@defrex/autobuild 0.12.0 → 0.14.0

package/packages/core/src/processes/repo-view.ts

@@ -1,60 +1,16 @@
-/**
- * The dispatcher's in-process repository view (AUT-647): a `BuildStore`
- * decorator that builds the state a tick needs once, at the first refresh, and
- * on every later refresh reads only events newer than the cursors it already
- * holds — one journal delta, one delta per live build, and the discovery
- * listing/digest reads that find builds appearing since.
- *
- * Every tick stage talks to this object instead of the raw store, so
- *
- * - reads (`getEvents`, `getRepoEvents`, `getRepoStateEvents`,
- *   `getRepoBuildDigests`, `listBuilds`) are answered from memory;
- * - an event a stage appends is folded in immediately, so a later stage of the
- *   same tick sees it with no re-read (a foreign append interleaved with ours
- *   leaves a seq gap, which marks the log dirty so the next read deltas);
- * - a failed compare-and-set marks its log dirty, so every existing CAS loop
- *   that re-reads after a conflict observes the winner's event unchanged.
- *
- * Concurrency: every state transition of one source (a build slug, the journal,
- * the listing/discovery pair) runs on that source's single in-flight promise
- * chain — snapshot reads, delta reads, window opening and widening, the fold
- * after an own append, a lost compare-and-set's invalidation. Readers run on the
- * chain too, so a second reader joins the repair already in flight and never
- * observes half-applied state; nothing interleaves inside a transition, which
- * is why no write-generation or re-check bookkeeping is needed. Chain tasks only
- * call the backing store and the private unlocked helpers, never a public
- * method (that would deadlock behind itself).
- *
- * Safety net: every delta must begin at `cursor + 1` and stay contiguous; if
- * it does not, the log is discarded and re-read in full, so "no event is ever
- * skipped" is enforced here rather than assumed of the adapters.
- *
- * What is held:
- *
- * - the bounded repository journal (`getRepoStateEvents`' subset), pruned on
- *   arrival by the same keep rule — durable facts, latest-only measurements,
- *   and the tail (excluding latest-only types) from the latest
- *   `dispatcher.run-started` — which is exact for seq-ordered input;
- * - for *work* builds (nonterminal, aborted, reclaim-pending, execution-open),
- *   the full event array. Settled terminal builds hold only the discovery
- *   digest and cost no log read;
- * - read windows: cursor-bearing readers (the orchestrator wake pass scans
- *   every build, settled ones included, from a per-session cursor) get a
- *   per-source window holding only events above their lowest cursor.
- *
- * Cold start (reducer snapshots, `store/snapshots.ts`): a process with no hot
- * memory loads each source's stored reducer state — the pruned journal view; the
- * build, log-index and open-execution reducers for a work build — as of a
- * cursor, reads only events newer than it, and advances. A snapshot-backed work
- * log holds just that delta plus the reduced state of everything before it, so a
- * quiet tick reads zero event rows. Every snapshot is a cache the log
- * regenerates: a missing, mismatched-version, ahead-of-log, malformed or
- * unreadable one is a miss and the source is replayed in full, with identical
- * results. `persistSnapshots` writes the advanced state back (best effort;
- * cursors only ever move forward in the store).
- */
+import { readBuildDigests } from '../store/reduced-reads'
+/** Repository-scoped sequencing and metadata coordination. Current reductions
+ * come exclusively from persisted values; raw methods return actual event output. */
+import {
+  readBuildFacts,
+  readPersistedBuildDigests,
+  readRepositoryFacts,
+  type CurrentBuildFacts,
+  type RepositoryReadFacts,
+} from '../store/reduced-reads'
+import { repositoryReadFactsReducer } from '../kernel/read-facts'
+import type { ReducerValueRequest, ReducerValue } from '../store/reducer-values'
 import type { AbEvent, EventEnvelope, EventWrite } from '../events/catalog'
-import { validateRepositoryEventWrite } from '../events/repository'
 import type { EventType } from '../events/payloads'
 import type {
   RepositoryEvent,
@@ -68,32 +24,9 @@ import type {
   SessionEventType,
   SessionEventWrite,
 } from '../events/sessions'
-import { dashboardFactsReducer, type DashboardFacts } from '../cli/dashboard/facts'
-import { currentDeferralObservationReducer, type DeferralLedger } from '../kernel/auto-merge'
-import { logIndexReducer, type LogIndex } from '../kernel/log-index'
-import { buildReducer, reduceBuild, type BuildAcc, type BuildState } from '../kernel/reducer'
+import type { BuildState } from '../kernel/reducer'
 import { createBuildScopedStore } from '../store/build-scope'
-import { buildDigestReducer, reduceBuildDigest, type DigestEventRow } from '../store/digest'
-import {
-  foldJournalView,
-  JOURNAL_VIEW_REDUCER_VERSION,
-  journalViewReducer,
-  type JournalViewAcc,
-} from '../store/repo-state-events'
-import {
-  loadReducerSnapshot,
-  persistReducerSnapshot,
-  type ReducerSnapshot,
-  type SnapshotScope,
-} from '../store/snapshots'
-import { openBuildWorkspaceReducer, type OpenBuildWorkspace } from './dispatcher-selectors'
-import {
-  type ExecutionOutcome,
-  lastExecutionOutcomeReducer,
-  openExecutionReducer,
-  type OpenExecution,
-} from './execution-settlement'
-import { type PublicationView, publicationStateReducer } from './publication-state'
+import type { ReducerSnapshot, SnapshotScope } from '../store/snapshots'
 import { createSessionScopedStore } from '../store/session-handle'
 import type {
   StreamChunk,
@@ -131,76 +64,13 @@ import type {
   Unsubscribe,
 } from '../store/types'
 
-/** Registry names the snapshots are keyed by (kernel/reducer-registry.ts). */
-const SNAPSHOT_JOURNAL = 'journalView'
-/** A resident view persists at most this often; a cold single-tick process
- * (the hosted dispatcher) always persists once at its tick's end. */
-const PERSIST_MIN_INTERVAL_MS = 30_000
-/** Builds written back concurrently. */
-const PERSIST_CONCURRENCY = 4
-
-/** The reducers a work build's snapshots hold beside `build`, keyed by registry
- * name (`kernel/reducer-registry.ts`). Every quiet-path tick stage reads its
- * facts from these, so a snapshot-backed log needs no event array. */
-const EXTRA_REDUCERS = {
-  // The digest reducer folds the narrow rows `digestRow` projects, so it is
-  // adapted to the event-array form the rest of the bundle shares. A restored
-  // log derives its own digest from this, never from discovery.
-  buildDigest: {
-    version: buildDigestReducer.version,
-    initial: buildDigestReducer.initial,
-    advance: (acc: ReturnType<typeof buildDigestReducer.initial>, events: readonly AbEvent[]) =>
-      buildDigestReducer.advance(acc, events.map(digestRow)),
-    finish: buildDigestReducer.finish,
-  },
-  logIndex: logIndexReducer,
-  openExecution: openExecutionReducer,
-  openBuildWorkspace: openBuildWorkspaceReducer,
-  publicationState: publicationStateReducer,
-  lastExecutionOutcome: lastExecutionOutcomeReducer,
-  // The operator dashboard's row facts (`cli/dashboard/facts.ts`) and the
-  // auto-merge deferral ledger, so a row derives from the snapshot too.
