@defrex/autobuild 0.13.0 → 0.14.0

package/README.md

@@ -24,7 +24,7 @@ needs an authenticated [`gh` CLI](https://cli.github.com) or an exported
 <!-- release-install:start -->
 
 ```sh
-bun add -g @defrex/autobuild@0.13.0
+bun add -g @defrex/autobuild@0.14.0
 ```
 
 <!-- release-install:end -->

package/SPEC.md

@@ -457,7 +457,7 @@ builds       id/slug, ticket ref, repo, branch, status (derived), created/update
              lease + heartbeat (mutable liveness columns — §15.2.6, never events)
 events       build_id, seq, timestamp, actor, type, payload (JSON)   — append-only
 artifacts    build_id, kind, revision, blobRef, metadata
-repo_streams repo, created/updated, lease + heartbeat
+repo_streams repo, created/updated, lease + heartbeat, bounded tick observation
 repo_events  repo, seq, timestamp, actor, type, payload (JSON) — append-only
 repo_artifacts repo, kind, revision, blobRef, metadata
 ticket_assets repo, ticket_id, kind, name, revision, layout, manifest (JSON), size,
@@ -1926,6 +1926,24 @@ head (or an explicit commit) to a deterministic operator branch and a pull
 request against the base branch and records published/publish-failed journal
 facts.
 
+Successful dispatcher ticks with no effects, counters, diagnostics, queue change,
+or attention transition append no tick boundary events. The first queue baseline,
+failed ticks, meaningful ticks, diagnostic clearing, failure recovery, and the
+first retry after a source cooldown remain recorded. Recorded starts may arrive
+with completion; optional `startedAt` preserves the actual start time, falling
+back to envelope time for historical journals.
+
+Repository tick telemetry is bounded mutable operational metadata, like leases.
+`beginRepoTick` persists the open boundary before unsafe work; `finishRepoTick`
+atomically replaces it with actual completion time and outcome and appends any
+validated tick boundaries. Both are fenced by the unexpired repository lease,
+and neither renews it. Quiet completions advance telemetry without advancing the
+journal. Readers refresh telemetry independently of event cursors, correlate it
+by run, and merge with historical completions by actual time; heartbeat never
+stands in for tick completion. Telemetry survives lease release. Safe shutdown
+uses the matching run's open observation, historical journal boundaries when
+absent, and refuses forced termination when the observation cannot be read.
+
 The operator's job across many concurrent builds: see status at a glance,
 act on a selected build, find blocked builds, answer escalations, and inspect
 any build's trail. Each dashboard build row spends its header on identity and

package/bin/ab-dispatch-kernel.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import { readDispatcherRunFacts } from '../packages/core/src/store/reduced-reads'
 /** Private, shipped child for the interactive `ab dispatch` kernel. It owns no
  * terminal handles; the public command launches it with immutable options. */
 import { abDispatch } from '../packages/core/src/cli/dispatch'
@@ -61,12 +62,9 @@ try {
     const opened = openStoreForRepoState(state, { env: process.env })
     try {
       await opened.store.ensureRepo(state.repo)
-      const events = await opened.store.getRepoEvents(state.repo)
-      if (
-        !events.some(
-          (event) => event.type === 'dispatcher.run-stopped' && event.payload.run === options.run,
-        )
-      ) {
+      const facts = (await readDispatcherRunFacts(opened.store, state.repo, options.run, false))
+        .value
+      if (!facts.stop) {
         await opened.store.appendRepo(state.repo, {
           actor: DISPATCHER,
           type: 'dispatcher.run-stopped',

package/docs/architecture.md

@@ -145,9 +145,9 @@ by a later advance. Each reducer publishes a `version`; bump it whenever the
 accumulator shape or the fold semantics change, because a cached accumulator is
 only valid for the version that wrote it. `kernel/reducer-registry.ts` lists
 every reducer with its version, and its snapshot test fails when an accumulator
-shape changes without a bump. Most callers still read whole logs (the terminal
-dashboard poll advances a carried build accumulator by per-build deltas; the
-dispatcher view below restores from stored accumulators).
+shape changes without a bump. Current-state consumers use the typed persisted
+read helpers in `store/reduced-reads.ts`; whole-array reducers remain pure
+reference projections for tests and explicit historical output.
 
