@defrex/autobuild 0.8.0 → 0.10.0

package/packages/core/src/cli/dispatch.ts

@@ -28,13 +28,25 @@ import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 import semver from 'semver'
 import { parseConfig } from '../config/load'
-import { DISPATCHER_CONFIG_ARTIFACT, LiveConfig, type ConfigSnapshot } from '../config/live'
+import {
+  composeBuildConfig,
+  DISPATCHER_CONFIG_ARTIFACT,
+  LiveConfig,
+  type ConfigSnapshot,
+} from '../config/live'
+import {
+  isActionablePipelineFailure,
+  resolvePipelineSource,
+  type PipelineSourceFailure,
+  type PipelineSourceMeta,
+} from '../config/pipeline-source'
 import { effectiveRuntimeReferences, roleKeyWarnings, SLUG_ROLE } from '../config/roles'
 import type { Config } from '../config/schema'
-import { loadPlugins } from '../plugins/load'
+import { loadPlugins, pluginResolutionKind } from '../plugins/load'
 import type { PluginRegistry } from '../plugins/registry'
 import { materializePluginRuntimes } from '../plugins/runtimes'
-import { DISPATCHER, humanActor } from '../events/envelope'
+import { DISPATCHER, KERNEL, humanActor } from '../events/envelope'
+import type { AbEvent } from '../events/catalog'
 import type { RepositoryEventWrite } from '../events/repository'
 import { randomIds, randomUuids, type IdSource, type UuidSource } from '../ids'
 import { reduceDispatchSettings } from '../kernel/dispatch-settings'
@@ -100,15 +112,21 @@ import {
   type BuildExecutionHandle,
 } from '../ports/workspace/build-execution'
 import type { Exec } from '../ports/workspace/git-worktree'
-import { validateVercelGithubOrigin } from '../ports/workspace/vercel-sandbox'
 import {
   BUILD_EFFECTIVE_CONFIG_ARTIFACT,
   BUILD_RUNNER_DIAGNOSTIC_ARTIFACT,
   effectiveBuildConfigContent,
+  parseBuildConfigMetadata,
   parseDiagnostic,
+  parseEffectiveBuildConfig,
+  selectOpenWorkspace,
 } from '../processes/build-execution-state'
 import { HarvestRunner, type HarvestRunnerResult } from '../processes/harvest-runner'
-import { scanUnclaimedObservations, evaluateHarvestPressure } from '../processes/harvest'
+import {
+  sampleUnclaimedObservationCount,
+  readRepoEventsIfRecorded,
+  evaluateHarvestPressureFromStore,
+} from '../processes/harvest'
 import { classifyHarvestOutcome } from '../processes/harvest-execution-state'
 import type { HarvestExecution } from '../ports/workspace/harvest-execution'
 import {
@@ -122,6 +140,7 @@ import {
   type LaunchRunnerResult,
   type TickReport,
 } from '../processes/dispatcher'
+import { RepoViewStore } from '../processes/repo-view'
 import {
   BuildControlError,
   buildControlUser,
@@ -154,8 +173,12 @@ const DEFAULT_INTERVAL_MS = 10_000
 const REPO_LEASE_TTL_MS = 60_000
 const REPO_LEASE_HEARTBEAT_MS = 20_000
 /** Repository artifact containing the schema-validated composed Config used by
- * one dispatch run. It is the frontend's only config source. */
-export const DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT = 'dispatcher-effective-config'
+ * one dispatch run. It is the frontend's only config source. Defined in
+ * `store/retention.ts` beside the other kind constants and re-exported here
+ * (the long-standing import path). */
+export { DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT } from '../store/retention'
+// Local uses within this module.
+import { DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT as _effectiveConfigKind } from '../store/retention'
 
 /** JSON encoding in the config schema's declarative input shape. Parsed Config
  * has normalized `{steps, stepConfigs}` sections; flattening named step tables
@@ -196,8 +219,9 @@ function definedEnv(env: Record<string, string | undefined>): Record<string, str
  * the process-local display cache then polls dashboard-visible streams with
  * `getEvents(lastSeq)`, retaining abort cleanup until final completion and reusing unchanged
  * reductions/timing projections. Repository controls and Harvest are still
- * read fresh. The identical-frame check in `live.ts` makes an unchanged paint
- * cost zero terminal writes. */
+ * read fresh through the bounded journal read (AUT-489 subset; AUT-545). The
+ * identical-frame check in `live.ts` makes an unchanged paint cost zero
+ * terminal writes. */
 const DASHBOARD_POLL_MS = 500
 
