@defrex/autobuild 0.8.0 → 0.9.0

package/packages/core/src/kernel/reducer.ts

@@ -9,7 +9,7 @@
  */
 import type { Actor } from '../events/envelope'
 import type { AbEvent } from '../events/catalog'
-import { normalizeVerifyCompletion, type EventPayload } from '../events/payloads'
+import { normalizeVerifyCompletion, type EventPayload, type PinnedAsset } from '../events/payloads'
 import type {
   ArtifactRef,
   BuildOutcome,
@@ -52,6 +52,8 @@ export interface AnsweredEscalation extends OpenEscalation {
   resolution: EscalationResolution
   /** Exact replacement spec revision authorized by a `revise-spec` answer. */
   artifact?: ArtifactRef
+  /** Ticket assets sampled with a revise-from-ticket authorization. */
+  assets?: PinnedAsset[]
   /** Absolute review budget accepted with a review-round-limit answer. */
   reviewRoundCeiling?: number
   /** seq of the `escalation.answered` event. */
@@ -130,6 +132,11 @@ export interface AutoMergeProjection {
   /** Latest human command. False with no commandSeq means the default: off. */
   requested: boolean
   commandSeq?: number
+  /** The repository seq of the `dispatcher.auto-merge-default-set` fact the
+   * latest answering command (claim-time seed or fan-out) sampled, when one
+   * did. A per-build command with no `defaultSeq` preserves the previous
+   * value, so the default fan-out can tell an override from staleness. */
+  defaultSeq?: number
   /** Latest recorded external application. It may acknowledge an older
    * command; such a stale fact never changes `requested`/`commandSeq`. */
   applied?: { enabled: boolean; commandSeq: number }
@@ -194,6 +201,9 @@ export interface BuildState {
   lastEvent?: AbEvent
   /** 0 for an empty log; `runner.attached {resumedFromSeq}` cites this. */
   lastSeq: number
+  /** Ticket assets the build froze: set by `build.created`, replaced by a
+   * `spec.revised` that carries `assets` (§6.3). Empty for historical logs. */
+  pinnedAssets: PinnedAsset[]
   /** Latest spec artifact rev — `spec.imported`/`spec.authored` set it,
    * `spec.revised` bumps it (§6.3: rev N+1 restarts the build from plan). */
   specRev?: number
@@ -279,6 +289,16 @@ export interface BuildState {
   failures: Record<string, number>
 }
 