 **Reducer snapshots.** The `BuildStore` port can keep, per scope (one build log
 or the repository journal) and registered reducer, that reducer's accumulator as
@@ -173,72 +173,86 @@ reads every snapshot as missing and replays (SQLSTATE `42P01` is never an
 error), and an older client never asks. Run `bun run postgres:migrate` once to
 gain the table; until then the dispatcher and every other reader replay in full.
 
-**Dispatcher repository view.** A dispatcher process builds its view of the
-repository once and refreshes it by deltas
-(`packages/core/src/processes/repo-view.ts`). `RepoViewStore` decorates the
-`BuildStore` port: the first `refresh()` reads the journal's high-water mark
-(`getRepoHighWater`), the bounded journal subset, the build listing and digests,
-and the full log of every build that still has work (the same predicate the tick
-loops use); every later `refresh()` reads only events newer than its cursors —
-one journal delta, one delta per held build, plus the listing and digest reads
-that discover new builds. Every tick stage reads and writes through the view, so
-an event a stage appends is folded in at once and later stages in the same tick
-see it with no re-read; a foreign append interleaved with ours leaves a seq gap
-that marks the log dirty, a lost compare-and-set does the same, and any delta
-that is not contiguous from its cursor discards the log and re-reads it in full,
-so no event is skipped. Every state transition of one source (a build, the
-journal) runs on that source's single promise chain — snapshot and delta reads,
-window opening and widening, the fold after an own append, a lost
-compare-and-set's invalidation — and readers queue on it too, so overlapping
-readers join the repair in flight instead of observing half-applied state.
-Decisions that deliberately re-read at the last moment
-(`refreshBuild`) take an explicit delta. Cursor-bearing readers such as the
-orchestrator wake pass get per-source windows that hold only events above the
-lowest session cursor. A `--once` invocation builds the view cold and reads each
-log once; a long-running dispatcher pays that replay at its first tick and not
-again.
-
-The view restores from reducer snapshots on cold start. The journal comes from
-the `journalView` reducer (the journal pruned on arrival: durable types plus the
-tail from the latest `dispatcher.run-started`); each work build comes from one
-`work` snapshot row — the `build`, `logIndex`, `openExecution`,
-`openBuildWorkspace`, `publicationState`, `lastExecutionOutcome`, `buildDigest`,
-`dashboardFacts` and `currentDeferralObservation` accumulators at a single
-cursor. One row is one atomic write on every adapter, so a reader in another
-process sees the old bundle or the new, never a mix; the bundle version is
-derived from the component reducer versions, so a stale bundle misses and the
-build is replayed once. The view
-reads only the events newer than that cursor and holds, for a snapshot-backed
-build, just that delta plus the reduced state of everything before it, so a tick
-with no new events reads zero event rows (apart from the discovery listing and
-digests) and one with M new events reads exactly M. Tick stages that run for every
-build each tick take `buildFacts(slug)` (state, log index, open execution, open
-workspace, publication view) instead of the event array, and read raw history
-only on the branches that act on it. `persistSnapshots()` writes the advanced
-state back at the end of each tick and on shutdown — best effort, throttled in a
-resident dispatcher, always run by a cold single-tick process — and never writes
-a cursor that was not read from the log.
-
-**Operator reads.** The web dashboard, the repository and Harvest status
-routes, the operator build listings, and the `ab watch`/`ab wait` discovery
-passes derive from that same view instead of replaying the log
-(`packages/core/src/operator/read-view.ts`). A dashboard row renders from the
-`BuildState` plus the `dashboardFacts` reducer
-(`packages/core/src/cli/dashboard/facts.ts`: queued-row dispatch text, session
-brackets, phase intervals, pause time, and the per-round loop-output seqs) and
-the auto-merge deferral ledger; `projectBuild(…, events)` is the same projection
-over the whole-array reduction, so the snapshot and replay paths cannot differ.
-Within one serving process, passes are single-flight per repository: requests
-arriving while a pass runs join the one trailing pass, which restores from the
-snapshot the previous pass persisted. A poll at idle therefore reads no event
-rows beyond snapshot lookups and build discovery, and a poll after M new events
-reads those M rows once, however many tabs or watchers the process serves.
-Serving processes do not coordinate: with P of them, each may read the same M
-rows once, so duplicate reads are bounded by P and never by history, tabs, or
-watchers. A settled build listed under `--all` is restored from the snapshot the
-dispatcher left at settlement, or read once and then persisted. The first
-operator poll after upgrading replays each work build once, because the stored
-bundle layout changed.
+**Named reducer values.** `BuildStore.getReducerValue(scope, {reducer, args?})`
+returns `{version, cursor, value}` for each eligible entry in the executable
+reducer registry. Eligible reducers consume build or repository events and finish