 /** Dashboard repaint (not re-read) cadence in watch mode. A running step's
@@ -295,7 +319,13 @@ const DEFAULT_TIMERS: TimerScheduler = {
 
 export interface DispatchOpts {
   /** Repo the dispatcher serves (§12: one dispatcher per repo) — the cwd, or
-   * in origin mode a private scratch root. Filesystem consumers only. */
+   * in origin mode a private scratch root. Filesystem consumers only.
+   * Callers without a checkout may pass a non-filesystem identity token
+   * instead (e.g. hosted-dispatcher's `'<hosted-dispatcher>'`): it is a
+   * caller-facing label, not a path, and origin-mode state resolution
+   * replaces it with the per-origin scratch root before any filesystem
+   * consumer — plugin loading, worktrees, exec cwd — runs (AUT-604). The
+   * token therefore never participates in cwd-relative disk resolution. */
   targetRepo: string
   /** Checkout-less origin mode (AUT-302): serve the repository at this origin
    * with no local checkout. CLI `--repository <origin>`, env `AB_REPOSITORY`.
@@ -433,23 +463,37 @@ async function defaultWire(
   // Origin mode: no checkout exists, so the provider's host git seams are
   // replaced by the injected origin and the forge's remote reads.
   const originMode = opts.repository !== undefined
-  if (config.workspace.provider === 'vercel-sandbox') {
-    if (config.forge !== 'github') {
-      throw new Error('vercel-sandbox requires the builtin github forge')
-    }
-    if (!originMode) {
-      const origin = await opts.exec(['git', 'remote', 'get-url', 'origin'], {
-        cwd: opts.targetRepo,
-      })
-      if (origin.exitCode !== 0) throw new Error('vercel-sandbox requires a readable Git origin')
-      validateVercelGithubOrigin(origin.stdout.trim())
-    }
-    if (githubTokenFromEnv(opts.env) === undefined) {
+  // Dispatch preflight is capability-driven (AUT-516): forge support, origin
+  // validation, and required environment all read the selected provider's
+  // registration declarations — builtin and plugin alike — instead of naming
+  // a provider.
+  const workspaceCaps = plugins.workspaceProviders.get(config.workspace.provider)?.capabilities
+  if (workspaceCaps?.supportedForges !== undefined) {
+    if (!workspaceCaps.supportedForges.includes(config.forge)) {
       throw new Error(
-        'vercel-sandbox publication requires GITHUB_TOKEN or GH_TOKEN in the dispatcher environment',
+        workspaceCaps.forgeDispatchMessage ??
+          `workspace provider "${config.workspace.provider}" does not support forge "${config.forge}"`,
       )
     }
   }
+  if (workspaceCaps?.validateOrigin !== undefined && !originMode) {
+    const origin = await opts.exec(['git', 'remote', 'get-url', 'origin'], {
+      cwd: opts.targetRepo,
+    })
+    if (origin.exitCode !== 0)
+      throw new Error(
+        workspaceCaps.originReadFailureMessage ??
+          `workspace provider "${config.workspace.provider}" requires a readable Git origin`,
+      )
+    workspaceCaps.validateOrigin(origin.stdout.trim())
+  }
+  for (const group of workspaceCaps?.requiredEnv ?? []) {
+    if (group.dispatchMessage === undefined) continue
+    const satisfied = group.alternatives.some((names) =>
+      names.every((name) => opts.env[name] !== undefined && opts.env[name] !== ''),
+    )
+    if (!satisfied) throw new Error(group.dispatchMessage)
+  }
   // The builtin GitHub forge resolves its credential lazily on its first
   // request (GITHUB_TOKEN, GH_TOKEN, then the gh CLI login) and names the
   // miss reason on any request that had to go out anonymously; nothing is
@@ -505,6 +549,7 @@ async function defaultWire(
     sandboxSetupCommand: config.commands.setup,
     sandboxRoot: resolve(join(opened.localStateRoot, 'orchestrator-sandboxes')),
     sandboxEnvironmentVariables: config.orchestrator.sandbox.environmentVariables,
+    orchestratorSandboxEnabled: config.orchestrator.enabled,
     ...providerSeams,
     ...(opened.token !== undefined ? { storeToken: opened.token } : {}),
   })
@@ -553,6 +598,8 @@ interface ActiveBuildExecution {
    * running, so the completion chain must append no `execution.ended`, release
    * no lease, settle no publication, and record no wait failure. */
   detaching?: boolean
+  /** A wait failure being recorded; teardown lets it finish rather than drop it. */
+  recording?: Promise<void>
 }
 
 /** The dispatch loop owns deterministic decisions and supervises one
@@ -560,6 +607,10 @@ interface ActiveBuildExecution {
  * Store; child completion is liveness evidence used for reaping/single-flight. */
 class DispatchLoop {
   private readonly dispatcher: Dispatcher
+  /** The incremental repository view (AUT-647) the dispatcher and this
+   * frontend's tick-path journal reads and writes share. Resident for a
+   * watch loop; `--once` builds it cold for its single tick. */
+  private readonly repoView: RepoViewStore
   private readonly host = hostname()
   private readonly maxHarvestRecoveryAttempts = DEFAULT_MAX_HARVEST_RECOVERY_ATTEMPTS
   /** In-flight build and harvest runs (fire-and-forget) — awaited before a
@@ -705,6 +756,8 @@ class DispatchLoop {
     private readonly liveConfig: LiveConfig,
     private readonly wiring: DispatchWiring,
     private readonly opts: DispatchOpts,
+    /** The view `abDispatch` already used for its lifecycle appends. */
+    view?: RepoViewStore,
   ) {
     const config = liveConfig.current().config
     // Minted exactly once per invocation: `wiring.ids` is `randomIds()` and a
@@ -741,8 +794,16 @@ class DispatchLoop {
       return result.text
     }
 
