@defrex/autobuild 0.8.0 → 0.10.0

package/packages/core/src/processes/dispatcher.ts

@@ -37,17 +37,25 @@
  * execution lease before launch; the child renews that same-holder lease.
  */
 import type { Config } from '../config/schema'
+import type { LanguageModel } from 'ai'
+import { runOrchestratorTickStep } from './orchestrator-tick'
 import { DISPATCHER, agentActor, humanActor } from '../events/envelope'
+import { isRemoteWorkspace } from '../events/workspace-remote'
 import type { AbEvent, EventWrite } from '../events/catalog'
-import type { EventPayload } from '../events/payloads'
+import type { EventPayload, PinnedAsset } from '../events/payloads'
 import type { IdSource } from '../ids'
 import {
   autoMergeApplicationType,
   pendingAutoMerge,
   recordAutoMergeDeferralObservation,
 } from '../kernel/auto-merge'
+import {
+  autoMergeDefaultTarget,
+  latestAutoMergeDefault,
+  type AutoMergeDefaultFact,
+} from '../kernel/auto-merge-default'
 import { reduceDispatchSettings } from '../kernel/dispatch-settings'
-import { decideNext } from '../kernel/engine'
+import { decideNextFromFacts } from '../kernel/engine'
 import {
   DEFAULT_MAX_HARVEST_RECOVERY_ATTEMPTS,
   decideHarvestControl,
@@ -56,7 +64,8 @@ import {
 } from '../kernel/harvest'
 import { pendingPrAttachmentReclaims } from '../kernel/pr-attachments'
 import { reduceBuild, type BuildState } from '../kernel/reducer'
-import type { ArtifactRef } from '../ontology'
+import { createOperatorSandboxService, type OperatorSandboxService } from '../operator/sandbox'
+import type { ArtifactRef, TicketRef } from '../ontology'
 import { BUILD_EXECUTION_LEASE_TTL_MS } from '../ports/workspace/build-execution'
 import type {
   DependencyState,
@@ -66,16 +75,25 @@ import type {
   WorkspaceProvider,
 } from '../ports/types'
 import type { Exec } from '../ports/workspace/git-worktree'
-import type { ArtifactMeta, BuildRecord, BuildStore, Clock } from '../store/types'
+import type { ArtifactMeta, BuildDigest, BuildRecord, BuildStore, Clock } from '../store/types'
+import { samplePinnedAssets } from '../store/ticket-assets'
 import { resolveRepoOrigin } from '../cli/repo-state'
 import { specConformance } from '../spec-standard'
 export { specConformance, type SpecConformance } from '../spec-standard'
 import { recordInfrastructureFailure as appendInfrastructureFailure } from './infrastructure-failure-budget'
-import { lastExecutionOutcome, openExecution, settleExecution } from './execution-settlement'
+import { settleOpenExecution } from './execution-settlement'
 import { openHarvestExecutions } from './harvest-execution-state'
+import { isWorkDigest, RepoViewStore } from './repo-view'
+import {
+  baseBranchReducer,
+  openBuildWorkspace,
+  provisionMarkerReducer,
+  recoveryCheckpointReducer,
+  type OpenBuildWorkspace,
+  type ProvisionMarker,
+} from './dispatcher-selectors'
 import type { RepositoryEvent } from '../events/repository'
 import { sandboxStates } from './sandbox-state'
-import { abandonedPublicationPending, publicationPending } from './publication-state'
 import { settlePublicationBeforeRelease } from './publication-loss'
 
 // ── Readiness resolution (SPEC §3.3) ─────────────────────────────────────────
@@ -97,11 +115,22 @@ import { settlePublicationBeforeRelease } from './publication-loss'
  * is otherwise the directory, so it defaults to no label gate. Plugin sources
  * likewise receive no host-imposed label convention. An explicit
  * `readyLabels` wins for every source.
+ *
+ * `[tickets].readyAssignee` (Linear only) adds a third conjunctive gate: the
+ * ticket must be assigned to that user.
  */
-export function readyCriteria(config: Config): { labels: string[]; state: string } {
-  const { readyLabels, readyState } = config.tickets
+export function readyCriteria(config: Config): {
+  labels: string[]
+  state: string
+  assignee?: string
+} {
+  const { readyLabels, readyState, readyAssignee } = config.tickets
   if (config.tickets.source === 'linear') {
-    return { labels: readyLabels ?? ['autobuild'], state: readyState }
+    return {
+      labels: readyLabels ?? ['autobuild'],
+      state: readyState,
+      ...(readyAssignee !== undefined ? { assignee: readyAssignee } : {}),
+    }
   }
   return { labels: readyLabels ?? [], state: readyState }
 }
@@ -349,6 +378,11 @@ export interface TickReport {
   sandboxIdleStops: number
   /** Contained idle-settlement failures this tick; retried next tick. */
   sandboxSettleFailures: number
+  /** Contained sandbox-backend construction failures this tick (AUT-584):
+   * deterministic and config-shaped, so it re-reports every tick until the
+   * config is repaired. The affected tick runs with sandbox tools filtered
+   * exactly as when no backend exists. */
+  orchestratorSandboxFailures: number
 }
 
 export function emptyTickReport(): TickReport {
@@ -385,6 +419,7 @@ export function emptyTickReport(): TickReport {
     harvestFailed: 0,
     sandboxIdleStops: 0,
     sandboxSettleFailures: 0,
+    orchestratorSandboxFailures: 0,
   }
 }
 
@@ -452,6 +487,10 @@ export interface TickOpts {
    * escalations remain human gates and are only reported as parked.
    */
   resumeCurrent?: boolean
+  /** The caller refreshed the repository view for this tick already (the CLI
+   * does, to sample the repository-wide controls from the same state). The
+   * tick then skips its own refresh so one tick performs one discovery read. */
+  viewRefreshed?: boolean
   /**
    * Repository-derived intake gate supplied by the CLI for this tick. False
    * skips only the ready-ticket list/claim/dispatch stage; janitor, startup
@@ -534,6 +573,11 @@ export interface DispatcherDeps {
    * supplies cancellation and treats every absence/failure/invalid result as a
    * local deterministic fallback, so naming can never prevent build creation. */
   nameSlug?: (spec: string, signal: AbortSignal) => Promise<string | null>
+  /** The orchestrator turn runner's language model, injected for tests. When
+   * absent the configured gateway model is resolved in process (AUT-342);
+   * the step itself only ever constructs in origin mode with the orchestrator
+   * enabled, so a local dispatcher never resolves a model. */
+  orchestratorModel?: LanguageModel
   /** Settle pending publication for `slug` after durable proof that the
    * guest execution ended. Supplied by the DispatchLoop; the settlement stage
    * invokes it only on a recorded completion. */
@@ -553,30 +597,14 @@ export interface DispatcherDeps {
 /** Latest `workspace.provisioned` not followed by a `workspace.released` —
  * the reducer deliberately ignores workspace events (liveness is the
  * dispatcher's concern), so the janitor scans the raw log. */
-function openWorkspace(
-  events: AbEvent[],
-): { provider: string; ref: string; path?: string; localPath?: string; branch: string } | null {
-  let open: {
-    provider: string
-    ref: string
-    path?: string
-    localPath?: string
-    branch: string
-  } | null = null
-  for (const event of events) {
-    if (event.type === 'workspace.provisioned') open = event.payload
-    else if (event.type === 'workspace.released') open = null
-  }
-  return open
+function openWorkspace(events: AbEvent[]): OpenBuildWorkspace | null {
+  return openBuildWorkspace(events)
 }
 
 /** The build's base branch, from its own `build.created` fact (§15.3);
  * falls back to the repo config for logs missing one. */
 function baseBranchOf(events: AbEvent[], config: Config): string {
-  for (const event of events) {
-    if (event.type === 'build.created') return event.payload.baseBranch
-  }
-  return config.baseBranch
+  return baseBranchReducer.reduce(events) ?? config.baseBranch
 }
 
 function artifactRefOf(deposited: ArtifactMeta[]): ArtifactRef {
@@ -634,7 +662,27 @@ export class Dispatcher {
    * slug here defers to the continuation; it never blocks on it. */
   private readonly continuations = new Map<string, ProvisionContinuation>()
 