+as plain JSON; raw journal-event lists, operator-session reducers, collections,
+selector functions, and top-level optional results are explicitly excluded with
+reasons. Factory arguments are validated and participate in a bounded digest
+cache key. The persisted envelope also records the canonical scope, arguments,
+name and version, and nested accumulator shapes are validated before restore.
+The `value.*` namespace is reserved: public snapshot reads and writes reject it,
+and the engine persists through private adapter hooks. Versioned cache keys
+exclude checkpoints produced while the old namespace was publicly writable.
+`tools/reducer-value-shapes.ts` regenerates those structural validators from the
+declared accumulator types.
+
+Memory, SQLite and Postgres use the same algorithm: capture the authoritative
+high-water, load persisted state on every call, fold the indexed contiguous delta
+through that boundary, persist, and return an independent JSON value. There is
+no process-local accumulator cache. A foreign checkpoint newer than the initial
+boundary causes a fresh high-water check. Normal writes are monotone; corrupt,
+wrong-version or ahead-of-log rows are repaired only by comparing the exact row
+observed, atomically with the log boundary. A losing writer still returns its
+correct prefix. Missing or unreadable cache state replays; log failures propagate.
+
+The remote adapter makes one value request; only the finished answer crosses the
+wire. The service uses named effective-configuration references for hosted ticket
+operations (including policy publication) and semantic build/harvest lifecycle
+facts for delegated authentication and issuance. Lifecycle snapshots keep session,
+execution and terminal evidence, including historical endings, without dispatcher
+tick tails. Anchor membership follows the contiguous log prefix. The legacy
+state-events route remains a deprecated compatibility endpoint. Public generic
+snapshot routes remain compatible, but current consumer reads do not restore the
+former dispatcher work bundles.
+
+**Dispatcher repository view.** `RepoViewStore`
+(`packages/core/src/processes/repo-view.ts`) coordinates repository metadata and
+source promise chains. Its build and journal facts come from persisted reduced
+values. Reads after an append or lost conditional append consult that boundary
+again, so no process-local memo suppresses a required delta. The adapter owns
+cache persistence and recovery; the view neither writes work bundles nor hydrates
+whole logs for decisions. Discovery uses persisted build digests, including for
+settled builds. Raw methods forward actual cursor event output.
+
+JSON-safe companion projections preserve collection and optional-value contracts.
+The build facts projection returns one prefix for engine routing; its log-index
+rounds and finalize steps reconstruct Maps and Sets explicitly, while publication
+selectors reconstruct from a JSON ledger. Repository facts retain configuration,
+control, Harvest, and dispatcher run correlations. Lease metadata and clocks stay
+outside event reducers: liveness combines durable run facts with the current
+repository record and observation time, including an older lease holder hidden
+by a newer run. The shared repository value keeps a bounded recent-run window, including the
+latest started and stopped runs. Fresh invocations use those shared facts for
+first-tick publication, liveness and supervision without creating a cold
+parameterized cache. Older holder correlations can use `dispatcherRunFacts` for
+the requested historical run. A never-started fresh invocation does not request
+historical correlation. Stopped dispatcher history is not copied into every
+current read.
+
+**Operator and CLI reads.** Build listings and details, repository and Harvest
+status, dispatcher decisions, operator API queries, MCP delegation and web
+dashboard refreshes use the same typed persisted read helpers. Shared projection
+functions render those facts; whole-array overloads remain reference oracles.
+Operator passes are single-flight per repository, with requests arriving during a
+pass queued for one trailing pass. Fresh readers use persisted cache rows too;
+steady-state event-row cost depends on newly appended events at fixed build/run
+cardinality, not on log length. Reduced collections may legitimately grow in JSON
+size. Cache loss or corruption can replay history once to recover the same answer.
+
+Watch and wait register from a compound persisted `buildStreamSeed` at cursor C.
+Its build accumulator, deferral ledger and insertion-ordered historical PR
+eligibility describe that same prefix. Ordinary polling, including the first
+batch on an old build, reads only events after the cursor and advances that seed
+event by event, preserving state at event N in each emitted record. Watch uses
+historical eligibility for baseline suppression; wait retains its separate
+current-attention registration policy. Only an explicit `--since` older than C
+reconstructs a historical prefix once in `cli/historical-build-state.ts`.
+Actual event listings, transcripts and cursor streams remain raw reads. The
+interactive terminal frontend retains its independently established incremental
+feed. `tools/persisted-reduced-reads.test.ts` scans production TypeScript calls
+and maintains precise, reason-bearing exceptions for these boundaries and pure
+reference projections; stale exceptions fail the check.
 