-  dashboardFacts: dashboardFactsReducer,
-  currentDeferralObservation: currentDeferralObservationReducer,
-} as const
-type ExtraName = keyof typeof EXTRA_REDUCERS
-const EXTRA_NAMES = Object.keys(EXTRA_REDUCERS) as ExtraName[]
-type ExtraAccs = Record<ExtraName, unknown>
-
-/** The one build-scope snapshot row a work build is restored from. Every
- * accumulator rides in it at a single cursor, so one `putReducerSnapshot` —
- * atomic per row on every adapter — publishes them together and a reader in
- * another process sees either the old bundle or the new, never a mix (a mixed
- * restore would fall back to a full replay). */
-const SNAPSHOT_WORK = 'work'
-/** Bump when the bundle layout changes. */
-const WORK_BUNDLE_LAYOUT = 1
-/** Derived from the component versions (they only ever increase), so a bundle
- * written under any other reducer version misses instead of mixing shapes. */
-export const WORK_BUNDLE_VERSION =
-  WORK_BUNDLE_LAYOUT +
-  buildReducer.version +
-  EXTRA_NAMES.reduce((total, name) => total + EXTRA_REDUCERS[name].version, 0)
-const WORK_BUNDLE_REDUCER = { version: WORK_BUNDLE_VERSION }
-
-/** The facts a quiet-path stage needs about one build, without its event array. */
-export interface BuildFacts {
-  state: BuildState
-  log: LogIndex
-  open: OpenExecution | null
-  /** The open workspace (the latest provisioned, not yet released). */
-  workspace: OpenBuildWorkspace | null
-  publication: PublicationView
-  lastExecution: ExecutionOutcome
-  /** What a dashboard row reads beyond the build state. */
-  dashboard: DashboardFacts
-  deferral: DeferralLedger
+export interface RepoViewOptions {
+  repo: string
+  resident?: boolean
+  now?: () => number
 }
-
-/** A build that still has tick duties: nonterminal, aborted (awaiting its
- * cleanup's `build.completed`), a `done` build with an unreclaimed release
- * asset, or one with an execution the provider has not been seen to end. A
- * terminal, settled build costs no event reads. */
+export type WindowSource = { build: string } | 'journal'
+export type BuildFacts = CurrentBuildFacts
 export function isWorkDigest(digest: Omit<BuildDigest, 'slug'>): boolean {
   return (
     digest.terminal === undefined ||
@@ -209,1047 +79,326 @@ export function isWorkDigest(digest: Omit<BuildDigest, 'slug'>): boolean {
     digest.executionOpen === true
   )
 }
-
-function digestRow(event: AbEvent): DigestEventRow {
-  return {
-    type: event.type,
-    seq: event.seq,
-    ts: event.ts,
-    ...(event.type === 'pr-attachment.reclaimed' ? { hostedSeq: event.payload.hostedSeq } : {}),
-    ...(event.type === 'execution.started' || event.type === 'execution.ended'
-      ? { instance: event.payload.instance }
-      : {}),
-  }
-}
-
-/** One build log held in memory: events with `seq > from`, contiguous through
- * `cursor`. Work logs are held from 0. A window created for a cursor-bearing
- * reader may start higher; in a resident view it then also carries `acc`, the
- * reduced state of the history it does not retain. */
-interface Log {
-  from: number
-  events: AbEvent[]
-  cursor: number
-  dirty: boolean
-  /** The refresh epoch this log was last brought current in. */
-  epoch: number
-  acc?: BuildAcc
-  /** The other work-build accumulators ride beside `acc`, so the facts a stage
-   * derives never need the event array. */
-  extra?: ExtraAccs
-  /** The cursor last read from, or written to, the snapshot store. */
-  persisted: number
-  /** Created by a cursor-bearing request: survives refreshes while unneeded. */
-  pinned: boolean
-  digest?: { cursor: number; value: Omit<BuildDigest, 'slug'> }
-}
-
-interface JournalWindow {
-  from: number
-  events: RepositoryEvent[]
-  /** Highest seq held (≥ from). */
-  last: number
-}
-
-/** Every retained journal entry is an event envelope, in increasing seq order
- * and no newer than the snapshot's cursor. */
-function retainedShape(retained: unknown[], cursor: number): boolean {
-  let last = 0
-  for (const event of retained) {
-    if (!isObject(event)) return false
-    if (typeof event.type !== 'string' || typeof event.ts !== 'string') return false
-    if (typeof event.repo !== 'string' || !isObject(event.actor)) return false
-    if (!Number.isInteger(event.seq) || (event.seq as number) <= last) return false
-    last = event.seq as number
-    // The payload must satisfy the repository event contract for its type, so a
-    // reducer never meets an entry a full replay would not have produced.
-    try {
-      validateRepositoryEventWrite({
-        actor: event.actor,
-        type: event.type,
-        payload: event.payload,
-      } as never)
-    } catch {
-      return false
-    }
-  }
-  return last <= cursor
-}
-
-/** Structural checks on the small accumulators a later fold dereferences. */
-function extraAccsShape(extra: ExtraAccs): boolean {
-  const field = (acc: unknown, key: string): unknown => (isObject(acc) ? acc[key] : undefined)
-  const open = field(extra.openExecution, 'open')
-  if (open !== null && !(isObject(open) && typeof open.instance === 'string')) return false
-  const workspace = field(extra.openBuildWorkspace, 'open')
-  if (workspace !== null && !(isObject(workspace) && typeof workspace.ref === 'string')) {
-    return false
-  }
-  if (typeof field(extra.lastExecutionOutcome, 'state') !== 'string') return false
-  if (!Array.isArray(field(extra.publicationState, 'ledger'))) return false
-  const dashboard = extra.dashboardFacts
-  if (
-    !(
-      isObject(dashboard) &&
-      Array.isArray(dashboard.sessionEvents) &&
-      isObject(dashboard.intervals) &&
-      isObject(dashboard.produced)
-    )
-  ) {
-    return false
-  }
-  if (!Array.isArray(field(extra.currentDeferralObservation, 'entries'))) return false
-  const digest = extra.buildDigest
-  return (
-    isObject(digest) &&
-    Array.isArray(digest.observations) &&
-    Array.isArray(digest.hosted) &&
-    Array.isArray(digest.reclaimed) &&
-    (digest.openInstance === null || typeof digest.openInstance === 'string')
-  )
-}
-
-function hasAccs(log: Log): boolean {
-  return log.acc !== undefined && log.extra !== undefined
-}
-
-function isObject(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value)
-}
-
-export interface RepoViewOptions {
-  repo: string
-  /** A long-running dispatcher: windows are seeded from a full read so the
-   * reduced state of unretained history stays available (one pass over the log
-   * at process start). One-shot invocations leave this off and read each
-   * window from its cursor, exactly as the wake pass always did. */
-  resident?: boolean
-  /** Injectable millisecond clock for the persist throttle (tests). */
-  now?: () => number
-}
-
-/** Runs tasks strictly one after another; `onIdle` fires when the queue drains. */
 class Chain {
-  private tail: Promise<void> = Promise.resolve()
-  private pending = 0
-
-  constructor(private readonly onIdle?: () => void) {}
-
+  private tail: Promise<unknown> = Promise.resolve()
   run<T>(task: () => Promise<T>): Promise<T> {
-    this.pending += 1
     const result = this.tail.then(task)
-    this.tail = result
-      .then(
-        () => undefined,
-        () => undefined,
-      )
-      .then(() => {
-        this.pending -= 1
-        if (this.pending === 0) this.onIdle?.()
-      })
+    this.tail = result.catch(() => {})
     return result
   }
 }
-
-export type WindowSource = { build: string } | 'journal'
-
+interface RawWindow<E> {
+  from: number
+  cursor: number
+  events: E[]
+  epoch: number
+  dirty: boolean
+}
 export class RepoViewStore implements BuildStore {
-  private readonly repo: string
-  private readonly resident: boolean
   private epoch = 0
+  private readonly windows = new Map<string, RawWindow<AbEvent>>()
+  private journalWindow?: RawWindow<RepositoryEvent>
+  private readonly repo: string
+  private readonly builds = new Map<string, Chain>()
+  private readonly journalChain = new Chain()
+  private readonly metaChain = new Chain()
   private initialized = false
-  /** The journal alone is loaded (`startJournal`): own journal appends fold. */
-  private journalReady = false
-  private initializing: Promise<void> | undefined
-
-  // Journal.
