next)].filter((id) => !visited.has(id))
     }
+    return true
   }
 
   /** Bounce (§6.3): back to Triage with a comment citing the standard and

package/packages/core/src/processes/harvest-child.ts

@@ -97,6 +97,7 @@ export async function runHarvestChild(
       uuids: randomUuids(),
       clock: systemClock,
       instance: input.instance,
+      ...(input.preparedRun ? { preparedRun: input.preparedRun } : {}),
       // Adopted holder: the guest skips its own claim, heartbeats the owning
       // dispatch loop's repository lease, and never releases it.
       ...(input.leaseHolder !== undefined ? { leaseHolder: input.leaseHolder } : {}),

package/packages/core/src/processes/harvest-execution-state.ts

@@ -92,9 +92,26 @@ export function classifyHarvestOutcome(
   input: HarvestExecutionClassificationInput,
 ): HarvestRunnerResult {
   const state = reduceHarvest(events)
-  const latestRun = state.runs.at(-1)
+  const started = events.find(
+    (event) =>
+      event.type === 'harvest.execution.started' && event.seq === input.executionStartedSeq,
+  )
+  const authorization =
+    started?.type === 'harvest.execution.started'
+      ? events.find(
+          (event) =>
+            event.type === 'harvest.execution.authorized' &&
+            event.payload.execution === started.payload.execution,
+        )
+      : undefined
+  const selected =
+    authorization?.type === 'harvest.execution.authorized' ? authorization.payload : undefined
+  const latestRun = selected
+    ? state.runs.find((run) => run.run === selected.run)
+    : state.runs.at(-1)
   if (latestRun !== undefined) {
-    const launch = latestRun.startedSeq > input.executionStartedSeq ? 'started' : 'resumed'
+    const launch =
+      selected?.launch ?? (latestRun.startedSeq > input.executionStartedSeq ? 'started' : 'resumed')
     // Recency gate: a terminal outcome counts only if its fact — the run's
     // terminal fact, or for an unresolved failure the failure fact itself
     // (`failureSeq`), which also covers exhaustion via `terminalSeq` —