 **Session Store authority.** `packages/core/src/cli/binary.ts` validates a complete build or
 Harvest ambient tuple before opening its phase Store through
@@ -387,7 +401,19 @@ SIGTERM restore terminal modes immediately and begin one supervised drain;
 persistent frontend and child handlers keep repeated signals graceful until the
 kernel child is reaped, after which a non-SIGINT terminating signal is replayed
 in the frontend. A parent-liveness watch remains the detached-kernel fallback.
-Timeout escalation is held while a durable `tick-started` fact remains open,
+The repository record carries constant-size, lease-holder-fenced tick telemetry:
+`beginRepoTick` opens the unsafe boundary, and `finishRepoTick` atomically closes
+it and appends selected tick facts. Successful unchanged ticks append nothing;
+queue transitions, counters, diagnostics, attention resets/retries, and failures
+retain their journal evidence. Buffered starts preserve actual `startedAt` for
+attention cooldowns; old starts use their envelope time. Liveness reads refresh
+the repository record even with an unchanged event cursor, merging matching-run
+completion samples with journal ticks. Heartbeat renewal cannot invent progress.
+The memory, SQLite, Postgres and remote adapters share this contract, including
+no mutation after lease expiry and no partial publication on validation failure.
+
+Timeout escalation is held while the matching repository tick observation is open
+(with historical `tick-started` journal fallback when no observation exists),
 because force-killing the ticket claim before build creation would not be
 recoverable. After a build child claims a takeover lease, it reduces one
 captured event prefix and appends transcriptless reclaimed `session.ended`

package/docs/hosted-service.md

@@ -17,8 +17,8 @@ package's `deployment/` directory and in `templates/hosted-service/`).
     "build": "ab-hosted-service-build"
   },
   "dependencies": {
-    "@defrex/autobuild-hosted-store-service": "0.13.0",
-    "@defrex/autobuild": "0.13.0",
+    "@defrex/autobuild-hosted-store-service": "0.14.0",
+    "@defrex/autobuild": "0.14.0",
     "next": "16.1.6",
     "react": "19.2.4",
     "react-dom": "19.2.4"