   private recorded = false
-  private journal: RepositoryEvent[] = []
-  private anchor: number | undefined
-  private journalCursor = 0
-  private journalDirty = false
-  private journalEpoch = -1
-  private journalWindow: JournalWindow | undefined
-  private persistedJournal = 0
-  private lastPersistAt: number | undefined
-
-  // Builds.
   private records: BuildRecord[] = []
-  private recordsDirty = false
+  private recordsDirty = true
   private discovery = new Map<string, BuildDigest>()
-  private discoveryDirty = false
-  private readonly logs = new Map<string, Log>()
-  private readonly work = new Set<string>()
-  private readonly buildChains = new Map<string, Chain>()
-  private readonly journalChain = new Chain()
-  /** Serializes the build listing and the discovery digests. */
-  private readonly metaChain = new Chain()
-
-  private readonly now: () => number
-
+  private readonly dirtyDigests = new Set<string>()
+  private discoveryDirty = true
+  private repoFacts = repositoryReadFactsReducer.finish(repositoryReadFactsReducer.initial())
   constructor(
     private readonly backing: BuildStore,
     opts: RepoViewOptions,
   ) {
     this.repo = opts.repo
-    this.resident = opts.resident === true
-    this.now = opts.now ?? Date.now
   }
-
-  // ── Refresh ────────────────────────────────────────────────────────────────
-
-  /** One build's transitions, strictly in order. */
   private build<T>(slug: string, task: () => Promise<T>): Promise<T> {
-    let chain = this.buildChains.get(slug)
-    if (chain === undefined) {
-      const created: Chain = new Chain(() => {
-        if (this.buildChains.get(slug) === created) this.buildChains.delete(slug)
-      })
-      chain = created
-      this.buildChains.set(slug, created)
+    let chain = this.builds.get(slug)
+    if (!chain) {
+      chain = new Chain()
+      this.builds.set(slug, chain)
     }
     return chain.run(task)
   }
-
-  /** Cold start once, shared by every reader that arrives before it finishes. */
-  private ensureInit(): Promise<void> {
-    if (this.initialized) return Promise.resolve()
-    this.initializing ??= this.refresh().finally(() => {
-      this.initializing = undefined
-    })
-    return this.initializing
-  }
-
-  /** The once-per-tick entry and lazy initializer. Cold (first call): the
-   * journal's high-water mark, the bounded journal read, the build listing and
-   * digests, and a full read of every work build. Warm: only what is newer. */
   async refresh(): Promise<void> {
-    this.epoch += 1
-    await this.journalChain.run(() => this.syncOrLoadJournal())
-    await this.refreshRecords()
-    await this.refreshDiscovery()
-
-    const own = this.records.filter((record) => record.repo === this.repo)
-    const known = new Set(own.map((record) => record.slug))
-    // Every build held at refresh start reads its tail first, regardless of
-    // what discovery says; only then may a now-settled build be evicted.
-    for (const slug of [...this.work]) {
-      await this.build(slug, async () => {
-        if (!this.work.has(slug)) return
-        if (!known.has(slug)) {
-          this.work.delete(slug)
-          this.logs.delete(slug)
-          return
-        }
-        const log = this.logs.get(slug)
-        if (log === undefined) {
-          await this.loadWork(slug)
-          return
-        }
-        await this.ensureCurrent(slug, log)
-        const current = this.logs.get(slug) ?? log
-        if (!isWorkDigest(this.digestOf(slug, current))) {
-          // Its last events are in hand; leave the final state behind.
-          await this.persistLog(slug, current)
-          this.work.delete(slug)
-          if (!current.pinned) this.logs.delete(slug)
-        }
-      })
-    }
-    for (const record of own) {
-      await this.build(record.slug, async () => {
-        if (this.work.has(record.slug)) return
-        const digest = this.discovery.get(record.slug)
-        if (digest !== undefined && !isWorkDigest(digest)) return
-        await this.loadWork(record.slug)
-        this.work.add(record.slug)
-      })
-    }
-    // Unpinned logs read for one request do not outlive the epoch.
-    for (const slug of [...this.logs.keys()]) {
-      await this.build(slug, async () => {
-        const log = this.logs.get(slug)
-        if (log !== undefined && !this.work.has(slug) && !log.pinned) this.logs.delete(slug)
-      })
-    }
-    // The cold start's replay is the expensive part to lose: leave it behind
-    // now rather than only at the tick's end. Later epochs persist at the end.
-    if (this.epoch === 1) await this.persistSnapshots({ cold: true })
-  }
-
-  private refreshRecords(): Promise<void> {
-    return this.metaChain.run(async () => {
-      // Cleared before the read: an own write that lands during it re-marks.
+    this.epoch++
+    await this.refreshJournal()
+    await this.metaChain.run(async () => {
       this.recordsDirty = false
-      try {
-        this.records = await this.backing.listBuilds()
-      } catch (error) {
-        this.recordsDirty = true
-        throw error
-      }
-    })
-  }
-
-  private refreshDiscovery(): Promise<void> {
-    return this.metaChain.run(async () => {
       this.discoveryDirty = false
-      try {
-        this.discovery = await this.backing.getRepoBuildDigests(this.repo)
-      } catch (error) {
-        this.discoveryDirty = true
-        throw error
-      }
+      this.dirtyDigests.clear()
+      this.records = await this.backing.listBuilds()
+      this.discovery = await readBuildDigests(this.backing, this.repo)
+      this.initialized = true
     })
   }
-
-  /** The journal-only delta, for a stage that needs foreign journal appends
-   * mid-tick (the ready scan) without paying for discovery. */
-  async refreshJournal(): Promise<void> {
-    if (!this.initialized) return this.ensureInit()
-    // The build epoch is untouched: build logs stay current for this tick.
