@defrex/autobuild 0.11.0 → 0.13.0

package/packages/core/src/processes/dispatcher.ts

@@ -1,3 +1,7 @@
+import { ensureExecutionProgress } from './execution-no-progress'
+import { ticketIdentity } from '../ports/tickets/identity'
+import { ticketLifecycle } from '../ports/tickets/lifecycle'
+import { ensureDispatchBudget } from './dispatch-failure-budget'
 import {
   reduceTicketSourceHealth,
   type TicketSourceDegradation,
@@ -61,6 +65,8 @@ import {
 } from '../kernel/auto-merge-default'
 import { reduceDispatchSettings } from '../kernel/dispatch-settings'
 import { decideNextFromFacts } from '../kernel/engine'
+import { composeBuildConfig } from '../config/live'
+import { BUILD_EFFECTIVE_CONFIG_ARTIFACT, parseEffectiveBuildConfig } from './build-execution-state'
 import {
   DEFAULT_MAX_HARVEST_RECOVERY_ATTEMPTS,
   decideHarvestControl,
@@ -82,7 +88,7 @@ import type {
 import { TicketSourceRateLimitError } from '../ports/types'
 import type { Exec } from '../ports/workspace/git-worktree'
 import type { ArtifactMeta, BuildDigest, BuildRecord, BuildStore, Clock } from '../store/types'
-import { samplePinnedAssets } from '../store/ticket-assets'
+import { preparePinnedAssets } from '../store/ticket-assets'
 import { resolveRepoOrigin } from '../cli/repo-state'
 import { specConformance } from '../spec-standard'
 export { specConformance, type SpecConformance } from '../spec-standard'
@@ -147,16 +153,11 @@ export function readyCriteria(config: Config): {
  * readiness is: the file tracker's grooming area IS the `triage/` directory,
  * while a Linear team only has a "Triage" workflow state when the team's
  * triage feature is enabled — Backlog is the state every Linear team has.
- * The hosted source is the credential-bearing Linear proxy and shares that
- * fallback. Plugin sources use the neutral `Triage` fallback unless configured.
+ * Hosted projects default to lowercase triage; plugin sources use the neutral
+ * `Triage` fallback unless configured.
  */
 export function defaultTriageState(config: Config): string {
-  return (
-    config.tickets.triageState ??
-    (config.tickets.source === 'linear' || config.tickets.source === 'hosted'
-      ? 'Backlog'
-      : 'Triage')
-  )
+  return ticketLifecycle(config.tickets).triage
 }
 
 /**
@@ -546,6 +547,8 @@ export interface DispatcherDeps {
   retiredWorkspaces?: readonly WorkspaceProvider[]
   forge: Forge
   config: Config
+  /** Configuration-only publication for incompatible pins; never launches a runner. */
+  repairBuildConfig?: (slug: string) => Promise<void>
   /** Current process snapshot, captured once at the beginning of each tick.
    * Omission preserves the cron/static-config API. */
   getConfig?: () => Config
@@ -646,6 +649,38 @@ export function heldByRepositoryPause(state: BuildState, paused: boolean): boole
 }
 