package/docs/operator-api.md

@@ -1,7 +1,7 @@
 # Operator API v1
 
 The hosted service exposes the polling-oriented operator surface at
-`/operator/v1/repos/{repo}`. It is versioned with remote store protocol **3**.
+`/operator/v1/repos/{repo}`. It is versioned with remote store protocol **4**.
 Every request must send `X-Autobuild-Version`,
 `X-Autobuild-Protocol-Version: 3`, and `Authorization: Bearer …`. Identity is
 checked before authentication or resource lookup.

package/docs/remote-store-protocol.md

@@ -37,7 +37,7 @@ headers, or available backend.
   `[store] url` (in that precedence order, before the local default); the shipped client appends the routes below.
 - Every `/builds`, `/repos`, and `/sessions` request sends
   `X-Autobuild-Version` with the exact client package version and
-  `X-Autobuild-Protocol-Version` with the remote protocol version (`3` in this
+  `X-Autobuild-Protocol-Version` with the remote protocol version (`4` in this
   distribution). Before authentication,
   body parsing, or resource lookup, the server validates the release-line window and known protocol identity.
   Unsupported or missing values receive `409 {"kind":"conflict","error":"…"}`;
@@ -355,6 +355,74 @@ part of this protocol. Retention is enforced server-side inside the store at
 deposit time (bounded pruning of dispatcher run/config artifact revisions),
 not through any endpoint.
 
+### Named reducer values
+
+`POST /builds/{slug}/reducer-values` and
+`POST /repos/{repo}/reducer-values` accept at most 4 KiB of JSON:
+
+```json
+{"reducer":"dispatchStatus","args":{"run":"run-a"}}
+```
+
+The response is `200 {"version":2,"cursor":123,"value":{...}}`. Only the
+finished JSON answer is returned, with no accumulator or raw-log bundle. `cursor`
+is the authoritative prefix included in the answer, not a guarantee to include
+appends concurrent with the request. Every call checks durable progress and
+persisted state; parallel instances may safely advance the same checkpoint.
+Snapshots are disposable caches: deletion, corruption, wrong versions and
+unreadable cache storage cause replay. Log read failures remain errors.
+
+The executable catalog is `kernel/reducer-registry.ts`. All requests reject
+unknown names, excluded reducers, wrong scopes and invalid/extra arguments with
+`400 validation`. A missing resource is `404`, project and delegated authority
+checks are the same as other reads, and unsupported methods remain unavailable.
+The operation is read-only authority even though its HTTP verb is POST and its
+internal cache may advance. It does not accept caller-supplied state. This is an
+additive protocol route: historical snapshot and event handlers and the supported
+client version window are unchanged.
+
+| Scope | Reducers with no arguments |
+| --- | --- |
+| Build | `executionNoProgress`, `summaryRequests`, `build`, `buildDigest`, `currentPrAttachments`, `pendingPrAttachmentReclaims`, `openExecution`, `lastExecutionOutcome`, `infrastructureFailureReset`, `openWorkspace`, `setupStreak`, `openBuildWorkspace`, `currentDeferralObservation`, `dashboardFacts`, `pinnedAssets`, `buildDelegation` |
+| Repository | `harvest`, `dispatchSettings`, `sandboxStates`, `openHarvestExecutions`, `autoMergeDefault`, `effectiveConfig`, `harvestDelegation` |
+
+| Reducer | Scope | Required arguments |
+| --- | --- | --- |
+| `dispatchStatus`, `openTick` | Repository | `run`: nonempty string |
+| `dispatchFailureBudget` | Build | `infrastructureOwnsWorkspace`: boolean |
+| `phaseFailures` | Build | `phase`: valid phase name; `round`: nonnegative integer |
+
+Arguments are canonicalized into the cache identity; variants never reuse one
+another's accumulator. `effectiveConfig` returns an object with optional `run`
+and `reference: {kind, rev}`. Absence is distinct from an unreadable referenced
+artifact. Delegation values contain semantic lifecycle facts indexed by prefixed
+identifiers, not authorization decisions; request time and grace expiry are
+always evaluated against those facts on the service.
+
+Each remaining registered reducer is explicitly excluded:
+
+| Reducers | Reason |
+| --- | --- |
+| `journalView`, `repositoryStateEvents`, `dispatchFrontend` | Raw repository event lists |
+| `session` | Operator-session log scope |
+| `publicationState` | Selector functions in finished value |
+| `logIndex` | Maps and Sets in finished value |
+| `hostedPrAttachments` | Map as finished value |
+| `summaryBoundary`, `ticketSourceHealth`, `frozenPrImageHost`, `publishedBranchHead`, `verifyDiffBase`, `recordedBaseSha`, `baseBranch`, `provisionMarker`, `recoveryCheckpoint` | Existing finished contract can return top-level `undefined`, which is not JSON |
+
+`GET /repos/{repo}/state-events` is **deprecated**. Its response remains unchanged
+for supported clients, including the current dispatcher run's event tail. It is
+the compatibility exception to flat event-row reads; new callers should request
+named values. The current product no longer loads or writes raw-tail snapshots.
+
+The `value.*` snapshot namespace is reserved for the adapter's private value
+checkpoint hooks. Public snapshot GET and PUT requests for this prefix return
+`400 validation`, including requests made with delegated or administrator
+credentials. Adapter snapshot APIs reject the same names. Ordinary snapshot
+names retain their existing behavior. The value cache key format is versioned;
+checkpoints from the former publicly writable format are ignored and rebuilt
+from the log after upgrading.
+
 ### Reducer snapshots
 