+  /** The incremental repository view every stage reads and writes through
+   * (AUT-647): `deps.store` itself when the caller already wrapped it. */
+  private readonly store: RepoViewStore
+
+  /** `deps.settlePublication`, followed by a delta read of the build: the
+   * guest-side settlement appends through its own store handle, which the view
+   * only learns of by reading. */
+  private get settlePublication(): ((slug: string) => Promise<void>) | undefined {
+    const settle = this.deps.settlePublication
+    if (settle === undefined) return undefined
+    return async (slug) => {
+      await settle(slug)
+      await this.store.refreshBuild(slug)
+    }
+  }
+
   constructor(private readonly deps: DispatcherDeps) {
+    this.store =
+      deps.store instanceof RepoViewStore
+        ? deps.store
+        : new RepoViewStore(deps.store, { repo: deps.repo })
     this.leaseTtlMs = deps.opts?.leaseTtlMs ?? 0
     this.doneState = deps.opts?.doneState ?? 'Done'
     this.slugNamingTimeoutMs = deps.opts?.slugNamingTimeoutMs ?? DEFAULT_SLUG_NAMING_TIMEOUT_MS
@@ -658,9 +706,21 @@ export class Dispatcher {
   }
 
   async tick(opts: TickOpts = {}): Promise<TickReport> {
+    try {
+      return await this.runTick(opts)
+    } finally {
+      // Leave this tick's reduced state behind for the next process (a cache;
+      // a failure to write it is never a tick failure). Throttled in a
+      // resident dispatcher, always run by a cold single-tick process.
+      await this.store.persistSnapshots()
+    }
+  }
+
+  private async runTick(opts: TickOpts): Promise<TickReport> {
     // One immutable config for this complete decision pass. A reload racing the
     // tick is observed by the next tick, never half-way through this one.
     this.deps.config = this.deps.getConfig?.() ?? this.deps.config
+    if (opts.viewRefreshed !== true) await this.store.refresh()
     let autoMergeUser: string | undefined
     if (opts.defaultAutoMerge === true) {
       autoMergeUser = opts.autoMergeUser?.trim()
@@ -672,11 +732,23 @@ export class Dispatcher {
     /** Builds already launched this tick — a janitor/startup re-attach must
      * not be doubled by the sweep, nor a fresh dispatch by anything. */
     const launched = new Set<string>()
-    // Sampled once, before any stage that could attach a runner: a pause that
-    // lands mid-tick takes effect on the next tick, matching intake (which the
-    // CLI likewise samples before calling `tick`). Neither control pretends to
-    // a serialization the store does not offer.
-    const paused = await this.repositoryPaused()
+    // One journal read for both repository-wide controls: a pause that lands
+    // mid-tick takes effect on the next tick, matching intake (which the CLI
+    // likewise samples before calling `tick`); the auto-merge default fact is
+    // the durable driver of this tick's fan-out below. Neither control
+    // pretends to a serialization the store does not offer.
+    const repoEvents = this.store.recordedJournal()
+    const paused = reduceDispatchSettings(repoEvents).paused
+    const autoMergeDefault = latestAutoMergeDefault(repoEvents)
+    // The claim-time seed cites the newest fact whose enabled state matches
+    // the launch sample, not blindly the newest fact: the CLI samples
+    // `defaultAutoMerge` from its own earlier read, so an interleaved toggle
+    // can make this tick's read newer-and-opposite. Citing the matching fact
+    // keeps the newer opposite fact strictly ahead of the seed's provenance,
+    // so the fan-out reconciles the build on the next tick instead of the
+    // stale sample out-voting the durable default forever (f_b851c0e8).
+    const autoMergeSeedFact =
+      opts.defaultAutoMerge === true ? latestAutoMergeDefault(repoEvents, true) : undefined
     // Stage 0 — SETTLEMENT: observe foreign executions from durable facts plus
     // provider liveness and settle their completion, lease, and publication.
     // Runs before the janitor so its executionLeaseLive checks see freshly
@@ -691,6 +763,13 @@ export class Dispatcher {
     if (this.outOfBudget(opts)) return report
     await this.settleOrchestratorSandboxes(report, opts)
     if (this.outOfBudget(opts)) return report
+    // The default fan-out runs before the janitor so one tick both records the
+    // consent and lets the janitor act on it (the janitor reduces a fresh read
+    // inside `checkPr`). Independent of intake and `acceptNewWork` — the
+    // durable fact drives it, so a second dispatcher polling the same
+    // repository converges the same state.
+    await this.applyAutoMergeDefault(autoMergeDefault)
+    if (this.outOfBudget(opts)) return report
     await this.janitor(report, launched, opts)
     if (this.outOfBudget(opts)) return report
     await this.recoverDispatches(report, launched, paused, opts)
@@ -700,7 +779,7 @@ export class Dispatcher {
     await this.leaseSweep(report, launched, paused, opts)
     if (this.outOfBudget(opts)) return report
     if (opts.acceptNewWork !== false) {
-      await this.dispatch(report, launched, autoMergeUser, paused, opts)
+      await this.dispatch(report, launched, autoMergeUser, paused, opts, autoMergeSeedFact)
     }
     // Fire-and-forget by contract: long synthesize/review sessions must not
     // stop janitor, lease sweep, ticket dispatch, or signal handling on later
@@ -708,6 +787,61 @@ export class Dispatcher {
     // launch. Pending control commands still launch the runner so the kernel
     // can settle them under the repository lease.
     await this.triggerHarvest()
+    // The orchestrator step (AUT-342) — LAST, after every build stage, so it
+    // can only consume slack: resumes, crash reaping, and wake turns run
+    // against min(configured, remaining tick budget) with a 30 s floor, and
+    // a busy repository simply defers its sessions to later ticks (durable
+    // state makes that safe). Two independent gates keep it inert where it
+    // does not belong: the step is constructed ONLY in origin mode (a local
+    // `ab dispatch` never constructs it — enabled = true in a local
+    // repository's autobuild.toml lists no sessions, builds no registry, and
+    // calls no model), and in origin mode only when the effective config
+    // enables the orchestrator.
+    if (this.deps.repoOrigin !== undefined && this.deps.config.orchestrator.enabled) {
+      if (!this.outOfBudget(opts)) {
+        const remainingSeconds =
+          opts.deadlineAt === undefined
+            ? undefined
+            : Math.max(0, Math.floor((opts.deadlineAt - this.deps.clock().getTime()) / 1000))
+        // The origin-mode tick's sandbox backend (AUT-584), built from the
+        // dispatcher's own deps — the same wired provider and forge the
+        // settlement stage already consumes. Construction is cheap and
+        // network-free (one idempotent ensureRepo), and building per tick
+        // picks up hot config reloads the way the rest of the tick does.
+        // A construction failure is contained: the step runs with sandbox
+        // tools filtered exactly as today, and the standing counter names
+        // the condition (the same discipline as sandboxSettleFailures).
+        let sandbox: OperatorSandboxService | undefined
+        try {
+          sandbox = await createOperatorSandboxService({
+            store: this.store,
+            repo: this.deps.repo,
+            provider: this.deps.workspaces,
+            sandbox: this.deps.config.orchestrator.sandbox,
+            baseBranch: this.deps.config.baseBranch,
+            forge: this.deps.forge,
+            clock: this.deps.clock,
+          })
+        } catch {
+          report.orchestratorSandboxFailures += 1
+          sandbox = undefined
+        }
+        await runOrchestratorTickStep({
+          store: this.store,
+          view: this.store,
+          repo: this.deps.repo,
+          config: this.deps.config,
+          clock: this.deps.clock,
+          ids: this.deps.ids,
+          tickets: this.deps.tickets,
+          ...(sandbox !== undefined ? { sandbox } : {}),
+          ...(this.deps.orchestratorModel !== undefined
+            ? { model: this.deps.orchestratorModel }
+            : {}),
+          ...(remainingSeconds !== undefined ? { remainingBudgetSeconds: remainingSeconds } : {}),
+        })
+      }
+    }
     return report
   }
 