+/** Whether the build carries an outstanding `discardRequest`. Present exactly
+ * while the build is non-terminal and its discard is unsettled; the reducer
+ * settles it only by terminal completion. This is the single predicate shared
+ * by the auto-merge default fan-out (`autoMergeDefaultEligible`, AUT-418) and
+ * the per-build consent guard (`controlBuild`'s `discard-pending` refusal), so
+ * the two controls' discard exclusions cannot diverge silently. */
+export function discardInFlight(state: Pick<BuildState, 'discardRequest'>): boolean {
+  return state.discardRequest !== undefined
+}
+
 export function reduceBuild(events: AbEvent[]): BuildState {
   let attached = false
   let pausedFlag = false
@@ -295,6 +315,7 @@ export function reduceBuild(events: AbEvent[]): BuildState {
   const autoMerge: AutoMergeProjection = { requested: false }
   let specRev: number | undefined
   let restartSince = 0
+  let pinnedAssets: PinnedAsset[] = []
   let finalizeCompletedSeq = 0
   const finalizeSteps: BuildState['finalizeSteps'] = []
   const plan: BuildState['plan'] = { round: 0, approved: false }
@@ -347,6 +368,8 @@ export function reduceBuild(events: AbEvent[]): BuildState {
       // Facts the projection does not need (workspace liveness is the
       // dispatcher's concern; finalize post-steps are failure-tolerant §5).
       case 'build.created':
+        pinnedAssets = event.payload.assets ?? []
+        break
       case 'workspace.provisioned':
       case 'workspace.released':
       case 'publication.requested':
@@ -443,10 +466,23 @@ export function reduceBuild(events: AbEvent[]): BuildState {
       case 'build.auto-merge-requested':
         autoMerge.requested = true
         autoMerge.commandSeq = event.seq
+        // A fan-out (or seeded) command carries the default fact it answers; a
+        // bare per-build command must preserve the previous provenance.
+        if (event.payload.defaultSeq !== undefined) autoMerge.defaultSeq = event.payload.defaultSeq
         break
       case 'build.auto-merge-cancelled':
         autoMerge.requested = false
         autoMerge.commandSeq = event.seq
+        if (event.payload.defaultSeq !== undefined) autoMerge.defaultSeq = event.payload.defaultSeq
+        break
+      case 'build.auto-merge-default-observed':
+        // A no-op fan-out still advances the build's provenance. Without it, a
+        // matching default fact would stay strictly ahead of a bare per-build
+        // command and be re-applied on the next tick, reverting the operator's
+        // explicit choice (f_28b3fba1).
+        if (event.payload.defaultSeq > (autoMerge.defaultSeq ?? 0)) {
+          autoMerge.defaultSeq = event.payload.defaultSeq
+        }
         break
       case 'build.paused':
         pausedFlag = true
@@ -467,6 +503,7 @@ export function reduceBuild(events: AbEvent[]): BuildState {
         break
       case 'spec.revised':
         specRev = event.payload.artifact.rev
+        if (event.payload.assets !== undefined) pinnedAssets = event.payload.assets
         // §6.3: rev N+1 restarts the build from plan. The restart boundary
         // invalidates every approval and result at or before it, so it is also
         // a verify cycle boundary. Finalize post-steps remain in full-log
@@ -661,6 +698,7 @@ export function reduceBuild(events: AbEvent[]): BuildState {
             answer: event.payload.answer,
             resolution: event.payload.resolution,
             ...(event.payload.artifact !== undefined ? { artifact: event.payload.artifact } : {}),
+            ...(event.payload.assets !== undefined ? { assets: event.payload.assets } : {}),
             ...(event.payload.reviewRoundCeiling !== undefined
               ? { reviewRoundCeiling: event.payload.reviewRoundCeiling }
               : {}),
@@ -725,6 +763,7 @@ export function reduceBuild(events: AbEvent[]): BuildState {
     finalizeSteps,
     lastEvent,
     lastSeq: lastEvent?.seq ?? 0,
+    pinnedAssets,
     specRev,
     restartSince,
     plan,

package/packages/core/src/operator/annotations.ts

@@ -182,6 +182,12 @@ export const OPERATOR_TOOL_ANNOTATIONS = {
     idempotentHint: false,
     approval: 'default',
   },
+  'sandbox.publish': {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    approval: 'default',
+  },
 } as const satisfies Record<string, ToolAnnotationsTableEntry>
 