+    // `abDispatch` hands over a view it already used for the lifecycle appends,
+    // so those rows are folded, not re-read, and one flush covers them all.
+    this.repoView =
+      view ??
+      new RepoViewStore(wiring.store, {
+        repo: this.repoIdentity,
+        resident: opts.once !== true,
+      })
     this.dispatcher = new Dispatcher({
-      store: wiring.store,
+      store: this.repoView,
       tickets: wiring.tickets,
       workspaces: wiring.workspaces,
       ...(wiring.retiredWorkspaces === undefined
@@ -779,33 +840,212 @@ class DispatchLoop {
     return this.liveConfig.current()
   }
 
+  /** Resolve this build's pinned pipeline source (SPEC §16.1). Never throws:
+   * every failure — missing build record, absent forge capability, unreadable
+   * branch/base, malformed TOML, store read failure — degrades to `source:
+   * undefined` with the failed attempts classified, never failing the
+   * deposit. The failures feed the caller's fallback diagnostic. */
+  private async resolveBuildPipeline(slug: string): Promise<{
+    source: Awaited<ReturnType<typeof resolvePipelineSource>>
+    failures: PipelineSourceFailure[]
+    events: AbEvent[]
+  }> {
+    const failures: PipelineSourceFailure[] = []
+    try {
+      // The workspace event carries the branch the build was provisioned on;
+      // the record's `branch` (when present) is the same fact. Using the event
+      // keeps this read to the events the caller already needs and avoids an
+      // extra build-record lookup on the hot launch path.
+      const events = await this.repoView.getEvents(slug)
+      const workspace = selectOpenWorkspace(events)
+      const source = await resolvePipelineSource({
+        slug,
+        record: { ...(workspace !== null ? { branch: workspace.branch } : {}) },
+        events,
+        mode: this.opts.repository !== undefined ? 'origin' : 'checkout',
+        forge: this.wiring.forge,
+        checkout: this.opts.targetRepo,
+        exec: this.opts.exec,
+        ...(workspace !== null ? { workspacePath: workspace.path } : {}),
+        onFailure: (failure) => failures.push(failure),
+      })
+      return { source, failures, events }
+    } catch (error) {
+      failures.push({
+        kind: 'store',
+        detail: `build-event read failed: ${error instanceof Error ? error.message : String(error)}`,
+      })
+      return { source: undefined, failures, events: [] }
+    }
+  }
+
   /** Publish the exact composed snapshot into one build-owned namespace. The
-   * child samples only this artifact and never receives config over IPC. */
+   * child samples only this artifact and never receives config over IPC.
+   *
+   * Build-owned sections (verify/finalize/commands/workspace) come from the
+   * build's own branch at its recorded pipeline-source commit; every other
+   * section comes from the live dispatcher snapshot. The source commit travels
+   * in the artifact metadata so status can report which autobuild.toml the
+   * build runs under (SPEC §16.1).
+   *
+   * A failed resolution never rewrites a pinned pipeline: when the build
+   * already has a deposit, its build-owned sections are reused verbatim (the
+   * reload path's rule), because depositing the live base-branch snapshot on a
+   * transient forge/store/git failure is exactly the AUT-366 poisoning. Only
+   * a build with no pinned artifact at all (legacy build, or a first deposit
+   * during an outage) takes the live snapshot. An actionable degradation — a
+   * missing forge capability, a build-branch source that resolved but cannot
+   * be read or parsed, a store failure — files a build-scoped observation
+   * naming the failed attempts; the documented fallbacks (an unpublished
+   * branch, an unreadable legacy base) stay quiet. */
   private async publishBuildConfig(slug: string, snapshot = this.currentConfig()): Promise<void> {
+    const { source, failures, events } = await this.resolveBuildPipeline(slug)
+    if (source !== undefined) {
+      await this.depositBuildConfig(
+        slug,
+        snapshot,
+        composeBuildConfig(source.config, snapshot.config),
+        source.meta,
+      )
+      return
+    }
+    let reused: PipelineSourceMeta | undefined
+    try {
+      const artifact = await this.wiring.store.getArtifact(slug, BUILD_EFFECTIVE_CONFIG_ARTIFACT)
+      if (artifact !== null) {
+        const pinned = parseEffectiveBuildConfig(artifact)
+        reused = parseBuildConfigMetadata(artifact).pipelineSource
+        await this.depositBuildConfig(
+          slug,
+          snapshot,
+          composeBuildConfig(pinned, snapshot.config),
+          reused,
+        )
+      } else {
+        await this.depositBuildConfig(slug, snapshot, snapshot.config)
+      }
+    } catch {
+      // Even the artifact read failed; the live snapshot deposit is the only
+      // option left that keeps the launch alive.
+      await this.depositBuildConfig(slug, snapshot, snapshot.config)
+    }
+    await this.filePipelineFallbackObservation(slug, reused, failures, events)
+  }
+
+  /** File a build-scoped observation when a deposit hit an actionable
+   * pipeline-source failure (SPEC §16.1): the operator must know the deposit
+   * degraded to the last good pipeline or the live snapshot, and why. The
+   * documented fallbacks (unpublished branch, unreadable legacy base) are
+   * normal resolution order and stay quiet. A diagnostic, never a launch
+   * dependency. */
+  private async filePipelineFallbackObservation(
+    slug: string,
+    reused: PipelineSourceMeta | undefined,
+    failures: PipelineSourceFailure[],
+    events: readonly AbEvent[],
+  ): Promise<void> {
+    const actionable = failures.filter(isActionablePipelineFailure)
+    if (actionable.length === 0) return
+    const degradedTo =
+      reused !== undefined
+        ? 'kept the last pinned pipeline' +
+          (reused.commit !== undefined ? ` at ${reused.ref}@${reused.commit}` : ` (${reused.ref})`)
+        : 'deposited the live dispatcher snapshot (legacy fallback)'
+    const summary =
+      `pipeline-source resolution failed; ${degradedTo}. ` +
+      `Failed attempts: ${
+        actionable.map((failure) => `${failure.kind}: ${failure.detail}`).join('; ') ||
+        'none recorded'
+      }`
+    // Deduplicated against the build's log: a parked build re-attaches every
+    // sweep, and an outage must not harvest one identical diagnostic per tick.
+    if (
+      events.some(
+        (event) => event.type === 'observation.recorded' && event.payload.summary === summary,
+      )
+    ) {
+      return
+    }
+    try {
+      await this.wiring.store.append(slug, {
+        // The catalog admits kernel/agent actors for observations (§8.2); the
+        // dispatcher's system-side diagnostic rides the kernel actor, like the
+        // finalize-failure and auto-merge-deferral observations.
+        actor: KERNEL,
+        type: 'observation.recorded',
+        payload: {
+          id: this.wiring.ids('obs'),
+          kind: 'followup',
+          summary,
+          files: ['autobuild.toml'],
+        },
+      })
+    } catch {
+      // The build's pipeline is already deposited; the observation is best-effort.
+    }
+  }
+
+  private async depositBuildConfig(
+    slug: string,
+    snapshot: ConfigSnapshot,
+    config: Config,
+    pipelineSource?: PipelineSourceMeta,
+  ): Promise<void> {
     await this.wiring.store.putArtifact(slug, {
       kind: BUILD_EFFECTIVE_CONFIG_ARTIFACT,
-      content: effectiveBuildConfigContent(snapshot.config),
+      content: effectiveBuildConfigContent(config),
       metadata: {
         revision: snapshot.revision,
         run: this.runId,
+        ...(pipelineSource !== undefined ? { pipelineSource } : {}),
       },
     })
   }
 