@@ -719,6 +853,46 @@ export class Dispatcher {
     return this.deps.opts?.triageState ?? defaultTriageState(this.deps.config)
   }
 
+  /** This repository's builds paired with their digests, from one record
+   * listing and one digest read — the tick loops' per-build event reads start
+   * from here so a settled terminal build costs none. Records are read before
+   * digests (as `operator/query.ts` does) so a concurrent create cannot fail
+   * the completeness check. */
+  private async repoBuildDigests(): Promise<{ record: BuildRecord; digest: BuildDigest }[]> {
+    const store = this.store
+    const { repo } = this.deps
+    const records = (await store.listBuilds()).filter((record) => record.repo === repo)
+    const digests = await store.getRepoBuildDigests(repo)
+    return records.map((record) => {
+      const digest = digests.get(record.slug)
+      if (digest === undefined) {
+        throw new Error(
+          `build digest missing for ${record.slug}: the digest read broke completeness`,
+        )
+      }
+      return { record, digest }
+    })
+  }
+
+  /** Builds with no terminal fact: the only ones whose tick duties change
+   * their state (decide, resume, lease sweep, capacity). */
+  private async nonterminalBuilds(): Promise<BuildRecord[]> {
+    return (await this.repoBuildDigests())
+      .filter(({ digest }) => digest.terminal === undefined)
+      .map(({ record }) => record)
+  }
+
+  /** Builds that still have work: nonterminal ones, plus terminal builds whose
+   * post-terminal duty is outstanding — an `aborted` build awaiting its
+   * cleanup's `build.completed`, a `done` build with an unreclaimed release
+   * asset, or any build with an execution the provider has not been seen to
+   * end. A terminal, settled build costs no event reads. */
+  private async workBuilds(): Promise<BuildRecord[]> {
+    return (await this.repoBuildDigests())
+      .filter(({ digest }) => isWorkDigest(digest))
+      .map(({ record }) => record)
+  }
+
   /** Observation-only ready listing for Store-backed frontends while intake is
    * disabled. It shares the active-ticket exclusion with dispatch but performs
    * no dependency fetch, claim, bounce, build, workspace, or launch side
@@ -729,11 +903,10 @@ export class Dispatcher {
     ticketDiagnostics: string[]
   }> {
     this.deps.config = this.deps.getConfig?.() ?? this.deps.config
+    await this.store.refresh()
     const activeTicketIds = new Set<string>()
-    for (const record of await this.deps.store.listBuilds()) {
-      if (record.repo !== this.deps.repo || record.ticket === undefined) continue
-      const state = reduceBuild(await this.deps.store.getEvents(record.slug))
-      if (state.status !== 'done' && state.status !== 'aborted') {
+    for (const { record, digest } of await this.repoBuildDigests()) {
+      if (record.ticket !== undefined && digest.terminal === undefined) {
         activeTicketIds.add(record.ticket.id)
       }
     }
@@ -745,24 +918,66 @@ export class Dispatcher {
     }
   }
 
-  private async repositoryEvents() {
-    if ((await this.deps.store.getRepo(this.deps.repo)) === null) return []
-    return this.deps.store.getRepoEvents(this.deps.repo)
-  }
-
-  private async repositoryPaused(): Promise<boolean> {
-    return reduceDispatchSettings(await this.repositoryEvents()).paused
+  /** Apply the newest durable `dispatcher.auto-merge-default-set` fact to every
+   * current non-terminal build of this repository: on — request consent; off —
+   * cancel it. Attribution is the toggling human's own actor, exactly as if
+   * they had pressed `m` on each row; each command carries the fact's seq so
+   * the fan-out is idempotent (a settled build fails `autoMergeDefaultTarget`)
+   * and a per-build override stands until the default is toggled again. A fact
+   * whose value already matches the build's state writes a provenance-only
+   * `build.auto-merge-default-observed` marker instead of a duplicate command,
+   * so the matching fact is recorded as answered (f_28b3fba1).
+   *
+   * Per build, a compare-and-set loop (the `requestOne` shape from
+   * `bulk-control.ts`): the read/reduce/evaluate lives inside the loop, so a
+   * competing write loses at most one attempt and the next re-reads fresh
+   * state. No TickReport counter: the evidence is the build events, and the
+   * report shape stays compatible. */
+  private async applyAutoMergeDefault(fact: AutoMergeDefaultFact | undefined): Promise<void> {
+    if (fact === undefined) return
+    const store = this.store
+
+    // Terminal builds are never eligible (`autoMergeDefaultEligible`).
+    for (const record of (await this.nonterminalBuilds()).sort((a, b) =>
+      a.slug.localeCompare(b.slug),
+    )) {
+      while (true) {
+        const { state } = await store.buildFacts(record.slug)
+        const target = autoMergeDefaultTarget(state, fact)
+        if (target === undefined) break
+        if (target === 'observed') {
+          const observed = await store.appendIfCurrent(record.slug, state.lastSeq, {
+            actor: DISPATCHER,
+            type: 'build.auto-merge-default-observed',
+            payload: { defaultSeq: fact.seq },
+          })
+          if (observed !== null) break
+          continue
+        }
+        const type =
+          target === 'request' ? 'build.auto-merge-requested' : 'build.auto-merge-cancelled'
+        const appended = await store.appendIfCurrent(record.slug, state.lastSeq, {
+          actor: fact.actor,
+          type,
+          payload: { defaultSeq: fact.seq },
+        })
+        if (appended !== null) break
+      }
+    }
   }
 