 export class Dispatcher {
+  /** Read at each decision boundary: artifact revisions are independent of events. */
+  private async decideBuild(
+    slug: string,
+    state: Parameters<typeof decideNextFromFacts>[0],
+    log: Parameters<typeof decideNextFromFacts>[1],
+    report: TickReport,
+  ): Promise<ReturnType<typeof decideNextFromFacts> | undefined> {
+    let revision: number | undefined
+    try {
+      let artifact = await this.store.getArtifact(slug, BUILD_EFFECTIVE_CONFIG_ARTIFACT)
+      if (artifact === null) return decideNextFromFacts(state, log, this.deps.config)
+      revision = artifact.meta.revision
+      let pinned: Config
+      try {
+        pinned = parseEffectiveBuildConfig(artifact)
+      } catch (error) {
+        if (this.deps.repairBuildConfig === undefined) throw error
+        await this.deps.repairBuildConfig(slug)
+        artifact = await this.store.getArtifact(slug, BUILD_EFFECTIVE_CONFIG_ARTIFACT)
+        if (artifact === null) throw new Error('configuration repair deposited no pipeline')
+        revision = artifact.meta.revision
+        pinned = parseEffectiveBuildConfig(artifact)
+      }
+      return decideNextFromFacts(state, log, composeBuildConfig(pinned, this.deps.config))
+    } catch (error) {
+      report.blockedDiagnostics.push(
+        `build ${slug} pipeline${revision === undefined ? '' : ` revision ${revision}`} unavailable: pipeline decisions withheld; next tick retries. Restore readable build-branch configuration or use a compatible dispatcher version. ${error instanceof Error ? error.message : String(error)}`,
+      )
+      return undefined
+    }
+  }
+
   /** Memoized normalized origin of the served repository (one git call per
    * dispatcher), recorded on created builds so ambient reads can accept a
    * differently located checkout of the same repository by origin equality.
@@ -665,7 +700,15 @@ export class Dispatcher {
     return this.repoOrigin
   }
   private readonly leaseTtlMs: number
-  private readonly doneState: string
+  private get doneState(): string {
+    return (
+      this.deps.opts?.doneState ??
+      (this.deps.config.tickets.source === 'hosted'
+        ? ticketLifecycle(this.deps.config.tickets).done
+        : undefined) ??
+      'Done'
+    )
+  }
   private readonly slugNamingTimeoutMs: number
   private readonly maxHarvestRecoveryAttempts: number
   private readonly provisionStaleMs: number
@@ -695,7 +738,6 @@ export class Dispatcher {
         ? deps.store
         : new RepoViewStore(deps.store, { repo: deps.repo })
     this.leaseTtlMs = deps.opts?.leaseTtlMs ?? 0
-    this.doneState = deps.opts?.doneState ?? 'Done'
     this.slugNamingTimeoutMs = deps.opts?.slugNamingTimeoutMs ?? DEFAULT_SLUG_NAMING_TIMEOUT_MS
     this.maxHarvestRecoveryAttempts =
       deps.opts?.maxHarvestRecoveryAttempts ?? DEFAULT_MAX_HARVEST_RECOVERY_ATTEMPTS
@@ -980,6 +1022,23 @@ export class Dispatcher {
     }
   }
 
+  private async activeTicketIdentities(refs: TicketRef[], listed: Ticket[]): Promise<Set<string>> {
+    const key = (ref: TicketRef) => `${ref.source}:${ref.id}`
+    const ids = new Set(refs.map(key))
+    if (this.deps.tickets.name !== 'hosted' || listed.length === 0) return ids
+    const listedIds = new Set(listed.map((ticket) => key(ticket.ref)))
+    const identity = ticketIdentity(this.deps.tickets)
+    try {
+      for (const ref of refs) {
+        if (ref.source === 'hosted' && !listedIds.has(key(ref))) ids.add(await identity(ref))
+      }
+    } catch (error) {
+      await this.sourceFailure(error, 'ready-scan')
+      throw error
+    }
+    return ids
+  }
+
   /** Observation-only ready listing for Store-backed frontends while intake is
    * disabled. It shares the active-ticket exclusion with dispatch but performs
    * no dependency fetch, claim, bounce, build, workspace, or launch side
@@ -991,20 +1050,21 @@ export class Dispatcher {
   }> {
     this.deps.config = this.deps.getConfig?.() ?? this.deps.config
     await this.store.refresh()
-    const activeTicketIds = new Set<string>()
-    for (const { record, digest } of await this.repoBuildDigests()) {
-      if (record.ticket !== undefined && digest.terminal === undefined) {
-        activeTicketIds.add(record.ticket.id)
-      }
-    }
     const report = emptyTickReport()
     this.restoreScan(report)
     const checkpoint = await this.scanCheckpoint('observation')
     if (checkpoint.due) {
       await this.store.refreshJournal()
       const listing = await this.listReady()
+      const refs: TicketRef[] = []
+      for (const { record, digest } of await this.repoBuildDigests()) {
+        if (record.ticket && digest.terminal === undefined) refs.push(record.ticket)
+      }
+      const activeTicketIds = await this.activeTicketIdentities(refs, listing.tickets)
       await this.store.refreshJournal()
-      report.queued = listing.tickets.filter((ticket) => !activeTicketIds.has(ticket.ref.id)).length
+      report.queued = listing.tickets.filter(
+        (ticket) => !activeTicketIds.has(`${ticket.ref.source}:${ticket.ref.id}`),
+      ).length
       report.invalidTickets = listing.diagnostics.length
       report.ticketDiagnostics = [...listing.diagnostics]
       report.dependencyBlocked = 0
@@ -1165,9 +1225,24 @@ export class Dispatcher {
     }
   }
 