+  /** Re-deposit deployment-owned sections to active builds on a reload. The
+   * build-owned sections are reused verbatim from the build's last deposit, so
+   * a base-branch reload can never retarget an in-flight build's pipeline; a
+   * build picks up pipeline changes only from its own branch at its next
+   * launch (SPEC §16.1). */
   private async publishActiveBuildConfigs(snapshot: ConfigSnapshot): Promise<void> {
     await Promise.all(
-      [...this.activeBuildRuns.keys()].map((slug) => this.publishBuildConfig(slug, snapshot)),
+      [...this.activeBuildRuns.keys()].map(async (slug) => {
+        const artifact = await this.wiring.store.getArtifact(slug, BUILD_EFFECTIVE_CONFIG_ARTIFACT)
+        if (artifact === null) {
+          await this.publishBuildConfig(slug, snapshot)
+          return
+        }
+        let existing: Config
+        try {
+          existing = parseEffectiveBuildConfig(artifact)
+        } catch {
+          // A corrupt or pre-pin artifact cannot pin a pipeline; fall back to
+          // the launch-path resolution instead of failing the reload.
+          await this.publishBuildConfig(slug, snapshot)
+          return
+        }
+        const meta = parseBuildConfigMetadata(artifact)
+        await this.depositBuildConfig(
+          slug,
+          snapshot,
+          composeBuildConfig(existing, snapshot.config),
+          meta.pipelineSource,
+        )
+      }),
     )
   }
 
   private async appendStatus(event: RepositoryEventWrite): Promise<void> {
-    await this.wiring.store.appendRepo(this.repoIdentity, event)
+    await this.repoView.appendRepo(this.repoIdentity, event)
   }
 