   private async triggerHarvest(): Promise<void> {
     const start = this.deps.startHarvest
     if (start === undefined) return
-    const record = await this.deps.store.getRepo(this.deps.repo)
-    if (record === null) {
+    // The journal moves under foreign harvest writers while the stages run, so
+    // take the delta before deciding.
+    await this.store.refreshJournal()
+    if (!this.store.journalRecorded()) {
       start()
       return
     }
-    const state = reduceHarvest(await this.deps.store.getRepoEvents(this.deps.repo))
+    // Bounded subset (AUT-489): the harvest reducer consumes durable types only.
+    const state = reduceHarvest(this.store.recordedJournal())
     if (decideHarvestControl(state, this.maxHarvestRecoveryAttempts).kind !== 'park') {
       start()
     }
@@ -791,28 +1006,26 @@ export class Dispatcher {
    * the stage still settles. */
   private async settleForeignExecutions(report: TickReport, opts: TickOpts = {}): Promise<void> {
     const active = this.deps.activeExecutions?.() ?? new Set<string>()
-    for (const record of await this.deps.store.listBuilds()) {
-      if (record.repo !== this.deps.repo) continue
+    for (const record of await this.workBuilds()) {
       if (active.has(record.slug)) continue
       // Budget gate: once spent, stop settling further foreign executions.
       if (this.outOfBudget(opts)) break
       try {
-        const events = await this.deps.store.getEvents(record.slug)
-        const open = openExecution(events)
+        const { open } = await this.store.buildFacts(record.slug)
         if (open === null) continue
         const owner = this.executionOwner(open.provider)
         const execution = owner?.buildExecution
         if (execution?.observe === undefined || open.commandId === undefined) continue
-        const settlement = await settleExecution(
+        const settlement = await settleOpenExecution(
           {
-            store: this.deps.store,
+            store: this.store,
             execution,
-            ...(this.deps.settlePublication !== undefined
-              ? { settlePublication: this.deps.settlePublication }
+            ...(this.settlePublication !== undefined
+              ? { settlePublication: this.settlePublication }
               : {}),
           },
           record.slug,
-          events,
+          open,
         )
         if (settlement === 'settled') report.settled += 1
       } catch {
@@ -837,9 +1050,16 @@ export class Dispatcher {
     const active = this.deps.activeHarvestExecutions?.() ?? new Set<string>()
     let events: RepositoryEvent[]
     try {
-      events = await this.repositoryEvents()
+      // The earlier stages awaited providers; take the journal delta so a
+      // foreign append (operator activity, harvest facts) made meanwhile is
+      // seen before any destructive decision below.
+      await this.store.refreshJournal()
+      events = this.store.recordedJournal()
     } catch {
-      // A repository with no journal yet has nothing to settle.
+      // The read itself failed (a transient store error — a missing record
+      // answers `[]` inside the helper, so it never reaches this arm):
+      // skipping this settlement stage for this tick while the rest of the
+      // tick proceeds, and the next tick retries what remains.
       return
     }
     for (const execution of openHarvestExecutions(events)) {
@@ -890,7 +1110,7 @@ export class Dispatcher {
             branch: '',
           })
         }
-        await this.deps.store.appendRepo(this.deps.repo, {
+        await this.store.appendRepo(this.deps.repo, {
           actor: DISPATCHER,
           type: 'harvest.execution.released',
           payload: {
@@ -933,9 +1153,16 @@ export class Dispatcher {
     const providerName = this.deps.workspaces.name
     let events: RepositoryEvent[]
     try {
-      events = await this.repositoryEvents()
+      // The earlier stages awaited providers; take the journal delta so a
+      // foreign append (operator activity, harvest facts) made meanwhile is
+      // seen before any destructive decision below.
+      await this.store.refreshJournal()
+      events = this.store.recordedJournal()
     } catch {
-      // A repository with no journal yet has nothing to settle.
+      // The read itself failed (a transient store error — a missing record
+      // answers `[]` inside the helper, so it never reaches this arm):
+      // skipping this settlement stage for this tick while the rest of the
+      // tick proceeds, and the next tick retries what remains.
       return
     }
     const idleMs = config.orchestrator.sandbox.idleMinutes * 60_000
@@ -957,7 +1184,7 @@ export class Dispatcher {
           // never a stop: nothing was stopped through a provider this
           // dispatcher no longer owns. If the provider returns, the next
           // operator ensure() re-provisions and re-brackets the environment.
-          await this.deps.store.appendRepo(this.deps.repo, {
+          await this.store.appendRepo(this.deps.repo, {
             actor: DISPATCHER,
             type: 'orchestrator.sandbox.released',
             payload: {
@@ -978,7 +1205,7 @@ export class Dispatcher {
         })
         if (outcome.outcome === 'unsupported') continue
         if (outcome.outcome === 'stopped') {
-          await this.deps.store.appendRepo(this.deps.repo, {
+          await this.store.appendRepo(this.deps.repo, {
             actor: DISPATCHER,
             type: 'orchestrator.sandbox.stopped',
             payload: {
@@ -993,7 +1220,7 @@ export class Dispatcher {
           // dead host): close the orphan's trail with an unconfirmed-purge
           // release fact, dispatcher-authored exactly as
           // `harvest.execution.released` is.
-          await this.deps.store.appendRepo(this.deps.repo, {
+          await this.store.appendRepo(this.deps.repo, {
             actor: DISPATCHER,
             type: 'orchestrator.sandbox.released',
             payload: {
@@ -1021,23 +1248,8 @@ export class Dispatcher {
 
   /** The latest `workspace.provision-started` not yet followed by a
    * provisioned/released fact — an open provisioning marker. */
-  private openProvisionMarker(
-    events: AbEvent[],
-  ): { provider: string; branch: string; generation: number; ts: string; seq: number } | undefined {
-    let marker:
-      | { provider: string; branch: string; generation: number; ts: string; seq: number }
-      | undefined
-    for (const event of events) {
-      if (event.type === 'workspace.provision-started') {
-        marker = { ...event.payload, ts: event.ts, seq: event.seq }
-      } else if (
-        marker !== undefined &&
-        (event.type === 'workspace.provisioned' || event.type === 'workspace.released')
-      ) {
-        marker = undefined
-      }
-    }
-    return marker
+  private openProvisionMarker(events: AbEvent[]): ProvisionMarker | undefined {
+    return provisionMarkerReducer.reduce(events)
   }
 