 A reducer snapshot is one registered reducer's serialized state as of a log
@@ -1136,7 +1204,7 @@ Four shipped behaviors do not add `BuildStore` routes:
   store lifecycle; there is no close endpoint.
 - `GET /health` is outside the `BuildStore` interface. It is always open and
   returns exactly `200 {"ok":true,"autobuildVersion":"<package>",
-  "protocolVersion":"3", "supportedClientRange":{"minVersion":"0.9.0",
+  "protocolVersion":"4", "supportedClientRange":{"minVersion":"0.9.0",
   "maxVersionExclusive":"0.12.0"}}`. It reports HTTP-process availability and identity,
   not a deeper backing-store transaction or migration check.
 
@@ -1213,3 +1281,17 @@ require a project credential and operate only on its own identity; admin and
 internal operator credentials cannot impersonate self-service. All protocol
 responses are no-store/no-referrer. Connection commands are unavailable in
 build/harvest sessions.
+
+### Repository tick telemetry (protocol 4)
+
+`POST /repos/:repo/tick/begin` accepts `{holder}` and returns the actual start
+ timestamp, or null when the unexpired repository lease does not match.
+`POST /repos/:repo/tick/finish` accepts `{holder, completion, events}`. Completion
+is `{outcome:"completed", counters}` or `{outcome:"failed", error}`; events is
+empty for a quiet success or a matching dispatcher start/terminal pair for that
+holder. The validated batch and finished telemetry commit atomically. The reply
+is `{observation, events}` with assigned envelopes, or null on fencing failure.
+These operations never renew the lease. Repository records optionally expose
+`tick: {run, open?: {startedAt}, finished?: {run, startedAt, completedAt, ...completion}}`.
+They retain the previous completion while a new tick is open and after lease
+release. Build and session credentials cannot mutate repository ticks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defrex/autobuild",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Agent-driven software delivery from groomed ticket to merged PR",
   "repository": {
     "type": "git",
@@ -114,6 +114,7 @@
     "docs"
   ],
   "scripts": {
+    "ab": "bun bin/ab.ts",
     "dev:cli": "bun --hot --no-clear-screen bin/ab-dev.ts",
     "capture:dashboard": "bun tools/dashboard-capture.ts",
     "capture:web-dashboard": "bun packages/web-dashboard-capture/src/web-dashboard-capture.tsx",
@@ -143,8 +144,8 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.5",
-    "@defrex/autobuild-postgres-store": "0.12.0",
-    "@defrex/autobuild-vercel-sandbox": "0.12.0",
+    "@defrex/autobuild-postgres-store": "0.14.0",
+    "@defrex/autobuild-vercel-sandbox": "0.14.0",
     "@resvg/resvg-js": "2.6.2",
     "@types/bun": "^1.3.14",
     "@types/node": "^24.0.0",