   private async refreshConfig(): Promise<void> {
     if (this.opts.once === true) return
     // Origin mode reloads from the forge: autobuild.toml at the CURRENT
-    // effective base branch (hot — a rename converges within two ticks).
+    // effective base branch (hot — a rename converges within two ticks). This
+    // read feeds the dispatcher's own snapshot; a reload re-deposits only the
+    // deployment-owned sections to active builds (build-owned pipeline
+    // sections stay pinned to each build's own branch, SPEC §16.1).
     // Restart-required changes keep startup-built adapters and file the
     // existing restart-required observation (LiveConfig semantics).
     const outcome =
@@ -861,8 +1101,10 @@ class DispatchLoop {
   }
 
   private async readDispatchSettings(): Promise<ReturnType<typeof reduceDispatchSettings>> {
-    const events = await this.wiring.store.getRepoEvents(this.repoIdentity)
-    return reduceDispatchSettings(events)
+    // The view's bounded subset (AUT-489): the settings reducer consumes
+    // durable types only. `refresh()` ran first in the tick, so this is the
+    // delta-current journal, never a store read.
+    return reduceDispatchSettings(this.repoView.recordedJournal())
   }
 
   private dispatcherTick(resumeCurrent: boolean): Promise<Awaited<ReturnType<Dispatcher['tick']>>> {
@@ -884,12 +1126,17 @@ class DispatchLoop {
       })
 
       // Unclaimed observations are display-only and sampled once per interactive
-      // dispatcher tick. A failed scan must neither fail dispatch nor replace
-      // the last complete measurement with a fabricated zero.
+      // dispatcher tick from the journal and one repo-scoped digest read
+      // (AUT-487) — flat in the finished-build count. A journal record that
+      // does not yet exist reads as an empty journal (AUT-524); the sample
+      // writes nothing. Any other failed sample must neither fail dispatch nor
+      // replace the last complete measurement with a fabricated zero.
       if (this.dashboard) {
         try {
-          const scan = await scanUnclaimedObservations(this.wiring.store, this.repoIdentity)
-          this.observationCount = scan.observations.length
+          this.observationCount = await sampleUnclaimedObservationCount(
+            this.wiring.store,
+            this.repoIdentity,
+          )
         } catch {
           // Display-only sampling failures retain the last factual count and
           // retry on the next tick; they are not dashboard failures.
@@ -898,6 +1145,7 @@ class DispatchLoop {
 
       // Sample inside the serialized tick, not at process startup. Every
       // dispatcher therefore gates claims from the latest repository facts.
+      await this.repoView.refresh()
       const settings = await this.readDispatchSettings()
       const readyObservation =
         settings.intake || (!this.dashboard && this.opts.kernelRunId === undefined)
@@ -905,6 +1153,7 @@ class DispatchLoop {
           : await this.dispatcher.observeReady()
       const report = await this.dispatcher.tick({
         resumeCurrent,
+        viewRefreshed: true,
         acceptNewWork: settings.intake,
         defaultAutoMerge: settings.defaultAutoMerge,
         autoMergeUser: buildControlUser(this.opts.env),
@@ -1175,6 +1424,7 @@ class DispatchLoop {
       repo: this.repoIdentity,
       user: buildControlUser(this.opts.env),
       setting: 'intake',
+      run: this.runId,
     })
     this.say(`dispatcher intake ${event.enabled ? 'ON' : 'OFF'}`)
     await this.renderOnce()
@@ -1439,6 +1689,7 @@ class DispatchLoop {
         repo: this.repoIdentity,
         user: buildControlUser(this.opts.env),
         setting: 'auto-merge-default',
+        run: this.runId,
       })
       this.say(`dispatcher auto-merge default ${event.enabled ? 'ON' : 'OFF'}`)
       await this.renderOnce()
@@ -2055,8 +2306,11 @@ class DispatchLoop {
       // the pure Store-read pressure check; the guest rescans authoritatively
       // once provisioned, so a threshold crossing between gate and guest scan
       // is never suppressed by this check.
-      const record = await store.getRepo(repo)
-      const events = record === null ? [] : await store.getRepoEvents(repo)
+      // The view's bounded subset (AUT-489): the harvest control decision
+      // reduces durable types only. Take the journal delta first — guests and
+      // other dispatchers write harvest facts between ticks.
+      await this.repoView.refreshJournal()
+      const events = this.repoView.recordedJournal()
       const state = reduceHarvest(events)
       const control = decideHarvestControl(state, this.maxHarvestRecoveryAttempts)
       const resumePending =
@@ -2066,8 +2320,16 @@ class DispatchLoop {
         control.kind === 'request-recovery' ||
         control.kind === 'exhaust-recovery'
       if (!resumePending) {
-        const scan = await scanUnclaimedObservations(store, repo)
-        const pressure = evaluateHarvestPressure(scan, this.currentConfig().config.policy)
+        // Flat-cost gate (AUT-521): the journal read above plus one
+        // repo-scoped digest batch read — no per-build history reads, so the
+        // per-evaluation cost no longer grows with accumulated finished
+        // builds. The guest rescans authoritatively once provisioned.
+        const pressure = await evaluateHarvestPressureFromStore({
+          store,
+          repo,
+          harvestEvents: events,
+          policy: this.currentConfig().config.policy,
+        })
         if (pressure.trigger === undefined) return
       }
 