   /** Liveness of the lease behind an open provision marker: `live` means a
@@ -1046,7 +1258,7 @@ export class Dispatcher {
    * may have crashed between marker and claim — adopted only after the
    * `provisionStaleMs` backstop. */
   private async provisionMarkerLiveness(slug: string): Promise<'live' | 'expired' | 'absent'> {
-    const record = await this.deps.store.getBuild(slug)
+    const record = await this.store.getBuild(slug)
     if (record?.lease === undefined) return 'absent'
     return new Date(record.lease.expiresAt).getTime() > this.deps.clock().getTime()
       ? 'live'
@@ -1065,6 +1277,8 @@ export class Dispatcher {
       body: string
       authoredSession?: string
       autoMergeUser?: string
+      autoMergeDefaultSeq?: number
+      assets?: PinnedAsset[]
     },
   ): Promise<'kicked' | 'in-flight' | 'foreign-live'> {
     const slug = record.slug
@@ -1093,7 +1307,7 @@ export class Dispatcher {
     }
     const branch = record.branch ?? `ab/${slug}`
     const generation = events.filter((event) => event.type === 'workspace.provisioned').length
-    await this.deps.store.append(slug, {
+    await this.store.append(slug, {
       actor: DISPATCHER,
       type: 'workspace.provision-started',
       payload: { provider: this.deps.workspaces.name, branch, generation },
@@ -1134,12 +1348,15 @@ export class Dispatcher {
             body: string
             authoredSession?: string
             autoMergeUser?: string
+            autoMergeDefaultSeq?: number
+            assets?: PinnedAsset[]
           }
         | undefined
       tail: 'dispatch' | 'launch'
     },
   ): Promise<void> {
-    const { store, workspaces, config } = this.deps
+    const store = this.store
+    const { workspaces, config } = this.deps
     const slug = entry.slug
     let leaseClaimed = false
     let heartbeat: ReturnType<typeof setInterval> | undefined
@@ -1192,6 +1409,7 @@ export class Dispatcher {
           ref: handle.ref,
           path: handle.path,
           ...(handle.localPath !== undefined ? { localPath: handle.localPath } : {}),
+          remote: workspaces.publication !== undefined,
           branch: handle.branch,
           base: handle.base,
         },
@@ -1277,10 +1495,10 @@ export class Dispatcher {
     for (const entry of entries) entry.controller.abort()
     for (const entry of entries) {
       try {
-        const events = await this.deps.store.getEvents(entry.slug)
+        const events = await this.store.getEvents(entry.slug)
         if (this.openProvisionMarker(events) !== undefined) {
           const attempt = events.filter((event) => event.type === 'dispatch.failed').length + 1
-          await this.deps.store.append(entry.slug, {
+          await this.store.append(entry.slug, {
             actor: DISPATCHER,
             type: 'dispatch.failed',
             payload: {
@@ -1295,7 +1513,7 @@ export class Dispatcher {
         // The durable marker plus the released lease still gate adoption.
       }
       try {
-        await this.deps.store.releaseLease(entry.slug, entry.instance)
+        await this.store.releaseLease(entry.slug, entry.instance)
       } catch {
         // Expiry fences an ambiguous release.
       }
@@ -1311,12 +1529,11 @@ export class Dispatcher {
   ): Promise<void> {
     // Listing is repository-wide work: if it fails there is no individual
     // build to attribute, so the caller's existing top-level boundary owns it.
-    const records = await this.deps.store.listBuilds()
-    for (const record of records) {
-      // One dispatcher per repo (§12), but the store is shared by design
-      // (§7.2) — another repo's builds are another dispatcher's duty. Acting
-      // on them would poll foreign PRs and break single-writer discipline.
-      if (record.repo !== this.deps.repo) continue
+    // Only this repo's builds that still have work (§12: another repo's
+    // builds are another dispatcher's duty; settled terminal builds cost no
+    // event reads).
+    const entries = (await this.repoBuildDigests()).filter(({ digest }) => isWorkDigest(digest))
+    for (const { record, digest } of entries) {
       // Budget gate: the janitor's per-build path issues forge/store transport
       // calls (PR probes, closePr, deleteBranch); once the budget is spent,
       // stop starting new ones. The remaining builds stay janitor due — the
@@ -1326,14 +1543,22 @@ export class Dispatcher {
         // Once a record is known, contain its complete janitor path: loading
         // and reducing facts, cleanup, forge/ticket calls, and store writes.
         // Existing partial facts leave the same work due on the next tick.
-        const events = await this.deps.store.getEvents(record.slug)
-        const state = reduceBuild(events)
+        const { state, workspace } = await this.store.buildFacts(record.slug)
         const executionLeaseLive = this.hasLiveExecutionLease(record)
+        // Raw history, read at most once and only by a branch that acts on it:
+        // the facts above answer every quiet-path question without it.
+        let loaded: AbEvent[] | undefined
+        const history = async (): Promise<AbEvent[]> => {
+          loaded ??= await this.store.getEvents(record.slug)
+          return loaded
+        }
         // Pipeline/ticket/workspace state is settled, but release-asset cleanup
         // has its own crash window after build.completed. Revisit only pending
         // hosted handles; this never relaunches a runner or consumes capacity.
         if (state.status === 'done') {
-          await this.reclaimPrAttachments(record.slug, events)
+          if (digest.reclaimPending === true) {
+            await this.reclaimPrAttachments(record.slug, await history())
+          }
           continue
         }
         // Abort is destructive human judgment and therefore outranks a queued
@@ -1343,13 +1568,15 @@ export class Dispatcher {
           state.status === 'queued' &&
           state.pendingCommands.some((command) => command.command === 'abort')
         ) {
-          const acknowledged = await this.deps.store.append(record.slug, {
+          const acknowledged = await this.store.append(record.slug, {
             actor: DISPATCHER,
             type: 'build.aborted',
             payload: {},
           } satisfies EventWrite<'build.aborted'>)
-          events.push(acknowledged)
-          await this.cleanupAborted(record, events, report)
+          void acknowledged
+          // The view folded the acknowledgement it just appended.
+          loaded = undefined
+          await this.cleanupAborted(record, await history(), report)
           continue
         }
         // Discard is a queued-only recovery control. A request that raced with
@@ -1360,15 +1587,23 @@ export class Dispatcher {
           state.status === 'queued' &&
           state.discardRequest !== undefined
         ) {
-          await this.cleanupDiscarded(record, events, report)
+          await this.cleanupDiscarded(record, await history(), report)
           continue
         }
         if (!executionLeaseLive && state.status === 'aborted') {
-          await this.cleanupAborted(record, events, report)
+          await this.cleanupAborted(record, await history(), report)
           continue
         }
-        if (state.pr)
-          await this.checkPr(record, events, state, report, launched, executionLeaseLive)
+        if (state.pr) {
+          await this.checkPr(
+            record,
+            { history, workspace },
+            state,
+            report,
+            launched,
+            executionLeaseLive,
+          )
+        }
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error)
         report.janitorFailed += 1
@@ -1378,8 +1613,11 @@ export class Dispatcher {
   }
 
   private forgeWorkspacePath(events: AbEvent[]): string {
-    const open = openWorkspace(events)
-    if (open?.provider === 'vercel-sandbox') return this.deps.repo
+    return this.forgeWorkspacePathOf(openWorkspace(events))
+  }
+
+  private forgeWorkspacePathOf(open: OpenBuildWorkspace | null): string {
+    if (open !== null && isRemoteWorkspace(open)) return this.deps.repo
     // Local forges run git with cwd = workspacePath: it must be the physical
     // checkout, never the store identity (an origin URL since the identity
     // change; a path only for origin-less fixtures).
@@ -1401,19 +1639,19 @@ export class Dispatcher {
     events: AbEvent[],
     report: TickReport,
   ): Promise<void> {
-    const { store, tickets, forge } = this.deps
+    const store = this.store
+    const { tickets, forge } = this.deps
     const branch = record.branch
     // Whether this build ever owned a local checkout workspace, judged on the
     // provisioned facts (not the open one, which is null when the build never
     // provisioned or already released — only the former must skip the
     // local-branch git step; a released local workspace may still have left a
-    // branch in the checkout). Remote workspaces (vercel-sandbox) never create
-    // a local branch in the main checkout, and origin mode has no checkout at
-    // all: the local-branch git step is skipped, and the saga's later steps
-    // tolerate its absence.
+    // branch in the checkout). Remote workspaces never create a local branch
+    // in the main checkout, and origin mode has no checkout at all: the
+    // local-branch git step is skipped, and the saga's later steps tolerate
+    // its absence.
     const hadLocalWorkspace = events.some(
-      (event) =>
-        event.type === 'workspace.provisioned' && event.payload.provider !== 'vercel-sandbox',
+      (event) => event.type === 'workspace.provisioned' && !isRemoteWorkspace(event.payload),
     )
     const has = (type: AbEvent['type']): boolean => events.some((event) => event.type === type)
     const append = async <T extends EventWrite['type']>(write: EventWrite<T>): Promise<void> => {
@@ -1565,7 +1803,8 @@ export class Dispatcher {
     events: AbEvent[],
     report: TickReport,
   ): Promise<void> {
-    const { store, tickets } = this.deps
+    const store = this.store
+    const { tickets } = this.deps
     await this.releaseWorkspace(record.slug, events, 'discard')
     if (record.lease !== undefined) {
       await store.releaseLease(record.slug, record.lease.holder)
@@ -1589,18 +1828,21 @@ export class Dispatcher {
    * against the reduced `prState`), release/complete, project to the ticket. */
   private async checkPr(
     record: BuildRecord,
-    events: AbEvent[],
+    // `workspace` is the open workspace fact; `history` loads the raw log, which
+    // only the branches that act on a PR transition need.
+    source: { history: () => Promise<AbEvent[]>; workspace: OpenBuildWorkspace | null },
     state: BuildState,
     report: TickReport,
     launched: Set<string>,
     executionLeaseLive: boolean,
   ): Promise<void> {
-    const { store, tickets, forge } = this.deps
+    const store = this.store
+    const { tickets, forge } = this.deps
     const pr = state.pr
     if (!pr) return
     // Forge calls run from the workspace when it still exists (it does until
     // the build completes); fall back to the repo itself for odd logs.
-    const workspacePath = this.forgeWorkspacePath(events)
+    const workspacePath = this.forgeWorkspacePathOf(source.workspace)
     const prState = await forge.getPrState(workspacePath, pr.number)
     const autoMerge = prState.state === 'open' ? pendingAutoMerge(state) : undefined
 