package/packages/core/src/cli/attention.ts

@@ -1,6 +1,10 @@
 import type { AbEvent } from '../events/catalog'
 import type { RepositoryEvent } from '../events/repository'
-import { currentAutoMergeDeferral } from '../kernel/auto-merge'
+import {
+  currentDeferralObservationReducer,
+  mergeAttentionFromFacts,
+  type DeferralLedger,
+} from '../kernel/auto-merge'
 import { reduceBuild, type BuildState } from '../kernel/reducer'
 
 export interface MergeDecision {
@@ -17,22 +21,18 @@ export function mergeDecision(
   now: Date,
   state = reduceBuild(events),
 ): MergeDecision | null {
-  if (
-    !state.finalizeCompletedSeq ||
-    !state.pr ||
-    state.prState !== 'open' ||
-    state.status === 'done' ||
-    state.status === 'aborted'
-  )
-    return null
-  const deferral = currentAutoMergeDeferral(events, state)
-  if (state.autoMerge.requested && deferral === undefined) return null
-  return {
-    type: 'build.merge-decision',
-    pr: state.pr,
-    reason: deferral ?? 'Auto-merge is not armed',
-    observedAt: now.toISOString(),
-  }
+  return mergeDecisionFromFacts(state, currentDeferralObservationReducer.reduce(events), now)
+}
+
+export function mergeDecisionFromFacts(
+  state: BuildState,
+  ledger: DeferralLedger,
+  now: Date,
+): MergeDecision | null {
+  const decision = mergeAttentionFromFacts(state, ledger)
+  return decision
+    ? { type: 'build.merge-decision', ...decision, observedAt: now.toISOString() }
+    : null
 }
 
 export function buildNeedsAttention(events: AbEvent[], state: BuildState): boolean {
@@ -60,150 +60,4 @@ export function repositoryNeedsAttention(event: RepositoryEvent): boolean {
   }
 }
 