 export type OperatorToolName = keyof typeof OPERATOR_TOOL_ANNOTATIONS

package/packages/core/src/operator/control.ts

@@ -29,19 +29,27 @@ export async function setRepositorySetting(opts: {
   enabled: boolean
   /** Delegated-write attribution marker threaded onto the event's actor. */
   via?: Via
+  /** Dispatcher invocation that performed the write. Present on the
+   * dashboard/launch-flag write paths so the two are distinguishable in the
+   * journal; optional so the operator API (which has no run) is unchanged. */
+  run?: string
 }): Promise<{ enabled: boolean; event: RepositoryEventEnvelope }> {
   await opts.store.ensureRepo(opts.repo)
+  const payload = {
+    enabled: opts.enabled,
+    ...(opts.run !== undefined ? { run: opts.run } : {}),
+  }
   const event =
     opts.setting === 'intake'
       ? await opts.store.appendRepo(opts.repo, {
           actor: humanActor(opts.user, opts.via),
           type: 'dispatcher.intake-set',
-          payload: { enabled: opts.enabled },
+          payload,
         })
       : await opts.store.appendRepo(opts.repo, {
           actor: humanActor(opts.user, opts.via),
           type: 'dispatcher.auto-merge-default-set',
-          payload: { enabled: opts.enabled },
+          payload,
         })
   return { enabled: opts.enabled, event }
 }
@@ -52,9 +60,12 @@ export async function toggleRepositorySetting(opts: {
   user: string
   setting: RepositorySetting
   via?: Via
+  /** Dispatcher invocation that performed the write (see setRepositorySetting). */
+  run?: string
 }): Promise<{ enabled: boolean; event: RepositoryEventEnvelope }> {
   await opts.store.ensureRepo(opts.repo)
-  const settings = reduceDispatchSettings(await opts.store.getRepoEvents(opts.repo))
+  // Bounded read (AUT-489): the settings reducer consumes durable types only.
+  const settings = reduceDispatchSettings(await opts.store.getRepoStateEvents(opts.repo))
   const enabled = opts.setting === 'intake' ? !settings.intake : !settings.defaultAutoMerge
   return setRepositorySetting({ ...opts, enabled })
 }
@@ -66,7 +77,8 @@ export async function toggleHarvestGate(opts: {
   via?: Via
 }): Promise<{ command: 'pause' | 'resume'; event: RepositoryEventEnvelope }> {
   await opts.store.ensureRepo(opts.repo)
-  const state = reduceHarvest(await opts.store.getRepoEvents(opts.repo))
+  // Bounded read (AUT-489): the harvest reducer consumes durable types only.
+  const state = reduceHarvest(await opts.store.getRepoStateEvents(opts.repo))
   const pending = state.pendingCommands.at(-1)
   const requestedPaused = pending === undefined ? state.paused : pending.command === 'pause'
   const command = requestedPaused ? 'resume' : 'pause'
@@ -87,7 +99,9 @@ export async function controlHarvestRun(opts: {
   via?: Via
 }): Promise<{ action: HarvestRunAction; event: RepositoryEventEnvelope }> {
   await opts.store.ensureRepo(opts.repo)
-  const events = await opts.store.getRepoEvents(opts.repo)
+  // Bounded read (AUT-489): the harvest reducer and the dashboard harvest
+  // projection consume durable types only.
+  const events = await opts.store.getRepoStateEvents(opts.repo)
   const state = reduceHarvest(events)
   const projected = projectHarvest(events)
   if (projected === undefined || projected.run !== opts.run) {

package/packages/core/src/operator/index.ts

@@ -1,7 +1,7 @@
-export { OperatorApiClient, OperatorApiError } from './client'
-export type { DownloadedArtifact, OperatorApiClientOptions } from './client'
-export { createOperatorServer } from './server'
-export type { OperatorServerOptions } from './server'
+// Core's operator surface: the tool registry behind `ab mcp`, the CLI-facing
+// control/query/tickets/requests primitives, and the operator wire protocol.
+// The operator HTTP server and client ship in
+// `@defrex/autobuild-hosted-store-service` (see its `operator-api` subpath).
 export {
   answerRequestSchema,
   buildControlRequestSchema,
@@ -9,6 +9,10 @@ export {
   bulkControlRequestSchema,
   harvestControlRequestSchema,
   operatorErrorSchema,
+  sessionApprovalRequestSchema,
+  sessionCreateRequestSchema,
+  sessionMessageRequestSchema,
+  sessionWakeRequestSchema,
   settingRequestSchema,
   ticketBlockerRequestSchema,
   ticketCreateRequestSchema,
@@ -19,6 +23,10 @@ export type {
   OperatorAnswerRequest,
   OperatorBuildControlRequest,
   OperatorErrorBody,
+  OperatorSessionApprovalRequest,
+  OperatorSessionCreateRequest,
+  OperatorSessionMessageRequest,
+  OperatorSessionWakeRequest,
   OperatorTicketBlockerRequest,
   OperatorTicketCreateRequest,
   OperatorTicketMoveRequest,
@@ -29,8 +37,32 @@ export type {
   OperatorBuildView,
   OperatorDashboardSnapshot,
 } from './query'
-export { OperatorControlError } from './control'
-export { OperatorQueryError } from './query'
+export {
+  controlHarvestRun,
+  OperatorControlError,
+  setRepositorySetting,
+  toggleHarvestGate,
+  toggleRepositorySetting,
+} from './control'
+export {
+  getHarvestStatus,
+  getOperatorBuild,
+  getOperatorDashboard,
+  getRepositoryStatus,
+  listOperatorBuilds,
+  OperatorQueryError,
+  OrchestratorConfigError,
+  orchestratorConfig,
+} from './query'
+export {
+  orchestratorWakeGlobs,
+  ORCHESTRATOR_ROUTE_LIMIT_SECONDS,
+  type OrchestratorConfig,
+} from '../config/schema'
+export type { OrchestratorTurnRunner } from '../orchestrator/turn-runner'
+export { createOrchestratorTurnRunner } from '../orchestrator/turn-runner'
+export { randomIds } from '../ids'
+export type { Config } from '../config/schema'
 export {
   OPERATOR_NOTES_ARTIFACT,
   TOOLS,
@@ -59,4 +91,37 @@ export type {
   OperatorTicketDetail,
   OperatorTicketQueue,
 } from './tickets'
+export {
+  getOperatorTicket,
+  listOperatorTickets,
+  mutateOperatorTicket,
+} from './tickets'
+export type { OperatorSandboxService } from './sandbox'
 export * from './presentation'
+
+/**
+ * Hosted operator-server composition. The moved server (in
+ * `@defrex/autobuild-hosted-store-service`) builds its routes from these core
+ * primitives; they are re-exported here so the hosted package needs no core
+ * internals. Deliberately not a general public API — do not grow it for
+ * core-internal convenience.
+ */
+export {
+  BuildControlError,
+  controlBuild,
+  type BuildControlAction,
+  type BuildControlResult,
+} from '../cli/build-control'
+export {
+  BulkWalkError,
+  bulkControlRepository,
+  type BulkControlSummary,
+} from '../cli/bulk-control'
+export { effectiveStatus } from '../cli/dashboard/model'
+export { reduceBuild } from '../kernel/reducer'
+export { TicketOperationError } from '../ports/tickets/operations'
+export { humanActor, type Via } from '../events/envelope'
+export type { HarvestStatusView } from '../cli/harvest'
+export type { RepositoryStatus } from '../cli/repository-status'
+export type { BuildSummary } from '../cli/status'
+export type { SessionRecord } from '../store/types'