@@ -2090,7 +2352,7 @@ class DispatchLoop {
         )
       }
       this.hostedHarvest = { execution, handle, detached }
-      const started = await store.appendRepo(repo, {
+      const started = await this.repoView.appendRepo(repo, {
         actor: DISPATCHER,
         type: 'harvest.execution.started',
         payload: {
@@ -2165,7 +2427,10 @@ class DispatchLoop {
     startedSeq: number,
   ): Promise<HarvestRunnerResult> {
     const { store } = this.wiring
-    const events = await store.getRepoEvents(repo)
+    // Bounded subset (AUT-489): classifyHarvestOutcome reduces harvest facts
+    // only. A guest wrote the facts through its own handle, so read the delta.
+    await this.repoView.refreshJournal()
+    const events = this.repoView.recordedJournal()
     const record = await store.getRepo(repo)
     return classifyHarvestOutcome(events, {
       executionStartedSeq: startedSeq,
@@ -2191,7 +2456,7 @@ class DispatchLoop {
       branch: '',
     }
     const reap = await this.reapHostedWorkspace(workspaceHandle)
-    await this.wiring.store.appendRepo(repo, {
+    await this.repoView.appendRepo(repo, {
       actor: DISPATCHER,
       type: 'harvest.execution.released',
       payload: {
@@ -2348,9 +2613,11 @@ class DispatchLoop {
   }
 
   private async settlePendingPublication(slug: string): Promise<void> {
+    // The guest appended through its own handle; settle against fresh state.
+    await this.repoView.refreshBuild(slug)
     await settleWorkspacePublication(
       {
-        store: this.wiring.store,
+        store: this.repoView,
         storeRef: this.wiring.storeRef,
         publication: this.wiring.workspaces.publication,
         forge: this.wiring.forge,
@@ -2373,11 +2640,13 @@ class DispatchLoop {
     cleanupPending: boolean
     identity?: BuildExecutionHandle['identity']
   }): Promise<void> {
+    // The failed executor may have appended through its own handle.
+    await this.repoView.refreshBuild(input.slug)
     await appendInfrastructureFailure(
-      { store: this.wiring.store, ids: this.wiring.ids },
+      { store: this.repoView, ids: this.wiring.ids },
       {
         slug: input.slug,
-        events: await this.wiring.store.getEvents(input.slug),
+        events: await this.repoView.getEvents(input.slug),
         maxAttempts: this.currentConfig().config.policy.maxInfrastructureAttempts,
         provider: input.identity?.provider ?? this.wiring.workspaces.name,
         workspaceRef: input.workspaceRef,
@@ -2408,11 +2677,7 @@ class DispatchLoop {
 
     try {
       await this.publishBuildConfig(slug)
-      leaseClaimed = await this.wiring.store.claimLease(
-        slug,
-        instance,
-        BUILD_EXECUTION_LEASE_TTL_MS,
-      )
+      leaseClaimed = await this.repoView.claimLease(slug, instance, BUILD_EXECUTION_LEASE_TTL_MS)
       if (!leaseClaimed) {
         this.activeBuildRuns.delete(slug)
         await this.appendStatus({
@@ -2423,7 +2688,7 @@ class DispatchLoop {
         this.failureNotice(`build ${slug} already held by another runner — skipped`)
         return 'already-active'
       }
-      const launchEvents = await this.wiring.store.getEvents(slug)
+      const launchEvents = await this.repoView.getEvents(slug)
       let workspaceRef: string | undefined
       let workspaceProvider: string | undefined
       for (const event of launchEvents) {
@@ -2467,7 +2732,7 @@ class DispatchLoop {
         provider: owning.name,
         workspaceRef,
       }
-      await this.wiring.store.append(slug, {
+      await this.repoView.append(slug, {
         actor: DISPATCHER,
         type: 'execution.started',
         payload: { ...identity, instance },
@@ -2482,7 +2747,7 @@ class DispatchLoop {
             // supervisor settles the execution from the Store.
             if (active.detaching) return
             try {
-              await this.wiring.store.append(slug, {
+              await this.repoView.append(slug, {
                 actor: DISPATCHER,
                 type: 'execution.ended',
                 payload: {
@@ -2504,7 +2769,8 @@ class DispatchLoop {
                 return
               }
 