-    await this.journalChain.run(() => this.syncJournal(true))
+  async startJournal(): Promise<void> {
+    await this.refreshJournal()
   }
-
-  // ── Journal ────────────────────────────────────────────────────────────────
-
-  private resetJournalState(): void {
-    this.journal = []
-    this.anchor = undefined
-    this.journalCursor = 0
-    this.journalWindow = undefined
-    this.journalDirty = false
-    this.persistedJournal = 0
-  }
-
-  /** Cold journal load. The true high-water mark is read before the bounded
-   * subset: an event the subset excludes is never needed (a later anchor has a
-   * higher seq and cannot pull earlier events into the tail), and everything
-   * committed between the two reads is either returned or irrelevant. */
-  private async loadJournal(opts: { snapshot?: boolean } = {}): Promise<void> {
-    this.resetJournalState()
-    if ((await this.backing.getRepo(this.repo)) === null) {
-      this.recorded = false
-      return
-    }
-    this.recorded = true
-    if (opts.snapshot === true && (await this.restoreJournal())) return
-    const high = await this.backing.getRepoHighWater(this.repo)
-    const subset = await this.backing.getRepoStateEvents(this.repo)
-    this.foldJournal(subset)
-    this.journalCursor = Math.max(high, this.journalCursor)
-    this.journalEpoch = this.epoch
-  }
-
-  /** Install the stored journal view and read only the events newer than its
-   * cursor. Any shortfall — no snapshot, a malformed one, a failed or
-   * non-contiguous delta — leaves the state reset and answers `false`, and the
-   * caller replays in full. */
-  private async restoreJournal(): Promise<boolean> {
-    const scope: SnapshotScope = { kind: 'repo', repo: this.repo }
-    const snapshot = await loadReducerSnapshot(
-      this.backing,
-      scope,
-      SNAPSHOT_JOURNAL,
-      journalViewReducer,
-    )
-    if (snapshot === null) return false
-    const state = snapshot.state
-    if (
-      !isObject(state) ||
-      !Array.isArray(state.retained) ||
-      (state.anchor !== undefined && typeof state.anchor !== 'number') ||
-      !retainedShape(state.retained, snapshot.cursor)
-    ) {
-      return false
-    }
-    try {
-      const delta = (await this.backing.getRepoEvents(this.repo, snapshot.cursor)).filter(
-        (event) => event.seq > snapshot.cursor,
-      )
-      if (!contiguousFrom(delta, snapshot.cursor)) return false
-      this.journal = [...(state.retained as RepositoryEvent[])]
-      this.anchor = state.anchor as number | undefined
-      this.journalCursor = snapshot.cursor
-      this.persistedJournal = snapshot.cursor
-      this.foldJournal(delta)
-      this.journalEpoch = this.epoch
-      return true
-    } catch {
-      this.resetJournalState()
-      this.recorded = true
-      return false
-    }
-  }
-
-  /** Restore the journal alone, ahead of the first `refresh()`, so the
-   * lifecycle appends a process makes before its first tick fold into the view
-   * and are not read back. Costs no listing, digest, or build read. */
-  startJournal(): Promise<void> {
-    return this.journalChain.run(async () => {
-      if (this.journalReady || this.initialized) return
-      await this.loadJournal({ snapshot: true })
-      this.journalReady = true
+  async refreshJournal(): Promise<void> {
+    if (this.journalWindow) this.journalWindow.dirty = true
+    await this.journalChain.run(async () => {
+      this.recorded = (await this.backing.getRepo(this.repo)) !== null
+      this.repoFacts = (await readRepositoryFacts(this.backing, this.repo)).value
     })
   }
-
-  private async syncOrLoadJournal(): Promise<void> {
-    if (!this.initialized) {
-      if (this.journalReady) await this.syncJournal(true)
-      else await this.loadJournal({ snapshot: true })
-      this.initialized = true
-    } else {
-      await this.syncJournal(true)
-    }
-  }
-
-  /** Bring the journal current: one delta read from the cursor (a repository
-   * no tick has recorded yet is re-probed instead). Runs on the journal chain. */
-  private async syncJournal(force = false): Promise<void> {
-    if (!this.recorded) {
-      if ((await this.backing.getRepo(this.repo)) === null) return
-      await this.loadJournal({ snapshot: true })
-      return
-    }
-    if (!force && !this.journalDirty && this.journalEpoch === this.epoch) return
-    const read = await this.backing.getRepoEvents(this.repo, this.journalCursor)
-    this.journalDirty = false
-    this.journalEpoch = this.epoch
-    const delta = read.filter((event) => event.seq > this.journalCursor)
-    if (delta.length === 0) return
-    if (!contiguousFrom(delta, this.journalCursor)) {
-      // A hole: discard and re-read from scratch rather than skip an event.
-      await this.loadJournal()
-      return
-    }
-    this.foldJournal(delta)
+  repositoryFacts(): RepositoryReadFacts {
+    return structuredClone(this.repoFacts)
   }
-
-  /** Fold events newer than the cursor into the bounded subset and the window. */
-  private foldJournal(events: readonly RepositoryEvent[]): void {
-    for (const event of events) {
-      if (event.seq <= this.journalCursor) continue
-      this.journalCursor = event.seq
-      // The same prune-on-arrival fold the registered `journalView` reducer
-      // runs, so a snapshot of this state resumes identically.
-      const acc: JournalViewAcc = { retained: this.journal }
-      if (this.anchor !== undefined) acc.anchor = this.anchor
-      foldJournalView(acc, [event])
-      this.journal = acc.retained
-      this.anchor = acc.anchor
-      const window = this.journalWindow
-      if (window !== undefined && event.seq > window.last) {
-        window.events.push(event)
-        window.last = event.seq
-      }
-    }
-  }
-
-  /** The bounded journal subset, `[]` for a repository no one has recorded. */
-  recordedJournal(): RepositoryEvent[] {
-    return [...this.journal]
-  }
-
-  /** Whether the repository's journal record exists. */
   journalRecorded(): boolean {
     return this.recorded
   }
-
-  // ── Builds ─────────────────────────────────────────────────────────────────
-
-  private digestOf(slug: string, log: Log): Omit<BuildDigest, 'slug'> {
-    if (log.digest === undefined || log.digest.cursor !== log.cursor) {
-      if (log.extra !== undefined) {
-        const value = buildDigestReducer.finish(log.extra.buildDigest as never)
-        log.digest = { cursor: log.cursor, value }
-        return value
-      }
-      if (log.from > 0) {
-        // A trimmed window cannot derive a digest; discovery owns that slug.
-        const found = this.discovery.get(slug)
-        if (found !== undefined) return found
-      }
-      log.digest = { cursor: log.cursor, value: reduceBuildDigest(log.events.map(digestRow)) }
-    }
-    return log.digest.value
-  }
-
-  /** Full read, installed as the slug's log. Runs on the build's chain. */
-  private async loadFull(slug: string): Promise<Log> {
-    const events = await this.backing.getEvents(slug)
-    const previous = this.logs.get(slug)
-    const log: Log = {
-      from: 0,
-      events,
-      cursor: events.at(-1)?.seq ?? 0,
-      dirty: false,
-      epoch: this.epoch,
-      persisted: previous?.persisted ?? 0,
-      pinned: previous?.pinned ?? false,
-    }
-    this.logs.set(slug, log)
-    return log
-  }
-
-  /** Install a work build's log, from its stored reducer state when there is
-   * one. Runs on the build's chain. The snapshot-backed log holds only the
-   * events newer than the snapshot, plus the accumulators for everything
-   * before; any shortfall is a full read. */
-  private async loadWork(slug: string): Promise<Log> {
-    const restored = await this.restoreLog(slug)
-    return restored ?? (await this.loadFull(slug))
-  }
-
-  private async restoreLog(slug: string): Promise<Log | null> {
-    const scope: SnapshotScope = { kind: 'build', slug }
-    const bundle = await loadReducerSnapshot(
-      this.backing,
-      scope,
-      SNAPSHOT_WORK,
-      WORK_BUNDLE_REDUCER,
-    )
-    if (bundle === null || !isObject(bundle.state)) return null
-    const buildState = bundle.state.build
-    const extra = bundle.state.extra
-    if (!isObject(extra)) return null
-    if (!buildAccShape({ ...bundle, state: buildState })) return null
-    for (const name of EXTRA_NAMES) if (!isObject(extra[name])) return null
-    if (!extraAccsShape(extra as ExtraAccs)) return null
-    if (!indexAccShape(extra.logIndex)) return null
-    const build = { cursor: bundle.cursor, state: buildState }
-    const cursor = build.cursor
-    try {
-      const delta = (await this.backing.getEvents(slug, cursor)).filter(
-        (event) => event.seq > cursor,
-      )
-      if (!contiguousFrom(delta, cursor)) return null
-      const log: Log = {
-        from: cursor,
-        events: [],
-        cursor,
-        dirty: false,
-        epoch: this.epoch,
-        acc: build.state as BuildAcc,
-        extra: extra as ExtraAccs,
-        persisted: cursor,
-        pinned: this.logs.get(slug)?.pinned ?? false,
-      }
-      // Exercise every projection a stage will derive, before the state is
-      // installed: a structurally incomplete accumulator that passed the cheap
-      // shape checks throws here and the build is replayed instead.