package/packages/core/src/operator/query.ts

@@ -1,16 +1,27 @@
+import { composeBuildConfig } from '../config/live'
+import type { PipelineSourceMeta } from '../config/pipeline-source'
 import { configSchema, type Config } from '../config/schema'
+import {
+  BUILD_EFFECTIVE_CONFIG_ARTIFACT,
+  parseBuildConfigMetadata,
+  parseEffectiveBuildConfig,
+} from '../processes/build-execution-state'
+import type { Artifact } from '../store/types'
 import { detail, statusFilter, summarize, type BuildDetail, type BuildSummary } from '../cli/status'
 import { projectRepositoryStatus, type RepositoryStatus } from '../cli/repository-status'
 import { projectHarvestStatus, type HarvestStatusView } from '../cli/harvest'
 import {
   buildDashboardFromProjected,
+  effectiveStatus,
   projectBuild,
   type DashboardBuild,
   type DashboardModel,
 } from '../cli/dashboard/model'
-import { reduceBuild } from '../kernel/reducer'
+import { reduceBuild, type BuildState } from '../kernel/reducer'
+import { DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT } from '../store/retention'
 import { reduceDispatchStatus } from '../kernel/dispatch-status'
-import { scanUnclaimedObservations } from '../processes/harvest'
+import { readRepoEventsIfRecorded, unclaimedObservationCount } from '../processes/harvest'
+import type { RepositoryEvent } from '../events/repository'
 import type { BuildStore, Clock } from '../store/types'
 
 export type BuildListScope = 'active' | 'queued' | 'all'
@@ -25,10 +36,6 @@ export class OperatorQueryError extends Error {
   }
 }
 