-              const state = reduceBuild(await this.wiring.store.getEvents(slug))
+              await this.repoView.refreshBuild(slug)
+              const state = reduceBuild(await this.repoView.getEvents(slug))
               if (diagnostic === null && exit.exitCode === 0) {
                 await this.appendStatus({
                   actor: DISPATCHER,
@@ -2530,7 +2796,7 @@ class DispatchLoop {
               })
               this.warn(`build ${slug} runner failed: ${detail}`)
             } finally {
-              await this.wiring.store.releaseLease(slug, instance)
+              await this.repoView.releaseLease(slug, instance)
               await this.settlePendingPublication(slug)
             }
           },
@@ -2541,7 +2807,7 @@ class DispatchLoop {
             // A rejected executor completion cannot prove the remote VM was
             // stopped. Keep the lease until expiry: recovery fences and reaps
             // the exact recorded identity before authorizing a replacement.
-            await this.recordInfrastructureFailure({
+            active.recording = this.recordInfrastructureFailure({
               slug,
               instance,
               workspaceRef,
@@ -2550,6 +2816,7 @@ class DispatchLoop {
               cleanupPending: true,
               identity,
             })
+            await active.recording
           },
         )
         .finally(() => {
@@ -2568,7 +2835,9 @@ class DispatchLoop {
         this.activeBuildRuns.delete(slug)
       }
       if (leaseClaimed) {
-        const events = await this.wiring.store.getEvents(slug)
+        // The runner appended through its own handle: take the delta.
+        await this.repoView.refreshBuild(slug)
+        const events = await this.repoView.getEvents(slug)
         let workspaceRef = ''
         for (const event of events) {
           if (event.type === 'workspace.provisioned') workspaceRef = event.payload.ref
@@ -2587,7 +2856,7 @@ class DispatchLoop {
         // Local start failures have no possible remote holder. Remote failures
         // retain the lease until its TTL fences an ambiguous start.
         if (this.wiring.workspaces.recovery === undefined) {
-          await this.wiring.store.releaseLease(slug, instance)
+          await this.repoView.releaseLease(slug, instance)
         }
       }
       await this.appendStatus({
@@ -2683,6 +2952,9 @@ class DispatchLoop {
           } catch {
             // Detach is best-effort: an unresolvable wait still exits.
           }
+          // A wait failure already being recorded is durable work, not
+          // supervision: let it land before the process exits.
+          await entry.recording?.catch(() => {})
           this.activeBuildRuns.delete(slug)
           if (entry.settled !== undefined) {
             this.inFlight.delete(entry.settled)
@@ -2839,9 +3111,14 @@ class DispatchLoop {
       configSnapshot.config,
       configSnapshot.revision,
     )
-    const repoRecord = await this.wiring.store.getRepo(this.repoIdentity)
-    const repositoryEvents =
-      repoRecord === null ? [] : await this.wiring.store.getRepoEvents(this.repoIdentity)
+    // Bounded read (AUT-489, AUT-545): every repository consumer of this frame —
+    // projectRepositoryHarvest (reduceHarvest plus the harvest-only raw scans in
+    // projectHarvestRun/escalationAttentionDismissed) and reduceDispatchSettings —
+    // reduces durable types only, so the AUT-489 subset is replay-equivalent with
+    // no anchor dependence (anchor analysis recorded; the frontend seed needed one
+    // only because reduceDispatchStatus folds here too — it does not here).
+    // Missing journal record stays a read-only empty journal (AUT-524).
+    const repositoryEvents = await readRepoEventsIfRecorded(this.wiring.store, this.repoIdentity)
 