-      this.probe(log)
-      if (delta.length > 0) this.fold(log, delta)
-      this.probe(log)
-      this.logs.set(slug, log)
-      return log
-    } catch {
-      return null
-    }
-  }
-
-  /** Bring one log current: a single delta read from its cursor, skipped when
-   * it was already brought current in this epoch and nothing marked it dirty.
-   * Runs on the build's chain, so nothing marks the log while the read is in
-   * flight. */
-  private async ensureCurrent(slug: string, log: Log): Promise<void> {
-    if (!log.dirty && log.epoch === this.epoch) return
-    const read = await this.backing.getEvents(slug, log.cursor)
-    log.dirty = false
-    log.epoch = this.epoch
-    const delta = read.filter((event) => event.seq > log.cursor)
-    if (delta.length === 0) return
-    if (!contiguousFrom(delta, log.cursor)) {
-      await this.loadFull(slug)
-      return
-    }
-    this.fold(log, delta)
+  async refreshBuild(slug: string): Promise<void> {
+    await this.build(slug, async () => {})
   }
-
-  /** Derive every projection of a log's accumulators (throws on malformed state). */
-  private probe(log: Log): void {
-    const extra = log.extra!
-    buildReducer.finish(log.acc!)
-    logIndexReducer.finish(extra.logIndex as never)
-    openExecutionReducer.finish(extra.openExecution as never)
-    openBuildWorkspaceReducer.finish(extra.openBuildWorkspace as never)
-    const publication = publicationStateReducer.finish(extra.publicationState as never)
-    publication.pending()
-    publication.abandonedPending()
-    publication.latestUncompletedRequest()
-    lastExecutionOutcomeReducer.finish(extra.lastExecutionOutcome as never)
-    buildDigestReducer.finish(extra.buildDigest as never)
-    dashboardFactsReducer.finish(extra.dashboardFacts as never)
-    currentDeferralObservationReducer.finish(extra.currentDeferralObservation as never)
+  buildState(slug: string): Promise<BuildState> {
+    return this.build(slug, async () => (await readBuildFacts(this.backing, slug)).value.state)
   }
-
-  private fold(log: Log, events: AbEvent[]): void {
-    log.events.push(...events)
-    log.cursor = events[events.length - 1]!.seq
-    if (log.acc !== undefined) log.acc = buildReducer.advance(log.acc, events)
-    if (log.extra !== undefined) {
-      for (const name of EXTRA_NAMES) {
-        // biome-ignore lint/suspicious/noExplicitAny: the table is heterogeneous
-        const reducer = EXTRA_REDUCERS[name] as any
-        log.extra[name] = reducer.advance(log.extra[name], events)
-      }
-    }
+  buildFacts(slug: string): Promise<CurrentBuildFacts> {
+    return this.build(slug, async () => (await readBuildFacts(this.backing, slug)).value)
   }
-
-  /** Make the three accumulators exist. Needs the full history unless they are
-   * already held; the caller guarantees `from === 0` or all three present. */
-  private ensureAccs(log: Log): void {
-    log.acc ??= buildReducer.advance(buildReducer.initial(), log.events)
-    if (log.extra === undefined) {
-      const extra = {} as ExtraAccs
-      for (const name of EXTRA_NAMES) {
-        // biome-ignore lint/suspicious/noExplicitAny: the table is heterogeneous
-        const reducer = EXTRA_REDUCERS[name] as any
-        extra[name] = reducer.advance(reducer.initial(), log.events)
+  async listBuilds(): Promise<BuildRecord[]> {
+    if (!this.initialized) await this.refresh()
+    return this.metaChain.run(async () => {
+      if (this.recordsDirty) {
+        this.recordsDirty = false
+        this.records = await this.backing.listBuilds()
       }
-      log.extra = extra
-    }
+      return structuredClone(this.records)
+    })
   }
-
-  private async openWindow(slug: string, since: number): Promise<Log> {
-    if (this.work.has(slug)) return this.loadFull(slug)
-    let log: Log
-    if (this.resident) {
-      // One pass over the log: reduce all of it, retain only what the reader
-      // has not consumed.
-      const all = await this.backing.getEvents(slug)
-      log = {
-        from: since,
-        events: all.filter((event) => event.seq > since),
-        cursor: all.at(-1)?.seq ?? 0,
-        dirty: false,
-        epoch: this.epoch,
-        acc: buildReducer.advance(buildReducer.initial(), all),
-        persisted: 0,
-        pinned: true,
+  async getRepoBuildDigests(repo: string): Promise<Map<string, BuildDigest>> {
+    if (repo !== this.repo) return this.backing.getRepoBuildDigests(repo)
+    await this.listBuilds()
+    return this.metaChain.run(async () => {
+      if (this.discoveryDirty) {
+        this.discoveryDirty = false
+        this.discovery = await readBuildDigests(this.backing, repo)
       }
-    } else {
-      const events = await this.backing.getEvents(slug, since)
-      log = {
-        from: since,
-        events,
-        cursor: Math.max(since, events.at(-1)?.seq ?? 0),
-        dirty: false,
-        epoch: this.epoch,
-        persisted: 0,
-        pinned: true,
+      if (this.dirtyDigests.size) {
+        const records = this.records.filter((record) => this.dirtyDigests.has(record.slug))
+        this.dirtyDigests.clear()
+        try {
+          for (const [slug, digest] of await readPersistedBuildDigests(this.backing, repo, records))
+            this.discovery.set(slug, digest)
+        } catch (error) {
+          for (const record of records) this.dirtyDigests.add(record.slug)
+          throw error
+        }
       }
-    }
-    this.logs.set(slug, log)
-    return log
+      const missing = this.records.filter(
+        (record) => record.repo === repo && !this.discovery.has(record.slug),
+      )
+      if (missing.length)
+        for (const [slug, digest] of await readPersistedBuildDigests(this.backing, repo, missing))
+          this.discovery.set(slug, digest)
+      return structuredClone(this.discovery)
+    })
   }
-
   async getEvents(
     slug: string,
-    cursor?: number,
+    sinceSeq = 0,
     opts?: { waitSeconds?: number; signal?: AbortSignal },
   ): Promise<AbEvent[]> {
-    const sinceSeq = cursor ?? 0
-    if (opts?.waitSeconds !== undefined || opts?.signal !== undefined) {
+    if (opts?.waitSeconds !== undefined || opts?.signal !== undefined)
       return this.backing.getEvents(slug, sinceSeq, opts)
-    }
-    return this.build(slug, async () => {
-      let log = this.logs.get(slug)
-      if (log === undefined || sinceSeq < log.from) {
-        log = await this.openWindow(slug, sinceSeq)
-      } else if (cursor !== undefined) {
-        // An explicit cursor, zero included, marks a cursor-bearing consumer
-        // (the wake pass); an omitted one is a plain read.
-        log.pinned = true
-      }
-      await this.ensureCurrent(slug, log)
-      // `ensureCurrent` may have replaced the log after a gap.