@@ -1626,6 +1868,7 @@ export class Dispatcher {
       // Dedupe: a reduced prState of 'conflicted' means reconcile is already
       // pending (a `reconcile.completed` returns it to 'open').
       if (state.prState === 'conflicted') return
+      const events = await source.history()
       const baseSha = await this.baseSha(baseBranchOf(events, this.deps.config))
       const conflicted = await store.append(record.slug, {
         actor: DISPATCHER,
@@ -1674,10 +1917,11 @@ export class Dispatcher {
         // Re-read at the last possible point. A cancellation, replacement
         // command, newly due pipeline work, or application fact suppresses
         // this attempt; the next tick reclassifies from fresh forge state.
-        const latestEvents = await store.getEvents(record.slug)
-        const latestState = reduceBuild(latestEvents)
+        await store.refreshBuild(record.slug)
+        const latest = await store.buildFacts(record.slug)
+        const latestState = latest.state
         const latestIntent = pendingAutoMerge(latestState)
-        const decision = decideNext(latestEvents, this.deps.config)
+        const decision = decideNextFromFacts(latest.state, latest.log, this.deps.config)
         if (
           latestState.pr?.number === pr.number &&
           latestIntent?.enabled === true &&
@@ -1693,6 +1937,7 @@ export class Dispatcher {
     switch (prState.state) {
       case 'merged': {
         if (executionLeaseLive) return
+        const events = await source.history()
         // Emit the fact once (a crash between steps re-runs this block; the
         // reduced prState dedupes the event, the log dedupes the release).
         if (state.prState !== 'merged') {
@@ -1718,6 +1963,7 @@ export class Dispatcher {
       }
       case 'closed': {
         if (executionLeaseLive) return
+        const events = await source.history()
         // Closed without merge is a human decision — back to Triage (§15.7).
         if (state.prState !== 'closed') {
           await store.append(record.slug, {
@@ -1774,14 +2020,14 @@ export class Dispatcher {
           workspacePath: this.deps.checkout ?? this.deps.repo,
           asset: hosted.payload.asset,
         })
-        await this.deps.store.append(slug, {
+        await this.store.append(slug, {
           actor: DISPATCHER,
           type: 'pr-attachment.reclaimed',
           payload: { hostedSeq: hosted.seq },
         })
       } catch (error) {
         try {
-          await this.deps.store.append(slug, {
+          await this.store.append(slug, {
             actor: DISPATCHER,
             type: 'pr-attachment.reclaim-failed',
             payload: {
@@ -1801,24 +2047,7 @@ export class Dispatcher {
   }
 
   private recoveryCheckpoint(events: AbEvent[]): string | undefined {
-    let settled: string | undefined
-    let original: string | undefined
-    for (const event of events) {
-      if (event.type === 'workspace.provisioned' && original === undefined) {
-        original = event.payload.base.sha
-      } else if (event.type === 'implement.completed') {
-        settled = event.payload.commits.head
-      } else if (event.type === 'reconcile.completed') {
-        settled = event.payload.mergeCommit
-      } else if (
-        event.type === 'finalize.step-completed' &&
-        event.payload.ok &&
-        event.payload.headSha !== undefined
-      ) {
-        settled = event.payload.headSha
-      }
-    }
-    return settled ?? original
+    return recoveryCheckpointReducer.reduce(events)
   }
 
   private async recordInfrastructureFailure(
@@ -1834,7 +2063,7 @@ export class Dispatcher {
   ): Promise<void> {
     const execution = [...events].reverse().find((event) => event.type === 'execution.started')
     const appended = await appendInfrastructureFailure(
-      { store: this.deps.store, ids: this.deps.ids },
+      { store: this.store, ids: this.deps.ids },
       {
         slug,
         events,
@@ -1884,7 +2113,7 @@ export class Dispatcher {
     // failure propagates — a stale workspace with an unrecorded pending
     // request is never reaped (the next tick retries).
     events = await settlePublicationBeforeRelease(
-      { store: this.deps.store, settlePublication: this.deps.settlePublication },
+      { store: this.store, settlePublication: this.settlePublication },
       slug,
       events,
       reason,
@@ -1903,7 +2132,7 @@ export class Dispatcher {
         ...(open.localPath !== undefined ? { localPath: open.localPath } : {}),
         branch: open.branch,
       })
-      const cleaned = await this.deps.store.append(slug, {
+      const cleaned = await this.store.append(slug, {
         actor: DISPATCHER,
         type: 'infrastructure.cleanup-attempted',
         payload: {
@@ -1916,7 +2145,7 @@ export class Dispatcher {
         },
       })
       events.push(cleaned)
-      const released = await this.deps.store.append(slug, {
+      const released = await this.store.append(slug, {
         actor: DISPATCHER,
         type: 'workspace.released',
         payload: { ref: open.ref, reason },
@@ -1925,7 +2154,7 @@ export class Dispatcher {
       return true
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error)
-      const failed = await this.deps.store.append(slug, {
+      const failed = await this.store.append(slug, {
         actor: DISPATCHER,
         type: 'infrastructure.cleanup-attempted',
         payload: {
@@ -1973,7 +2202,7 @@ export class Dispatcher {
     // workspace still exists. The guard's append failure propagates — the
     // release never proceeds past an unrecorded pending request.
     events = await settlePublicationBeforeRelease(
-      { store: this.deps.store, settlePublication: this.deps.settlePublication },
+      { store: this.store, settlePublication: this.settlePublication },
       slug,
       events,
       reason,
@@ -1988,7 +2217,7 @@ export class Dispatcher {
         ).length + 1
       try {
         const outcome = await recovery.reap(handle)
-        const cleaned = await this.deps.store.append(slug, {
+        const cleaned = await this.store.append(slug, {
           actor: DISPATCHER,
           type: 'infrastructure.cleanup-attempted',
           payload: {
@@ -2003,7 +2232,7 @@ export class Dispatcher {
         events.push(cleaned)
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error)
-        const failed = await this.deps.store.append(slug, {
+        const failed = await this.store.append(slug, {
           actor: DISPATCHER,
           type: 'infrastructure.cleanup-attempted',
           payload: {
@@ -2028,7 +2257,7 @@ export class Dispatcher {
     } else {
       await owner.release(handle)
     }
-    return this.deps.store.append(slug, {
+    return this.store.append(slug, {
       actor: DISPATCHER,
       type: 'workspace.released',
       payload: { ref: open.ref, reason },
@@ -2046,7 +2275,15 @@ export class Dispatcher {
   private async baseSha(baseBranch: string): Promise<string> {
     const remoteBranchSha = this.deps.forge.remoteBranchSha
     if (remoteBranchSha !== undefined) {
-      return await remoteBranchSha.call(this.deps.forge, baseBranch)
+      try {
+        return await remoteBranchSha.call(this.deps.forge, baseBranch)
+      } catch {
+        // A forge that advertises the capability but cannot resolve this branch
+        // (a checkout-mode adapter, an unseeded test fake, or a transient
+        // remote failure) falls through to the physical checkout's git read.
+        // In origin mode there is no checkout, so the git read's failure is the
+        // actionable error and the tick still fails closed.
+      }
     }
     const args = [
       'git',
@@ -2068,6 +2305,29 @@ export class Dispatcher {
 