-  private async launch(slug: string, launched: Set<string>): Promise<LaunchRunnerResult> {
+  private async launch(
+    slug: string,
+    launched: Set<string>,
+    report: TickReport = emptyTickReport(),
+  ): Promise<LaunchRunnerResult> {
     if (launched.has(slug)) return 'already-active'
     launched.add(slug)
+    if (
+      !(await ensureExecutionProgress(
+        this.store,
+        this.deps.ids,
+        slug,
+        this.deps.config,
+        (state, log) => this.decideBuild(slug, state, log, report),
+      ))
+    ) {
+      return 'already-active'
+    }
     return this.deps.launchRunner(slug)
   }
 
@@ -1508,6 +1583,10 @@ export class Dispatcher {
       generation,
       seed,
       tail,
+    }).catch(() => {
+      // Detached work must never reject into the dispatcher process. Failure
+      // recording can itself fail on a store outage; durable boundaries and
+      // lease expiry let the next tick repair or retry the unfinished work.
     })
     return 'kicked'
   }
@@ -1542,6 +1621,7 @@ export class Dispatcher {
     const slug = entry.slug
     let leaseClaimed = false
     let heartbeat: ReturnType<typeof setInterval> | undefined
+    let boundary: 'workspace' | 'read' | 'dispatch' | 'launch' = 'workspace'
     const stage: EventPayload<'dispatch.failed'>['stage'] = 'workspace'
     try {
       if (entry.controller.signal.aborted) {
@@ -1606,12 +1686,19 @@ export class Dispatcher {
       await store.releaseLease(slug, entry.instance)
       leaseClaimed = false
       if (entry.controller.signal.aborted) return
+      boundary = 'read'
       const record = await store.getBuild(slug)
       if (record === null) return
-      await (input.tail === 'dispatch'
-        ? this.completeDispatchBoundaries(record, input.seed)
-        : this.deps.launchRunner(slug))
+      const queued = reduceBuild(await store.getEvents(slug)).status === 'queued'
+      boundary = input.tail === 'dispatch' || queued ? 'dispatch' : 'launch'
+      if (boundary === 'dispatch') await this.completeDispatchBoundaries(record, input.seed)
+      else await this.deps.launchRunner(slug)
     } catch (error) {
+      // Dispatch boundaries own their failure facts and exhaustion repair.
+      // A failed tail read/write leaves durable unfinished work for the next
+      // tick; it is not another provider workspace failure. Replacement
+      // runner launch errors retain the existing infrastructure-budget path.
+      if (boundary === 'read' || boundary === 'dispatch') return
       const events = await store.getEvents(slug)
       if (workspaces.recovery !== undefined) {
         const open = openWorkspace(events)
@@ -2069,7 +2156,7 @@ export class Dispatcher {
       }
       // The dispatcher never runs agents (§15.7): re-attach a build-runner,
       // which executes the reconcile epilogue phase.
-      await this.launch(record.slug, launched)
+      await this.launch(record.slug, launched, report)
       report.conflicted += 1
       return
     }
@@ -2103,12 +2190,12 @@ export class Dispatcher {
         const latest = await store.buildFacts(record.slug)
         const latestState = latest.state
         const latestIntent = pendingAutoMerge(latestState)
-        const decision = decideNextFromFacts(latest.state, latest.log, this.deps.config)
+        const decision = await this.decideBuild(record.slug, latest.state, latest.log, report)
         if (
           latestState.pr?.number === pr.number &&
           latestIntent?.enabled === true &&
           latestIntent.commandSeq === autoMerge.commandSeq &&
-          decision.kind === 'wait' &&
+          decision?.kind === 'wait' &&
           decision.reason === 'awaiting-pr'
         ) {
           await forge.squashMerge(workspacePath, pr.number, result.headSha)
@@ -2485,6 +2572,16 @@ export class Dispatcher {
     return sha
   }
 