-      log = this.logs.get(slug) ?? log
-      return log.events.filter((event) => event.seq > sinceSeq)
-    })
-  }
-
-  /** Take one build's delta now, even if it was already read this epoch — for
-   * the decisions that deliberately re-read at the last possible moment so a
-   * concurrent writer's cancellation or request is honored. */
-  async refreshBuild(slug: string): Promise<void> {
-    await this.build(slug, async () => {
-      const log = this.logs.get(slug)
-      if (log === undefined) return
-      log.dirty = true
-      await this.ensureCurrent(slug, log)
-    })
-  }
-
-  /** The reduced state of one build without replaying history the view already
-   * folded: a held log is reduced in place; a resident window brings itself
-   * current and finishes its accumulator; anything else is one full read,
-   * then held. */
-  buildState(slug: string): Promise<BuildState> {
     return this.build(slug, async () => {
-      let log = this.logs.get(slug)
-      if (log === undefined || (log.from > 0 && log.acc === undefined)) {
-        log = await this.loadFull(slug)
-      }
-      await this.ensureCurrent(slug, log)
-      log = this.logs.get(slug) ?? log
-      return log.acc !== undefined ? buildReducer.finish(log.acc) : reduceBuild(log.events)
-    })
-  }
-
-  /** The reduced facts of one build — state, log index, open execution —
-   * brought current with one delta read, without its event array: a work
-   * build restored from snapshots answers from the accumulators. A log that is
-   * not snapshot-backed is reduced from its events (a full read the first
-   * time), and keeps the accumulators from then on. */
-  buildFacts(slug: string): Promise<BuildFacts> {
-    return this.build(slug, async () => {
-      let log = this.logs.get(slug)
-      if (log === undefined) {
-        log = await this.loadWork(slug)
-      } else if (log.from > 0 && !hasAccs(log)) {
-        log = await this.loadFull(slug)
-      }
-      await this.ensureCurrent(slug, log)
-      log = this.logs.get(slug) ?? log
-      this.ensureAccs(log)
-      const extra = log.extra!
-      return {
-        state: buildReducer.finish(log.acc!),
-        log: logIndexReducer.finish(extra.logIndex as never),
-        open: openExecutionReducer.finish(extra.openExecution as never),
-        workspace: openBuildWorkspaceReducer.finish(extra.openBuildWorkspace as never),
-        publication: publicationStateReducer.finish(extra.publicationState as never),
-        lastExecution: lastExecutionOutcomeReducer.finish(extra.lastExecutionOutcome as never),
-        dashboard: dashboardFactsReducer.finish(extra.dashboardFacts as never),
-        deferral: currentDeferralObservationReducer.finish(
-          extra.currentDeferralObservation as never,
-        ),
-      }
-    })
-  }
-
-  // ── Snapshots ──────────────────────────────────────────────────────────────
-
-  /** Write one work log's reducer state back to the snapshot store, if it has
-   * advanced past what was last read or written. Runs on the build's chain.
-   * Best effort: a failure leaves the cursor so the next call retries. A log
-   * that is dirty (a foreign append not yet read) or trimmed without its
-   * accumulators is skipped — only a cursor read from the log is persisted. */
-  private async persistLog(slug: string, log: Log): Promise<void> {
-    if (log.dirty || log.cursor <= log.persisted) return
-    if (log.from > 0 && !hasAccs(log)) return
-    this.ensureAccs(log)
-    const scope: SnapshotScope = { kind: 'build', slug }
-    const cursor = log.cursor
-    await persistReducerSnapshot(this.backing, scope, SNAPSHOT_WORK, {
-      version: WORK_BUNDLE_VERSION,
-      cursor,
-      state: { build: log.acc, extra: log.extra },
-    })
-    log.persisted = Math.max(log.persisted, cursor)
-  }
-
-  /** Write the journal view back when it has advanced. Runs on the journal chain. */
-  private async persistJournal(): Promise<void> {
-    if (!this.recorded || this.journalDirty || this.journalCursor <= this.persistedJournal) return
-    const cursor = this.journalCursor
-    const state: JournalViewAcc = {
-      ...(this.anchor !== undefined ? { anchor: this.anchor } : {}),
-      retained: [...this.journal],
-    }
-    await persistReducerSnapshot(
-      this.backing,
-      { kind: 'repo', repo: this.repo },
-      SNAPSHOT_JOURNAL,
-      { version: JOURNAL_VIEW_REDUCER_VERSION, cursor, state },
-    )
-    this.persistedJournal = Math.max(this.persistedJournal, cursor)
-  }
-
-  /** Persist every source that advanced since it was read or last written: the
-   * journal view and each work build. A resident view throttles repeated
-   * persists; `force` and a process's first persist always run. The snapshots
-   * are a cache — nothing here can fail the caller. */
-  async persistSnapshots(
-    opts: { force?: boolean; cold?: boolean; held?: boolean } = {},
-  ): Promise<void> {
-    if (!this.initialized && !this.journalReady) return
-    const now = this.now()
-    if (opts.cold !== true) {
-      if (
-        opts.force !== true &&
-        this.lastPersistAt !== undefined &&
-        now - this.lastPersistAt < PERSIST_MIN_INTERVAL_MS
-      ) {
-        return
-      }
-      this.lastPersistAt = now
-    }
-    try {
-      await this.journalChain.run(() => this.persistJournal())
-    } catch {
-      // A cache: the next call retries.
-    }
-    // `held` also writes a log read for one request (a settled build the view
-    // never tracks as work), so its cold full read is paid once.
-    const candidates = opts.held === true ? [...this.logs.keys()] : [...this.work]
-    const slugs = candidates.filter((slug) => {
-      const log = this.logs.get(slug)
-      return log !== undefined && log.cursor > log.persisted
-    })
-    let next = 0
-    const worker = async (): Promise<void> => {
-      while (next < slugs.length) {
-        const slug = slugs[next++]!
-        try {
-          await this.build(slug, async () => {
-            const log = this.logs.get(slug)
-            if (log !== undefined) await this.persistLog(slug, log)
-          })
-        } catch {
-          // A cache: the next call retries.
+      let window = this.windows.get(slug)
+      if (!window || sinceSeq < window.from) {
+        const events = await this.backing.getEvents(slug, sinceSeq)
+        window = {
+          from: sinceSeq,
+          cursor: Math.max(sinceSeq, events.at(-1)?.seq ?? 0),
+          events,
+          epoch: this.epoch,
+          dirty: false,
         }
-      }
-    }
-    await Promise.all(Array.from({ length: Math.min(PERSIST_CONCURRENCY, slugs.length) }, worker))
-  }
-
-  /** Drop retained events at or below `minCursor` for a windowed source — the
-   * wake pass calls this once its sessions have consumed them. Only sources
-   * that carry reduced state for what they drop can be trimmed. */
-  releaseWindowsBelow(source: WindowSource, minCursor: number): void {
-    if (source === 'journal') {
-      const window = this.journalWindow
-      if (window === undefined || minCursor <= window.from) return
-      window.events = window.events.filter((event) => event.seq > minCursor)
-      window.from = minCursor
-      window.last = Math.max(window.last, minCursor)
-      return
-    }
-    const log = this.logs.get(source.build)
-    if (log === undefined || log.acc === undefined || this.work.has(source.build)) return
-    if (minCursor <= log.from) return
-    log.events = log.events.filter((event) => event.seq > minCursor)
-    log.from = minCursor
-  }
-
-  async listBuilds(): Promise<BuildRecord[]> {
-    await this.ensureInit()
-    if (this.recordsDirty) await this.refreshRecords()
-    return this.records.map((record) => structuredClone(record))
-  }
-
-  async getRepoBuildDigests(repo: string): Promise<Map<string, BuildDigest>> {
-    if (repo !== this.repo) return this.backing.getRepoBuildDigests(repo)
-    const records = (await this.listBuilds()).filter((record) => record.repo === repo)
-    const missing = (): boolean =>
-      records.some((record) => !this.work.has(record.slug) && !this.discovery.has(record.slug))
-    if (this.discoveryDirty || missing()) await this.refreshDiscovery()
-    const digests = new Map<string, BuildDigest>()
-    for (const record of records) {
-      const slug = record.slug
-      const digest = await this.build(slug, async () => {
-        // A log invalidated by an own write resolves before it feeds a digest.