     // Action-triggered and timer refreshes share the cache but may finish their
     // repository reads out of order. Never let an older build snapshot replace
@@ -3162,7 +3439,7 @@ class DispatchLoop {
       const holder = record?.lease?.holder
       if (holder === undefined || this.yieldedTo === holder) return
       this.yieldedTo = holder
-      await this.wiring.store.appendRepo(this.repoIdentity, {
+      await this.repoView.appendRepo(this.repoIdentity, {
         actor: DISPATCHER,
         type: 'dispatcher.tick-yielded',
         payload: {
@@ -3502,10 +3779,23 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
         `origin-mode dispatch requires the builtin github forge, but the fetched autobuild.toml selects ${JSON.stringify(config.forge)}`,
       )
     }
-    if (config.plugins !== undefined && config.plugins.length > 0) {
+    // Origin mode has no checkout, so repository-path plugin specifiers
+    // (relative, absolute, file:) cannot resolve — reject them with the
+    // existing remediation tone before any wiring. Bare package specifiers
+    // are accepted: the shared loadPlugins below resolves them from the
+    // dispatcher's own installation when the scratch root lacks them
+    // (AUT-517), which is exactly "resolvable from the dispatcher's own
+    // installation". The caller-supplied `targetRepo` is an identity token,
+    // not a path, and never reaches plugin resolution: the candidate roots
+    // are the scratch checkout and the installation, per the loadPlugins
+    // call below (AUT-604).
+    const repoPathPlugin = (config.plugins ?? []).find(
+      (moduleSpecifier) => pluginResolutionKind(moduleSpecifier) === 'repo-path',
+    )
+    if (repoPathPlugin !== undefined) {
       throw new Error(
-        'origin-mode dispatch cannot load configured plugins: plugin code is checkout-relative ' +
-          'and there is no checkout. Remove [plugins] from the base branch autobuild.toml or run from a checkout',
+        `origin-mode dispatch cannot load the repository-path plugin ${JSON.stringify(repoPathPlugin)}: ` +
+          'plugin code is checkout-relative and there is no checkout. Remove repository-path entries from [plugins] in the base branch autobuild.toml or run from a checkout',
       )
     }
   } else {
@@ -3524,8 +3814,22 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
   }
   // Configured plugin code is trusted like configured shell commands, but it
   // must resolve, evaluate, validate, and register before production wiring
-  // opens a store, claims a ticket, or launches a runner.
-  const plugins = await loadPlugins(config.plugins, resolvedOpts.targetRepo)
+  // opens a store, claims a ticket, or launches a runner. Skipped-module
+  // notices (builtin duplicate-skip, guest tolerance) surface on dispatch's
+  // own stderr channel.
+  // AUT-604: origin mode's repository candidate root for plugin loading is
+  // the per-origin scratch checkout, never the caller-supplied `targetRepo`
+  // token (e.g. hosted-dispatcher's `'<hosted-dispatcher>'`) — that token is
+  // a caller-facing identity label which `resolveOriginModeState` replaced
+  // with `state.checkout` above, so it never participates in cwd-relative
+  // disk resolution. `state.checkout` equals `resolvedOpts.targetRepo` in
+  // both modes, so passing it as `packageRoot` is behavior-preserving; the
+  // installation candidate (AUT-517) and the disk-first EROFS gate (AUT-587)
+  // are unchanged.
+  const plugins = await loadPlugins(config.plugins, resolvedOpts.targetRepo, {
+    packageRoot: state.checkout,
+    onNotice: (line) => resolvedOpts.stderr(line),
+  })
   // Validate the selector against the complete catalog before either custom
   // wiring or production wiring can open state or perform side effects.
   resolveForgeRegistration(config.forge, plugins)
@@ -3580,7 +3884,7 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
             metadata: { restartRequired: [...restartRequired], effectiveChanged },
           },
           {
-            kind: DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT,
+            kind: _effectiveConfigKind,
             content: effectiveConfigContent(effectiveConfig),
             metadata: { run: runId, effectiveChanged },
           },
@@ -3616,27 +3920,36 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
   // another dispatcher cannot clobber the latest operator choice with a value
   // it inferred at startup. Fresh-repository fallbacks live in the reducer.
   await wiring.store.ensureRepo(state.repo)
+  // Every own lifecycle append goes through one view, restored from snapshots
+  // before the first of them, so a quiet invocation reads none of its own
+  // rows back and the final flush covers `run-stopped` too.
+  const view = new RepoViewStore(wiring.store, {
+    // The loop's store-keyed identity (an explicit `repo` pins it).
+    repo: resolvedOpts.repo ?? resolvedOpts.targetRepo,
+    resident: resolvedOpts.once !== true,
+  })
+  await view.startJournal()
   const actor = humanActor(buildControlUser(resolvedOpts.env))
   if (resolvedOpts.intake !== undefined) {
-    await wiring.store.appendRepo(state.repo, {
+    await view.appendRepo(state.repo, {
       actor,
       type: 'dispatcher.intake-set',
       payload: { enabled: resolvedOpts.intake, run: runId },
     })
   }
   if (resolvedOpts.defaultAutoMerge !== undefined) {
-    await wiring.store.appendRepo(state.repo, {
+    await view.appendRepo(state.repo, {
       actor,
       type: 'dispatcher.auto-merge-default-set',
       payload: { enabled: resolvedOpts.defaultAutoMerge, run: runId },
     })
   }
 
-  await wiring.store.appendRepoWithArtifacts(
+  await view.appendRepoWithArtifacts(
     state.repo,
     [
       {
-        kind: DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT,
+        kind: _effectiveConfigKind,
         content: effectiveConfigContent(config),
         metadata: { run: runId, revision: 0 },
       },
@@ -3657,10 +3970,10 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
     },
   )
 
-  const loop = new DispatchLoop(liveConfig, wiring, resolvedOpts)
+  const loop = new DispatchLoop(liveConfig, wiring, resolvedOpts, view)
   try {
     await loop.run()
-    await wiring.store.appendRepo(state.repo, {
+    await view.appendRepo(state.repo, {
       actor: DISPATCHER,
       type: 'dispatcher.run-stopped',
       payload: {
@@ -3672,7 +3985,7 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
     })
   } catch (error) {
     try {
-      await wiring.store.appendRepo(state.repo, {
+      await view.appendRepo(state.repo, {
         actor: DISPATCHER,
         type: 'dispatcher.run-stopped',
         payload: {
@@ -3687,6 +4000,10 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
     }
     throw error
   } finally {
+    // Every append this invocation made, `run-stopped` included, is in the
+    // view; leave the reduced state behind so the next cold process reads
+    // only what is newer than it.
+    await view.persistSnapshots({ force: true })
     if (resolvedOpts.wire === undefined) await wiring.store.close()
   }
 }