+  private dispatchBudget(slug: string): Promise<boolean> {
+    return ensureDispatchBudget(
+      this.store,
+      this.deps.ids,
+      slug,
+      this.deps.config.policy.maxDispatchAttempts,
+      this.deps.workspaces.recovery !== undefined,
+    )
+  }
+
   // ── b. Interrupted dispatch recovery ───────────────────────────────────────
 
   /** The claim-time `build.created` payload. Assets are omitted when the ticket
@@ -2539,6 +2636,7 @@ export class Dispatcher {
   ): Promise<DispatchOutcome> {
     const store = this.store
     const { config } = this.deps
+    if (!(await this.dispatchBudget(record.slug))) return 'parked'
     let stage: EventPayload<'dispatch.failed'>['stage'] = 'create'
     try {
       let events = await store.getEvents(record.slug)
@@ -2553,7 +2651,14 @@ export class Dispatcher {
         // can only sample the ticket's current assets (SPEC §6.3).
         const assets =
           seed?.assets ??
-          (await samplePinnedAssets(store, record.repo, record.ticket.id).catch(() => []))
+          (await preparePinnedAssets(this.deps.tickets, store, record.repo, record.ticket.id).catch(
+            (error) => {
+              // Preserve legacy recovery only without native assets. Native preparation
+              // must never publish an empty pin after losing the source bytes.
+              if (this.deps.tickets.assets || this.deps.tickets.name === 'hosted') throw error
+              return []
+            },
+          ))
         await store.appendIfCurrent(record.slug, 0, {
           actor: DISPATCHER,
           type: 'build.created',
@@ -2628,8 +2733,6 @@ export class Dispatcher {
         } satisfies EventWrite<'workspace.provisioned'>)
         events = await store.getEvents(record.slug)
       }
-
-      return await this.completeDispatchBoundaries(record, seed, report, launched)
     } catch (error) {
       const events = await store.getEvents(record.slug)
       if (stage === 'workspace' && this.deps.workspaces.recovery !== undefined) {
@@ -2654,8 +2757,10 @@ export class Dispatcher {
         },
       })
       report.dispatchFailed += 1
+      await this.dispatchBudget(record.slug)
       return 'failed'
     }
+    return this.completeDispatchBoundaries(record, seed, report, launched)
   }
 
   /** The post-workspace dispatch boundaries — spec, comment, launch — shared
@@ -2676,10 +2781,13 @@ export class Dispatcher {
   ): Promise<Exclude<DispatchOutcome, 'deferred'>> {
     const store = this.store
 
+    if (!(await this.dispatchBudget(record.slug))) return 'parked'
     let stage: EventPayload<'dispatch.failed'>['stage'] = 'spec'
     let authored = false
     try {
       const events = await store.getEvents(record.slug)
+      const state = reduceBuild(events)
+      if (state.status !== 'queued' || state.discardRequest !== undefined) return 'parked'
       if (
         !events.some((event) => event.type === 'spec.imported' || event.type === 'spec.authored')
       ) {
@@ -2762,7 +2870,7 @@ export class Dispatcher {
         return 'parked'
       }
       if (launched === undefined) await this.deps.launchRunner(record.slug)
-      else await this.launch(record.slug, launched)
+      else await this.launch(record.slug, launched, report)
       if (authored && report !== undefined) report.authored += 1
       return 'completed'
     } catch (error) {
@@ -2779,6 +2887,7 @@ export class Dispatcher {
         },
       })
       if (report !== undefined) report.dispatchFailed += 1
+      await this.dispatchBudget(record.slug)
       return 'failed'
     }
   }
@@ -2810,9 +2919,11 @@ export class Dispatcher {
       // Queued itself means runner attachment is still missing. Always enter
       // the fact-driven helper: it skips every completed boundary and retries
       // only the final launch when setup is already durable.
-      if ((await this.attemptDispatchCompletion(record, launched, report)) === 'completed') {
-        report.recovered += 1
-      }
+      const outcome = await this.attemptDispatchCompletion(record, launched, report)
+      if (outcome === 'completed') report.recovered += 1
+      // A failed boundary owns this tick's attempt; startup and lease recovery
+      // must not bypass the unfinished dispatch boundary later in the tick.
+      if (outcome === 'failed') launched.add(record.slug)
     }
   }
 