-        const held = this.logs.get(slug)
-        if (held?.dirty === true) await this.ensureCurrent(slug, held)
-        const log = this.logs.get(slug)
-        if (
-          this.work.has(slug) &&
-          log !== undefined &&
-          (log.from === 0 || log.extra !== undefined)
-        ) {
-          return { slug, ...this.digestOf(slug, log) }
+        this.windows.set(slug, window)
+      } else if (window.dirty || window.epoch !== this.epoch) {
+        let delta = await this.backing.getEvents(slug, window.cursor)
+        if (delta.some((event, index) => event.seq !== window!.cursor + index + 1)) {
+          delta = await this.backing.getEvents(slug, window.from)
+          window.events = []
         }
-        return this.discovery.get(slug)
-      })
-      if (digest !== undefined) digests.set(slug, digest)
-    }
-    return digests
+        window.events.push(...delta)
+        window.cursor = delta.at(-1)?.seq ?? window.cursor
+        window.epoch = this.epoch
+        window.dirty = false
+      }
+      return structuredClone(window.events.filter((event) => event.seq > sinceSeq))
+    })
   }
-
-  // ── Repository journal reads ───────────────────────────────────────────────
-
   async getRepoEvents(
     repo: string,
     sinceSeq = 0,
     opts?: { waitSeconds?: number; signal?: AbortSignal },
   ): Promise<RepositoryEvent[]> {
-    if (repo !== this.repo || opts?.waitSeconds !== undefined || opts?.signal !== undefined) {
+    if (repo !== this.repo || opts?.waitSeconds !== undefined || opts?.signal !== undefined)
       return this.backing.getRepoEvents(repo, sinceSeq, opts)
-    }
-    await this.ensureInit()
     return this.journalChain.run(async () => {
-      await this.syncJournal()
-      if (!this.recorded) return this.backing.getRepoEvents(repo, sinceSeq)
       let window = this.journalWindow
-      if (window === undefined || sinceSeq < window.from) {
+      if (!window || sinceSeq < window.from) {
         const events = await this.backing.getRepoEvents(repo, sinceSeq)
         window = {
           from: sinceSeq,
+          cursor: Math.max(sinceSeq, events.at(-1)?.seq ?? 0),
           events,
-          last: Math.max(sinceSeq, events.at(-1)?.seq ?? 0),
+          epoch: this.epoch,
+          dirty: false,
         }
         this.journalWindow = window
-        // Anything newer than the cursor feeds the bounded subset too.
-        this.foldJournal(events)
+      } else if (window.dirty || window.epoch !== this.epoch) {
+        let delta = await this.backing.getRepoEvents(repo, window.cursor)
+        if (delta.some((event, index) => event.seq !== window!.cursor + index + 1)) {
+          delta = await this.backing.getRepoEvents(repo, window.from)
+          window.events = []
+        }
+        window.events.push(...delta)
+        window.cursor = delta.at(-1)?.seq ?? window.cursor
+        window.epoch = this.epoch
+        window.dirty = false
       }
-      return window.events.filter((event) => event.seq > sinceSeq)
+      return structuredClone(window.events.filter((event) => event.seq > sinceSeq))
     })
   }
-
-  async getRepoStateEvents(repo: string): Promise<RepositoryEvent[]> {
-    if (repo !== this.repo) return this.backing.getRepoStateEvents(repo)
-    await this.ensureInit()
-    return this.journalChain.run(async () => {
-      await this.syncJournal()
-      if (!this.recorded) return this.backing.getRepoStateEvents(repo)
-      return [...this.journal]
-    })
+  getRepoStateEvents(repo: string): Promise<RepositoryEvent[]> {
+    return this.backing.getRepoStateEvents(repo)
+  }
+  getReducerValue(scope: SnapshotScope, request: ReducerValueRequest): Promise<ReducerValue> {
+    return this.backing.getReducerValue(scope, request)
   }
-
   getReducerSnapshot(
     scope: SnapshotScope,
-    reducer: string,
+    name: string,
     version: number,
   ): Promise<ReducerSnapshot | null> {
-    return this.backing.getReducerSnapshot(scope, reducer, version)
+    return this.backing.getReducerSnapshot(scope, name, version)
   }
-
   putReducerSnapshot(
     scope: SnapshotScope,
-    reducer: string,
+    name: string,
     snapshot: ReducerSnapshot,
   ): Promise<boolean> {
-    return this.backing.putReducerSnapshot(scope, reducer, snapshot)
+    return this.backing.putReducerSnapshot(scope, name, snapshot)
   }
-
-  async getRepoHighWater(repo: string): Promise<number> {
+  getRepoHighWater(repo: string): Promise<number> {
     return this.backing.getRepoHighWater(repo)
   }
-
-  // ── Writes: delegate, then fold ────────────────────────────────────────────
-
-  /** Fold an own build append on the build's chain, after any read in flight:
-   * contiguous folds in place, a gap (a foreign append interleaved) marks the
-   * log dirty so the next read deltas. */
-  private foldBuildAppend(slug: string, envelope: AbEvent): Promise<void> {
-    return this.build(slug, async () => {
-      this.recordsDirty = true
-      const log = this.logs.get(slug)
-      if (log === undefined) {
-        // An append to a build the view holds no log for may change its digest.
-        this.discoveryDirty = true
-        return
-      }
-      if (envelope.seq <= log.cursor) return
-      if (envelope.seq === log.cursor + 1) this.fold(log, [envelope])
-      else log.dirty = true
-    })
+  // Raw windows are owned by their cursor consumers, and values persist at the adapter boundary.
+  releaseWindowsBelow(source: WindowSource, minCursor: number): void {
+    const trim = <E extends { seq: number }>(window: RawWindow<E> | undefined): void => {
+      if (!window || minCursor <= window.from) return
+      window.events = window.events.filter((event) => event.seq > minCursor)
+      window.from = minCursor
+      window.cursor = Math.max(window.cursor, minCursor)
+    }
+    if (source === 'journal') trim(this.journalWindow)
+    else trim(this.windows.get(source.build))
   }
 
-  /** Fold an own journal append on the journal chain. A seq gap means a foreign
-   * append interleaved: repair it now, because stages snapshot the journal
-   * synchronously through `recordedJournal()` and must see our own write. */
-  private foldJournalAppend(envelope: RepositoryEvent): Promise<void> {
-    return this.journalChain.run(async () => {
-      // Before the cold load there is no journal state to extend; it reads the
-      // journal, this append included.