-type Degraded = Extract<RepositoryEvent, { type: 'dispatcher.ticket-source-degraded' }>
-type Failed = Extract<RepositoryEvent, { type: 'dispatcher.tick-failed' }>
-export type PersistenceObservation =
-  | {
-      type: 'dispatcher.ticket-source-persistent'
-      source: string
-      cause: string
-      message: string
-      resetAt?: string
-      episodeSeq: number
-      observedAt: string
-      dependencyLimited: boolean
-    }
-  | {
-      type: 'dispatcher.tick-failure-persistent'
-      run: string
-      firstFailure: string
-      error: string
-      episodeSeq: number
-      observedAt: string
-    }
-
-/** Incremental journal projection. Episode starts survive run anchors and
- * repeated evidence can strengthen, but never postpone, an existing deadline. */
-export class RepositoryAttention {
-  private sources = new Map<
-    string,
-    {
-      event: Degraded
-      deadline: number
-      dependencyLimited: boolean
-      requiresRetry: boolean
-      retryObserved: boolean
-    }
-  >()
-  private failure: Failed | undefined
-  private tickStarts = new Map<string, number>()
-
-  private sourceDefersTick(now: number): boolean {
-    return [...this.sources.values()].some(
-      (source) => now < source.deadline || (source.requiresRetry && !source.retryObserved),
-    )
-  }
-
-  /** Crossing resetAt alone does not prove persistence: the dispatcher must
-   * finish a tick that could actually retry after the provider cooldown. */
-  private observeRetry(run: string): void {
-    const startedAt = this.tickStarts.get(run)
-    this.tickStarts.delete(run)
-    if (startedAt === undefined) return
-    for (const source of this.sources.values()) {
-      if (startedAt >= source.deadline) source.retryObserved = true
-    }
-  }
-  fold(event: RepositoryEvent): void {
-    switch (event.type) {
-      case 'dispatcher.ticket-source-degraded': {
-        const existing = this.sources.get(event.payload.source)
-        const deadline =
-          'resetAt' in event.payload
-            ? Date.parse(event.payload.resetAt)
-            : Date.parse(event.ts) + 15 * 60_000
-        if (existing) {
-          existing.deadline = Math.min(existing.deadline, deadline)
-          existing.requiresRetry ||= 'resetAt' in event.payload
-        } else
-          this.sources.set(event.payload.source, {
-            event,
-            deadline,
-            dependencyLimited: false,
-            requiresRetry: 'resetAt' in event.payload,
-            retryObserved: false,
-          })
-        // Cooldown-driven failures are not an independent dispatcher outage.
-        if (this.sourceDefersTick(Date.parse(event.ts))) this.failure = undefined
-        break
-      }
-      case 'dispatcher.ticket-source-dependency-limited': {
-        const source = this.sources.get(event.payload.source)
-        if (source) source.dependencyLimited = true
-        break
-      }
-      case 'dispatcher.ticket-source-recovered':
-        this.sources.delete(event.payload.source)
-        break
-      case 'dispatcher.run-started':
-        this.failure = undefined
-        this.tickStarts.clear()
-        break
-      case 'dispatcher.run-stopped':
-        this.tickStarts.delete(event.payload.run)
-        if (this.failure?.payload.run === event.payload.run) this.failure = undefined
-        break
-      case 'dispatcher.tick-started':
-        this.tickStarts.set(event.payload.run, Date.parse(event.ts))
-        break
-      case 'dispatcher.tick-completed':
-        this.observeRetry(event.payload.run)
-        if (this.failure?.payload.run === event.payload.run) this.failure = undefined
-        break
-      case 'dispatcher.tick-failed':
-        this.observeRetry(event.payload.run)
-        if (this.sourceDefersTick(Date.parse(event.ts))) this.failure = undefined
-        else if (this.failure?.payload.run !== event.payload.run) this.failure = event
-        break
-    }
-  }
-  pending(now: Date): { identity: string; observation: PersistenceObservation }[] {
-    const results: { identity: string; observation: PersistenceObservation }[] = []
-    for (const {
-      event,
-      deadline,
-      dependencyLimited,
-      requiresRetry,
-      retryObserved,
-    } of this.sources.values()) {
-      if (now.getTime() < deadline || (requiresRetry && !retryObserved)) continue
-      results.push({
-        identity: `source:${event.seq}`,
-        observation: {
-          type: 'dispatcher.ticket-source-persistent',
-          ...event.payload,
-          episodeSeq: event.seq,
-          observedAt: now.toISOString(),
-          dependencyLimited,
-        },
-      })
-    }
-    const event = this.failure
-    if (
-      event &&
-      !this.sourceDefersTick(now.getTime()) &&
-      now.getTime() >= Date.parse(event.ts) + 5 * 60_000
-    )
-      results.push({
-        identity: `tick:${event.seq}`,
-        observation: {
-          type: 'dispatcher.tick-failure-persistent',
-          ...event.payload,
-          firstFailure: event.ts,
-          episodeSeq: event.seq,
-          observedAt: now.toISOString(),
-        },
-      })
-    return results
-  }
-}
+export { RepositoryAttention, type PersistenceObservation } from '../kernel/repository-attention'