@@ -2836,7 +2947,6 @@ export class Dispatcher {
     opts: TickOpts = {},
   ): Promise<void> {
     const store = this.store
-    const { config } = this.deps
     for (const record of await this.nonterminalBuilds()) {
       if (launched.has(record.slug)) continue
       // Budget gate: resume launches runners (transport-backed work).
@@ -2853,7 +2963,14 @@ export class Dispatcher {
         continue
       }
 
-      const decision = decideNextFromFacts(state, facts.log, config)
+      if (
+        state.status === 'queued' &&
+        !state.pendingCommands.some((command) => command.command === 'abort') &&
+        !(await this.dispatchBudget(record.slug))
+      )
+        continue
+      const decision = await this.decideBuild(record.slug, state, facts.log, report)
+      if (decision === undefined) continue
       if (decision.kind === 'wait') {
         if (decision.reason === 'blocked' && state.openEscalations.length > 0) {
           report.blockedDiagnostics.push(
@@ -2867,7 +2984,7 @@ export class Dispatcher {
       // Disposable remote environments must pass through the stale-lease
       // fencing sweep below; startup must never attach directly to an old VM.
       if (this.deps.workspaces.recovery !== undefined) continue
-      const result = await this.launch(record.slug, launched)
+      const result = await this.launch(record.slug, launched, report)
       if (result === 'scheduled') report.resumed += 1
     }
   }
@@ -2923,7 +3040,14 @@ export class Dispatcher {
       ) {
         continue
       }
-      const decision = decideNextFromFacts(state, facts.log, this.deps.config)
+      if (
+        state.status === 'queued' &&
+        !state.pendingCommands.some((command) => command.command === 'abort') &&
+        !(await this.dispatchBudget(record.slug))
+      )
+        continue
+      const decision = await this.decideBuild(record.slug, state, facts.log, report)
+      if (decision === undefined) continue
       if (state.status === 'done' || state.status === 'aborted') continue
       // Raw history, read at most once and only by a branch that acts on it.
       let loaded: AbEvent[] | undefined
@@ -3024,7 +3148,7 @@ export class Dispatcher {
         // boundaries and the launch; this tick performs neither.
         continue
       }
-      const result = await this.launch(record.slug, launched)
+      const result = await this.launch(record.slug, launched, report)
       if (result === 'scheduled') report.swept += 1
     }
   }
@@ -3052,11 +3176,11 @@ export class Dispatcher {
     // pending work are live, only waiting on a human. Capacity is per repo
     // (§16.1) — another repo's builds never consume this repo's slots.
     let active = 0
-    const activeTicketIds = new Set<string>()
+    const activeRefs: TicketRef[] = []
     for (const { record, digest } of await this.repoBuildDigests()) {
       if (digest.terminal === undefined) {
         active += 1
-        if (record.ticket) activeTicketIds.add(record.ticket.id)
+        if (record.ticket) activeRefs.push(record.ticket)
       }
     }
     let capacity = config.capacity - active
@@ -3068,6 +3192,7 @@ export class Dispatcher {
     await this.store.refreshJournal()
     const journalBeforeReady = this.store.recordedJournal()
     const listing = await this.listReady()
+    const activeTicketIds = await this.activeTicketIdentities(activeRefs, listing.tickets)
     await this.store.refreshJournal()
     const journalAfterReady = this.store.recordedJournal()
     if (reduceTicketSourceHealth(journalAfterReady)?.cause === 'ready-scan-failed') {
@@ -3079,7 +3204,9 @@ export class Dispatcher {
         creation,
       ]),
     )
-    const ready = listing.tickets.filter((ticket) => !activeTicketIds.has(ticket.ref.id))
+    const ready = listing.tickets.filter(
+      (ticket) => !activeTicketIds.has(`${ticket.ref.source}:${ticket.ref.id}`),
+    )
     report.invalidTickets += listing.diagnostics.length
     report.ticketDiagnostics.push(...listing.diagnostics)
     report.queued = ready.length
@@ -3176,7 +3303,7 @@ export class Dispatcher {
 