-      if (!this.initialized && !this.journalReady) return
-      this.recorded = true
-      if (envelope.seq <= this.journalCursor) return
-      if (envelope.seq === this.journalCursor + 1) {
-        this.foldJournal([envelope])
-        return
-      }
-      this.journalDirty = true
-      await this.syncJournal()
-    })
+  private foldBuildAppend(slug: string, event: AbEvent): void {
+    const window = this.windows.get(slug)
+    if (!window || event.seq <= window.cursor) return
+    if (event.seq !== window.cursor + 1) {
+      window.dirty = true
+      return
+    }
+    window.events.push(event)
+    window.cursor = event.seq
+  }
+  private invalidate(slug?: string): void {
+    this.recordsDirty = true
+    if (slug) this.dirtyDigests.add(slug)
   }
-
   async createBuild(input: NewBuildInput): Promise<BuildRecord> {
     const record = await this.backing.createBuild(input)
-    this.recordsDirty = true
-    if (record.repo === this.repo) {
-      await this.build(record.slug, async () => {
-        await this.loadFull(record.slug)
-        this.work.add(record.slug)
-      })
-    }
+    this.invalidate(input.slug)
     return record
   }
-
-  async append<T extends EventType>(slug: string, event: EventWrite<T>): Promise<EventEnvelope<T>> {
-    const envelope = await this.backing.append(slug, event)
-    await this.foldBuildAppend(slug, envelope as unknown as AbEvent)
-    return envelope
+  append<T extends EventType>(slug: string, event: EventWrite<T>): Promise<EventEnvelope<T>> {
+    return this.build(slug, async () => {
+      const result = await this.backing.append(slug, event)
+      this.foldBuildAppend(slug, result as AbEvent)
+      this.invalidate(slug)
+      return result
+    })
   }
-
-  async appendIfCurrent<T extends EventType>(
+  appendIfCurrent<T extends EventType>(
     slug: string,
     expectedSeq: number,
     event: EventWrite<T>,
   ): Promise<EventEnvelope<T> | null> {
-    const envelope = await this.backing.appendIfCurrent(slug, expectedSeq, event)
-    if (envelope === null) {
-      await this.build(slug, async () => {
-        const log = this.logs.get(slug)
-        if (log !== undefined) log.dirty = true
-      })
-      return null
-    }
-    await this.foldBuildAppend(slug, envelope as unknown as AbEvent)
-    return envelope
+    return this.build(slug, async () => {
+      const result = await this.backing.appendIfCurrent(slug, expectedSeq, event)
+      if (result) this.foldBuildAppend(slug, result as AbEvent)
+      else {
+        const window = this.windows.get(slug)
+        if (window) window.dirty = true
+      }
+      this.invalidate(slug)
+      return result
+    })
   }
-
-  async appendWithArtifacts<T extends EventType>(
+  appendWithArtifacts<T extends EventType>(
     slug: string,
     artifacts: ArtifactInput[],
     makeEvent: (deposited: ArtifactMeta[]) => EventWrite<T>,
   ): Promise<{ event: EventEnvelope<T>; artifacts: ArtifactMeta[] }> {
-    const result = await this.backing.appendWithArtifacts(slug, artifacts, makeEvent)
-    await this.foldBuildAppend(slug, result.event as unknown as AbEvent)
-    return result
+    return this.build(slug, async () => {
+      const result = await this.backing.appendWithArtifacts(slug, artifacts, makeEvent)
+      this.foldBuildAppend(slug, result.event as AbEvent)
+      this.invalidate(slug)
+      return result
+    })
+  }
+  private async foldJournalAppend(event: RepositoryEvent): Promise<void> {
+    const window = this.journalWindow
+    if (window && event.seq > window.cursor) {
+      if (event.seq === window.cursor + 1) {
+        window.events.push(event)
+        window.cursor = event.seq
+      } else window.dirty = true
+    }
+    await this.refreshJournal()
   }
-
   async appendRepo<T extends RepositoryEventType>(
     repo: string,
     event: RepositoryEventWrite<T>,
   ): Promise<RepositoryEventEnvelope<T>> {
-    const envelope = await this.backing.appendRepo(repo, event)
-    if (repo === this.repo) await this.foldJournalAppend(envelope as unknown as RepositoryEvent)
-    return envelope
+    const result = await this.backing.appendRepo(repo, event)
+    if (repo === this.repo) await this.foldJournalAppend(result as RepositoryEvent)
+    return result
   }
-
   async appendRepoWithArtifacts<T extends RepositoryEventType>(
     repo: string,
     artifacts: ArtifactInput[],
     makeEvent: (deposited: RepositoryArtifactMeta[]) => RepositoryEventWrite<T>,
   ): Promise<{ event: RepositoryEventEnvelope<T>; artifacts: RepositoryArtifactMeta[] }> {
     const result = await this.backing.appendRepoWithArtifacts(repo, artifacts, makeEvent)
-    if (repo === this.repo) await this.foldJournalAppend(result.event as unknown as RepositoryEvent)
+    if (repo === this.repo) await this.foldJournalAppend(result.event as RepositoryEvent)
     return result
   }
-
   async claimLease(slug: string, holder: string, ttlMs: number): Promise<boolean> {
-    const claimed = await this.backing.claimLease(slug, holder, ttlMs)
-    this.recordsDirty = true
-    return claimed
+    const result = await this.backing.claimLease(slug, holder, ttlMs)
+    this.invalidate()
+    return result
   }
-
   async heartbeat(slug: string, holder: string): Promise<boolean> {
-    const beat = await this.backing.heartbeat(slug, holder)
-    this.recordsDirty = true
-    return beat
+    const result = await this.backing.heartbeat(slug, holder)
+    this.invalidate()
+    return result
   }
-
   async releaseLease(slug: string, holder: string): Promise<void> {
     await this.backing.releaseLease(slug, holder)
-    this.recordsDirty = true
+    this.invalidate()
   }
-
-  async ensureRepo(repo: string): Promise<RepositoryRecord> {
+  ensureRepo(repo: string): Promise<RepositoryRecord> {
     return this.backing.ensureRepo(repo)
   }
-
   // ── Plain delegation ───────────────────────────────────────────────────────
 
   scopeBuild(slug: string): BuildScopedStore {
@@ -1327,6 +476,16 @@ export class RepoViewStore implements BuildStore {
   ): Promise<TicketAssetMeta | null> {
     return this.backing.removeTicketAsset(repo, ticketId, kind, name)
   }
+  beginRepoTick(repo: string, holder: string) {
+    return this.backing.beginRepoTick(repo, holder)
+  }
+  async finishRepoTick(...args: Parameters<BuildStore['finishRepoTick']>) {
+    const result = await this.backing.finishRepoTick(...args)
+    if (result && args[0] === this.repo) {
+      for (const event of result.events) await this.foldJournalAppend(event)
+    }
+    return result
+  }
   claimRepoLease(repo: string, holder: string, ttlMs: number): Promise<boolean> {
     return this.backing.claimRepoLease(repo, holder, ttlMs)
   }
@@ -1406,32 +565,3 @@ export class RepoViewStore implements BuildStore {
     return this.backing.close()
   }
 }
-
-/** Cheap structural checks on a stored accumulator: a snapshot that fails one
- * is a miss. They guard a hand-edited or truncated row; a well-formed row of the
- * right version is the reducer's own output. */
-function buildAccShape(snapshot: ReducerSnapshot): boolean {
-  const state = snapshot.state
-  return (
-    isObject(state) && Array.isArray(state.openEscalations) && Array.isArray(state.observations)
-  )
-}
-
-function indexAccShape(state: unknown): boolean {
-  return (
-    isObject(state) &&
-    Array.isArray(state.candidates) &&
-    isObject(state.maxRoundEver) &&
-    Array.isArray(state.guidanceDeliveries)
-  )
-}
-
-/** Events are a contiguous run starting right after `cursor`. */
-function contiguousFrom(events: readonly { seq: number }[], cursor: number): boolean {
-  let expected = cursor + 1
-  for (const event of events) {
-    if (event.seq !== expected) return false
-    expected += 1
-  }
-  return true
-}