   // ── b. Interrupted dispatch recovery ───────────────────────────────────────
 
+  /** The claim-time `build.created` payload. Assets are omitted when the ticket
+   * had none, so a no-asset build's log is exactly what it was before. */
+  private buildCreatedPayload(
+    ticket: TicketRef,
+    repo: string,
+    seed:
+      | { autoMergeUser?: string; autoMergeDefaultSeq?: number; assets?: PinnedAsset[] }
+      | undefined,
+  ): EventPayload<'build.created'> {
+    const { config } = this.deps
+    return {
+      ticket,
+      repo,
+      baseBranch: config.baseBranch,
+      ...(seed?.autoMergeUser !== undefined ? { autoMergeRequestedBy: seed.autoMergeUser } : {}),
+      ...(seed?.autoMergeDefaultSeq !== undefined
+        ? { autoMergeDefaultSeq: seed.autoMergeDefaultSeq }
+        : {}),
+      ...(config.pr !== undefined ? { pr: config.pr } : {}),
+      ...(seed?.assets !== undefined && seed.assets.length > 0 ? { assets: seed.assets } : {}),
+    }
+  }
+
   /** Every boundary before runner attachment is derived from durable facts.
    * Missing facts are the todo list; successful provider calls are followed
    * immediately by their facts, so an ordinary later tick can continue. */
@@ -2091,9 +2351,12 @@ export class Dispatcher {
       body: string
       authoredSession?: string
       autoMergeUser?: string
+      autoMergeDefaultSeq?: number
+      assets?: PinnedAsset[]
     },
   ): Promise<DispatchOutcome> {
-    const { store, config } = this.deps
+    const store = this.store
+    const { config } = this.deps
     let stage: EventPayload<'dispatch.failed'>['stage'] = 'create'
     try {
       let events = await store.getEvents(record.slug)
@@ -2103,18 +2366,16 @@ export class Dispatcher {
             'build record lacks the immutable ticket facts needed to reconstruct build.created',
           )
         }
+        // Legacy path: a record an older dispatcher left with an empty stream.
+        // New claims write `build.created` atomically with the record, so this
+        // can only sample the ticket's current assets (SPEC §6.3).
+        const assets =
+          seed?.assets ??
+          (await samplePinnedAssets(store, record.repo, record.ticket.id).catch(() => []))
         await store.appendIfCurrent(record.slug, 0, {
           actor: DISPATCHER,
           type: 'build.created',
-          payload: {
-            ticket: record.ticket,
-            repo: record.repo,
-            baseBranch: config.baseBranch,
-            ...(seed?.autoMergeUser !== undefined
-              ? { autoMergeRequestedBy: seed.autoMergeUser }
-              : {}),
-            ...(config.pr !== undefined ? { pr: config.pr } : {}),
-          },
+          payload: this.buildCreatedPayload(record.ticket, record.repo, { ...seed, assets }),
         })
         events = await store.getEvents(record.slug)
         if (!events.some((event) => event.type === 'build.created')) {
@@ -2124,6 +2385,10 @@ export class Dispatcher {
 
       const created = events.find((event) => event.type === 'build.created')
       const autoMergeUser = seed?.autoMergeUser ?? created?.payload.autoMergeRequestedBy
+      // The claim's sampled default fact, for the request's fan-out provenance:
+      // the seed's own value first (this dispatch created the build), else the
+      // durable `build.created` fact a recovery pass resumes from.
+      const autoMergeDefaultSeq = seed?.autoMergeDefaultSeq ?? created?.payload.autoMergeDefaultSeq
       if (
         autoMergeUser !== undefined &&
         !events.some((event) => event.type === 'build.auto-merge-requested')
@@ -2131,7 +2396,9 @@ export class Dispatcher {
         await store.append(record.slug, {
           actor: humanActor(autoMergeUser),
           type: 'build.auto-merge-requested',
-          payload: {},
+          payload: {
+            ...(autoMergeDefaultSeq !== undefined ? { defaultSeq: autoMergeDefaultSeq } : {}),
+          },
         })
         events = await store.getEvents(record.slug)
       }
@@ -2172,6 +2439,7 @@ export class Dispatcher {
             ref: handle.ref,
             path: handle.path,
             ...(handle.localPath !== undefined ? { localPath: handle.localPath } : {}),
+            remote: this.deps.workspaces.publication !== undefined,
             branch: handle.branch,
             base: handle.base,
           },
@@ -2218,11 +2486,14 @@ export class Dispatcher {
       body: string
       authoredSession?: string
       autoMergeUser?: string
+      autoMergeDefaultSeq?: number
+      assets?: PinnedAsset[]
     },
     report?: TickReport,
     launched?: Set<string>,
   ): Promise<Exclude<DispatchOutcome, 'deferred'>> {
-    const { store } = this.deps
+    const store = this.store
+
     let stage: EventPayload<'dispatch.failed'>['stage'] = 'spec'
     let authored = false
     try {
@@ -2303,6 +2574,7 @@ export class Dispatcher {
       // Discard validation and recovery selection happened before several
       // provider awaits. Re-read immediately before launch so a request made
       // during those boundaries parks cleanly for the next janitor pass.
+      await store.refreshBuild(record.slug)
       const launchState = reduceBuild(await store.getEvents(record.slug))
       if (launchState.status !== 'queued' || launchState.discardRequest !== undefined) {
         return 'parked'
@@ -2335,9 +2607,8 @@ export class Dispatcher {
     paused: boolean,
     opts: TickOpts = {},
   ): Promise<void> {
-    for (const record of await this.deps.store.listBuilds()) {
+    for (const record of await this.nonterminalBuilds()) {
       if (
-        record.repo !== this.deps.repo ||
         record.ticket === undefined ||
         launched.has(record.slug) ||
         this.continuations.has(record.slug)
@@ -2346,8 +2617,7 @@ export class Dispatcher {
       }
       // Budget gate: recovery issues store transport calls per build.
       if (this.outOfBudget(opts)) break
-      const events = await this.deps.store.getEvents(record.slug)
-      const state = reduceBuild(events)
+      const { state } = await this.store.buildFacts(record.slug)
       if (
         state.status !== 'queued' ||
         state.discardRequest !== undefined ||
@@ -2383,14 +2653,15 @@ export class Dispatcher {
     paused: boolean,
     opts: TickOpts = {},
   ): Promise<void> {
-    const { store, config } = this.deps
-    for (const record of await store.listBuilds()) {
-      if (record.repo !== this.deps.repo || launched.has(record.slug)) continue
+    const store = this.store
+    const { config } = this.deps
+    for (const record of await this.nonterminalBuilds()) {
+      if (launched.has(record.slug)) continue
       // Budget gate: resume launches runners (transport-backed work).
       if (this.outOfBudget(opts)) break
 
-      const events = await store.getEvents(record.slug)
-      const state = reduceBuild(events)
+      const facts = await store.buildFacts(record.slug)
+      const state = facts.state
       if (
         state.status === 'done' ||
         state.status === 'aborted' ||
@@ -2400,7 +2671,7 @@ export class Dispatcher {
         continue
       }
 