       // Freeze the ticket's assets at the claim (SPEC §6.3): sampled before the
       // spec-authoring interval so edits made during it are never pinned.
-      const assets = await samplePinnedAssets(store, this.deps.repo, ticket.ref.id)
+      const assets = await preparePinnedAssets(tickets, store, this.deps.repo, ticket.ref.id)
 
       // Quality gate (§6.3): import a conforming ticket body as the spec;
       // author one for thin-but-groomed tickets; otherwise bounce.

package/packages/core/src/processes/execution-no-progress.ts

@@ -0,0 +1,176 @@
+import type { AbEvent } from '../events/catalog'
+import { DISPATCHER } from '../events/envelope'
+import type { EventType } from '../events/payloads'
+import type { IdSource } from '../ids'
+import type { Config } from '../config/schema'
+import { type Decision, decideNextFromFacts } from '../kernel/engine'
+import { defineReducer } from '../kernel/incremental'
+import type { RepoViewStore } from './repo-view'
+
+/** Every new event must explicitly choose whether it advances build work. */
+export const executionProgress = {
+  'build.created': 'progress',
+  'build.completed': 'progress',
+  'runner.attached': 'bookkeeping',
+  'runner.setup-failed': 'failure',
+  'workspace.provisioned': 'bookkeeping',
+  'workspace.provision-started': 'bookkeeping',
+  'workspace.released': 'bookkeeping',
+  'execution.started': 'bookkeeping',
+  'execution.ended': 'bookkeeping',
+  'infrastructure.failed': 'failure',
+  'infrastructure.cleanup-attempted': 'bookkeeping',
+  'pr-summary.requested': 'progress',
+  'pr-summary.attempted': 'progress',
+  'pr-summary.result': 'progress',
+  'pr-summary.settled': 'progress',
+  'finalize.step-started': 'progress',
+  'publication.requested': 'progress',
+  'publication.lost': 'progress',
+  'abort.remote-branch-deleted': 'progress',
+  'abort.local-branch-deleted': 'progress',
+  'abort.ticket-returned': 'progress',
+  'dispatch.failed': 'failure',
+  'dispatch.comment-posted': 'bookkeeping',
+  'build.pause-requested': 'progress',
+  'build.resume-requested': 'progress',
+  'build.abort-requested': 'progress',
+  'build.discard-requested': 'progress',
+  'build.auto-merge-requested': 'progress',
+  'build.auto-merge-cancelled': 'progress',
+  'build.auto-merge-default-observed': 'bookkeeping',
+  'build.paused': 'progress',
+  'build.resumed': 'progress',
+  'build.aborted': 'progress',
+  'spec.imported': 'progress',
+  'spec.authored': 'progress',
+  'spec.revised': 'progress',
+  'session.started': 'progress',
+  'session.ended': 'progress',
+  'plan.started': 'progress',
+  'plan.completed': 'progress',
+  'plan-review.started': 'progress',
+  'plan-review.verdict': 'progress',
+  'implement.started': 'progress',
+  'implement.completed': 'progress',
+  'code-review.started': 'progress',
+  'code-review.verdict': 'progress',
+  'verify.reconcile-policy-captured': 'progress',
+  'verify.started': 'progress',
+  'verify.completed': 'progress',
+  'finalize.started': 'progress',
+  'finalize.completed': 'progress',
+  'finalize.step-completed': 'progress',
+  'pr-attachment.designated': 'progress',
+  'pr-attachment.hosted': 'progress',
+  'pr-attachment.reclaimed': 'progress',
+  'pr-attachment.reclaim-failed': 'progress',
+  'pr.auto-merge-enabled': 'progress',
+  'pr.auto-merge-disabled': 'progress',
+  'pr.merged': 'progress',
+  'pr.closed': 'progress',
+  'pr.conflicted': 'progress',
+  'reconcile.progress-checked': 'progress',
+  'reconcile.started': 'progress',
+  'reconcile.completed': 'progress',
+  'observation.recorded': 'progress',
+  'escalation.raised': 'progress',
+  'escalation.answered': 'progress',
+  'phase.failed': 'failure',
+} satisfies Record<EventType, 'bookkeeping' | 'failure' | 'progress'>
+
+interface Accumulator {
+  active: { instance: string; seq: number; eligible: boolean } | null
+  count: number
+  open: string[]
+  latest: { instance: string; seq: number } | null
+}
+
+export const executionNoProgressReducer = defineReducer({
+  version: 1,
+  initial: (): Accumulator => ({ active: null, count: 0, open: [], latest: null }),
+  fold(acc, events: readonly AbEvent[]) {
+    for (const event of events) {
+      if (event.type === 'execution.started') {
+        // An abandoned start breaks the consecutive completed-execution streak.
+        if (acc.active !== null) acc.count = 0
+        acc.active = { instance: event.payload.instance, seq: event.seq, eligible: true }
+      } else if (event.type === 'execution.ended') {
+        if (acc.active?.instance !== event.payload.instance) continue
+        const clean = event.payload.outcome === 'completed' && event.payload.exitCode === 0
+        acc.count = clean && acc.active.eligible ? acc.count + 1 : 0
+        acc.latest = { instance: event.payload.instance, seq: event.seq }
+        acc.active = null
+      } else if (
+        event.type === 'escalation.raised' &&
+        event.payload.source === 'policy' &&
+        event.payload.policyCause === 'execution-no-progress'
+      ) {
+        if (!acc.open.includes(event.payload.id)) acc.open.push(event.payload.id)
+      } else if (event.type === 'escalation.answered') {
+        if (!acc.open.includes(event.payload.id)) continue
+        acc.open = acc.open.filter((id) => id !== event.payload.id)
+        acc.count = 0
+        acc.active = null
+      } else if (executionProgress[event.type] !== 'bookkeeping') {
+        acc.count = 0
+        if (acc.active !== null) acc.active.eligible = false
+      }
+    }
+  },
+  finish: (acc) => ({ ...acc, open: [...acc.open] }),
+})
+
+/** Describe routing without copying commands or phase feedback into the question. */
+function expectedAction(decision: Decision): string {
+  if (decision.kind === 'run-phase') return `${decision.kind} ${decision.phase}@${decision.round}`
+  if ('step' in decision)
+    return `${decision.kind} ${decision.step} (attempt ${'attempt' in decision ? decision.attempt : 1})`
+  if (decision.kind === 'raise-escalation') return `${decision.kind} ${decision.phase}`
+  return decision.kind
+}
+
+/** Repair the third-completion/raise crash gap without provisioning execution four. */
+export async function ensureExecutionProgress(
+  store: Pick<RepoViewStore, 'buildFacts' | 'appendIfCurrent' | 'refreshBuild'>,
+  ids: IdSource,
+  slug: string,
+  config: Config,
+  decide?: (
+    state: Parameters<typeof decideNextFromFacts>[0],
+    log: Parameters<typeof decideNextFromFacts>[1],
+  ) => Promise<Decision | undefined>,
+): Promise<boolean> {
+  for (;;) {
+    await store.refreshBuild(slug)
+    const facts = await store.buildFacts(slug)
+    const decision = decide
+      ? await decide(facts.state, facts.log)
+      : decideNextFromFacts(facts.state, facts.log, config)
+    if (decision === undefined) return false
+    // Commands must still be acknowledged even while this guard is parked.
+    if (decision.kind === 'acknowledge') return true
+    const streak = facts.executionNoProgress
+    if (streak.open.length > 0) return false
+    // Callers own wait routing, including publication-recovery launches. A
+    // legitimate wait is not dispatcher/runner disagreement.
+    if (decision.kind === 'wait') return true
+    if (streak.count < 3) return true
+    const raised = await store.appendIfCurrent(slug, facts.state.lastSeq, {
+      actor: DISPATCHER,
+      type: 'escalation.raised',
+      payload: {
+        id: ids('esc'),
+        phase: 'setup',
+        source: 'policy',
+        policyCause: 'execution-no-progress',
+        question: `${streak.count} consecutive executions ended normally without build progress. Dispatcher expected ${expectedAction(decision)}. Inspect the dispatcher/runner disagreement, then answer with guidance or retry.`,
+        refs:
+          streak.latest === null
+            ? []
+            : [`execution:${streak.latest.instance}`, `seq:${streak.latest.seq}`],
+      },
+    })
+    if (raised !== null) return false
+  }
+}