-      const decision = decideNext(events, config)
+      const decision = decideNextFromFacts(state, facts.log, config)
       if (decision.kind === 'wait') {
         if (decision.reason === 'blocked' && state.openEscalations.length > 0) {
           report.blockedDiagnostics.push(
@@ -2451,8 +2722,9 @@ export class Dispatcher {
     opts: TickOpts = {},
   ): Promise<void> {
     const now = this.deps.clock().getTime()
-    for (const record of await this.deps.store.listBuilds()) {
-      if (record.repo !== this.deps.repo) continue // §12: not this dispatcher's build
+    // Terminal builds are filtered on the digest before the lease and TTL
+    // checks, so a zero TTL cannot fall through to a log read.
+    for (const record of await this.nonterminalBuilds()) {
       if (launched.has(record.slug)) continue
       // Budget gate: the sweep re-attaches runners per expired build.
       if (this.outOfBudget(opts)) break
@@ -2461,16 +2733,22 @@ export class Dispatcher {
       } else if (now - new Date(record.updatedAt).getTime() < this.leaseTtlMs) {
         continue // absent lease within the first-claim grace (see DispatcherOpts)
       }
-      const events = await this.deps.store.getEvents(record.slug)
-      const state = reduceBuild(events)
+      const facts = await this.store.buildFacts(record.slug)
+      const state = facts.state
       if (
         (state.status === 'queued' && state.discardRequest !== undefined) ||
         heldByRepositoryPause(state, paused)
       ) {
         continue
       }
-      const decision = decideNext(events, this.deps.config)
+      const decision = decideNextFromFacts(state, facts.log, this.deps.config)
       if (state.status === 'done' || state.status === 'aborted') continue
+      // Raw history, read at most once and only by a branch that acts on it.
+      let loaded: AbEvent[] | undefined
+      const history = async (): Promise<AbEvent[]> => {
+        loaded ??= await this.store.getEvents(record.slug)
+        return loaded
+      }
       // Liveness gate (durable supervision): a recorded execution the provider
       // observes as RUNNING is left completely alone — no settle, no reap, no
       // replacement, no re-attach. This is the change that stops a supervisor
@@ -2478,13 +2756,12 @@ export class Dispatcher {
       // proved end settles first (completion facts, lease release, publication)
       // and then falls through to the normal decision; a provider-proved loss
       // falls through to the existing stale path below.
-      const foreignExecution = openExecution(events)
+      const foreignExecution = facts.open
       // A provider- or log-proved end in the same generation re-attaches in
       // place: the guest finished its work, the workspace is still the
       // build's, and replacing the environment would discard a healthy
       // generation. Only an unproven stale lease or a proved loss reaps.
-      const lastExecution = lastExecutionOutcome(events)
-      let endedInPlace = lastExecution === 'completed'
+      let endedInPlace = facts.lastExecution === 'completed'
       if (
         foreignExecution !== null &&
         foreignExecution.commandId !== undefined &&
@@ -2493,16 +2770,16 @@ export class Dispatcher {
         const owner = this.executionOwner(foreignExecution.provider)
         const execution = owner?.buildExecution
         if (execution?.observe !== undefined) {
-          const settlement = await settleExecution(
+          const settlement = await settleOpenExecution(
             {
-              store: this.deps.store,
+              store: this.store,
               execution,
-              ...(this.deps.settlePublication !== undefined
-                ? { settlePublication: this.deps.settlePublication }
+              ...(this.settlePublication !== undefined
+                ? { settlePublication: this.settlePublication }
                 : {}),
             },
             record.slug,
-            events,
+            foreignExecution,
           )
           if (settlement === 'running') continue
           if (settlement === 'settled') {
@@ -2514,8 +2791,8 @@ export class Dispatcher {
       const publicationRecoveryDue =
         state.status !== 'paused' &&
         state.status !== 'blocked' &&
-        (publicationPending(events) || abandonedPublicationPending(events))
-      const open = openWorkspace(events)
+        (facts.publication.pending() || facts.publication.abandonedPending())
+      const open = facts.workspace
       // A provider- or log-proved END in the same generation re-attaches in
       // place: the guest finished its work, the workspace is still the
       // build's, and replacing the environment would discard a healthy
@@ -2528,13 +2805,13 @@ export class Dispatcher {
             : state.status === 'blocked'
               ? ('blocked' as const)
               : ('replacement' as const)
-        const reaped = await this.reapStaleWorkspace(record.slug, events, reason)
+        const reaped = await this.reapStaleWorkspace(record.slug, await history(), reason)
         if (!reaped) continue
         if (!parked) {
           // Recovery-capable provider: reap inline (bounded), then kick the
           // same background continuation — it provisions and launches without
           // blocking this tick. Local providers never enter this branch.
-          const kicked = await this.ensureProvisionContinuation(record, events, 'launch')
+          const kicked = await this.ensureProvisionContinuation(record, await history(), 'launch')
           if (kicked === 'kicked') {
             report.provisioning += 1
             report.swept += 1
@@ -2551,11 +2828,11 @@ export class Dispatcher {
       // already continued earlier.
       if (decision.kind === 'wait' && !publicationRecoveryDue) continue
       if (
-        openWorkspace(events) === null &&
+        facts.workspace === null &&
         this.deps.workspaces.recovery !== undefined &&
-        events.some((event) => event.type === 'workspace.provisioned')
+        (await history()).some((event) => event.type === 'workspace.provisioned')
       ) {
-        const kicked = await this.ensureProvisionContinuation(record, events, 'launch')
+        const kicked = await this.ensureProvisionContinuation(record, await history(), 'launch')
         if (kicked === 'kicked') {
           report.provisioning += 1
           report.swept += 1
@@ -2578,17 +2855,17 @@ export class Dispatcher {
     autoMergeUser: string | undefined,
     paused: boolean,
     opts: TickOpts = {},
+    autoMergeSeedFact: AutoMergeDefaultFact | undefined = undefined,
   ): Promise<void> {
-    const { store, tickets, config } = this.deps
+    const store = this.store
+    const { tickets, config } = this.deps
     // Blocked and paused builds still occupy a slot: their workspaces and
     // pending work are live, only waiting on a human. Capacity is per repo
     // (§16.1) — another repo's builds never consume this repo's slots.
     let active = 0
     const activeTicketIds = new Set<string>()
-    for (const record of await store.listBuilds()) {
-      if (record.repo !== this.deps.repo) continue
-      const state = reduceBuild(await store.getEvents(record.slug))
-      if (state.status !== 'done' && state.status !== 'aborted') {
+    for (const { record, digest } of await this.repoBuildDigests()) {
+      if (digest.terminal === undefined) {
         active += 1
         if (record.ticket) activeTicketIds.add(record.ticket.id)
       }
@@ -2599,9 +2876,11 @@ export class Dispatcher {
     // standing queue-depth report and must stay honest exactly when the
     // dispatcher is saturated. Sources that keep a claimed ticket in the
     // ready state are deduped against the active builds embodying them.
-    const journalBeforeReady = await this.repositoryEvents()
+    await this.store.refreshJournal()
+    const journalBeforeReady = this.store.recordedJournal()
     const listing = await tickets.listReady(readyCriteria(config))
-    const journalAfterReady = await this.repositoryEvents()
+    await this.store.refreshJournal()
+    const journalAfterReady = this.store.recordedJournal()
     const creationHolds = new Map(
       harvestCreationsDuringReadyScan(journalBeforeReady, journalAfterReady).map((creation) => [
         creation.creationKey.toLowerCase(),
@@ -2691,6 +2970,10 @@ export class Dispatcher {
         continue
       }
 
+      // Freeze the ticket's assets at the claim (SPEC §6.3): sampled before the
+      // spec-authoring interval so edits made during it are never pinned.
+      const assets = await samplePinnedAssets(store, this.deps.repo, ticket.ref.id)
+
       // Quality gate (§6.3): import a conforming ticket body as the spec;
       // author one for thin-but-groomed tickets; otherwise bounce.
       let body = ticket.body
@@ -2717,12 +3000,29 @@ export class Dispatcher {
       const slug = await this.uniqueSlug(baseSlug)
       const branch = `ab/${slug}`
       const repoOrigin = await this.resolveRepoOriginOnce()
+      const createdSeed = {
+        ...(autoMergeUser !== undefined ? { autoMergeUser } : {}),
+        // Claim-time provenance: the newest durable default fact that agrees
+        // with the launch sample, recorded on `build.created` so the fan-out's
+        // seq comparison sees the claim as already answering that fact — and
+        // so a newer opposite fact (an interleaved toggle) stays strictly
+        // ahead of it and reconciles this build on the next tick (f_b851c0e8).
+        ...(autoMergeSeedFact !== undefined ? { autoMergeDefaultSeq: autoMergeSeedFact.seq } : {}),
+        assets,
+      }
+      // `build.created` rides with the record so the pinned assets and the
+      // record exist together or not at all.
       const record = await store.createBuild({
         slug,
         repo: this.deps.repo,
         ticket: ticket.ref,
         branch,
         ...(repoOrigin !== undefined ? { repoOrigin } : {}),
+        created: {
+          actor: DISPATCHER,
+          type: 'build.created',
+          payload: this.buildCreatedPayload(ticket.ref, this.deps.repo, createdSeed),
+        },
       })
       report.queued -= 1
       capacity -= 1
@@ -2730,7 +3030,7 @@ export class Dispatcher {
         ticket,
         body,
         ...(authoredSession !== undefined ? { authoredSession } : {}),
-        ...(autoMergeUser !== undefined ? { autoMergeUser } : {}),
+        ...createdSeed,
       })
       // Accepted dispatches: durable boundaries recorded. A deferred outcome
       // means the remote provisioning continuation owns the rest.
@@ -2817,7 +3117,7 @@ export class Dispatcher {
   /** Valid bounded base, deduped store-wide with -2/-3/… suffixes. */
   private async uniqueSlug(base: string): Promise<string> {
     let slug = base
-    for (let n = 2; (await this.deps.store.getBuild(slug)) !== null; n += 1) {
+    for (let n = 2; (await this.store.getBuild(slug)) !== null; n += 1) {
       slug = `${base}-${n}`
     }
     return slug