-async function repoEvents(store: BuildStore, repo: string) {
-  return (await store.getRepo(repo)) === null ? [] : store.getRepoEvents(repo)
-}
-
 export async function listOperatorBuilds(opts: {
   store: BuildStore
   repo: string
@@ -36,9 +43,40 @@ export async function listOperatorBuilds(opts: {
   now: Date
 }): Promise<BuildSummary[]> {
   const statuses = new Set(statusFilter(opts.scope === 'all', opts.scope === 'queued'))
+  // Records are read and held before the digest read: builds are never
+  // deleted, so every record iterated below is guaranteed an entry in the
+  // digest map fetched after it — a build created between the two reads
+  // appears only in the digest map, which is harmless — and the completeness
+  // check can only ever catch a genuine adapter bug, never a concurrent
+  // dispatch. The reverse order would let a concurrent creation abort the
+  // whole listing (AUT-488 finding f_3cb67aba).
+  const records = await opts.store.listBuilds()
+  // One digest read gates the per-build history reads (AUT-488): the active
+  // and queued scopes never show a terminal build, so a build whose digest
+  // already carries a terminal fact skips its `getEvents` round trip and the
+  // listing's store cost stays flat as finished builds accumulate. The `--all`
+  // scope includes terminal statuses, so it takes no digest read and skips
+  // nothing — byte-for-byte the old loop.
+  const digests = opts.scope === 'all' ? undefined : await opts.store.getRepoBuildDigests(opts.repo)
   const output: BuildSummary[] = []
-  for (const record of await opts.store.listBuilds()) {
+  for (const record of records) {
     if (record.repo !== opts.repo) continue
+    if (digests !== undefined) {
+      // Completeness is contractual (one entry per repo build); a missing
+      // entry is an adapter bug and must fail loudly rather than silently
+      // drop the build from the listing.
+      const digest = digests.get(record.slug)
+      if (digest === undefined) {
+        throw new Error(`getRepoBuildDigests is missing an entry for build "${record.slug}"`)
+      }
+      // The digest's `terminal` follows `reduceBuild`'s terminal rule exactly
+      // (in-order overwrite of `build.completed`/`build.aborted`, never
+      // cleared — pinned against `reduceBuild` in store/digest.test.ts), so
+      // `terminal !== undefined` is exactly reduced status `done`/`aborted`,
+      // which the active and queued status sets never include. Skipping the
+      // history read therefore cannot change the emitted summaries.
+      if (digest.terminal !== undefined) continue
+    }
     const projected = summarize(record, await opts.store.getEvents(record.slug), opts.now)
     if (statuses.has(projected.status)) output.push(projected)
   }
@@ -59,10 +97,10 @@ export async function effectiveConfig(
   repo: string,
 ): Promise<{
   config: Config
-  repositoryEvents: Awaited<ReturnType<typeof repoEvents>>
+  repositoryEvents: RepositoryEvent[]
   status: ReturnType<typeof reduceDispatchStatus>
 }> {
-  const repositoryEvents = await repoEvents(store, repo)
+  const repositoryEvents = await readRepoEventsIfRecorded(store, repo)
   let latestRun: string | undefined
   for (const event of repositoryEvents) {
     if (event.type === 'dispatcher.run-started') latestRun = event.payload.run
@@ -112,6 +150,65 @@ export interface OperatorBuildView {
   dashboardRow: DashboardBuild | null
 }
 
+interface PinnedProjection {
+  config: Config
+  revision?: number
+  pipelineSource?: PipelineSourceMeta
+}
+
+/** Read one build's pinned effective-config artifact (SPEC §16.1): its parsed
+ * build-owned sections composed over the live snapshot's deployment-owned
+ * ones, plus the artifact's metadata projection. Every row must be projected
+ * against the pipeline the build actually runs — the artifact's build-owned
+ * sections — never the dispatcher's live base-branch snapshot, which a pinned
+ * build may never execute. All read failures are display-only: an absent or
+ * malformed artifact degrades to the live config, the pre-pin behavior. */
+async function readPinnedConfig(
+  store: BuildStore,
+  slug: string,
+  live: Config,
+): Promise<PinnedProjection> {
+  let artifact: Artifact | null
+  try {
+    artifact = await store.getArtifact(slug, BUILD_EFFECTIVE_CONFIG_ARTIFACT)
+  } catch {
+    artifact = null
+  }
+  if (artifact === null) return { config: live }
+  let config: Config
+  try {
+    config = composeBuildConfig(parseEffectiveBuildConfig(artifact), live)
+  } catch {
+    config = live
+  }
+  return { config, ...parseBuildConfigMetadata(artifact) }
+}
+
+/** The shared null-row gate (AUT-486 snapshot, AUT-496 getOperatorBuild,
+ * AUT-487 digest): `effectiveStatus` maps only `done` outside the visible set
+ * (cli/dashboard/model.ts `isVisible`), so `projectBuild` returns null
+ * exactly for this state, and a pinned effective-config read for such a
+ * build could never be surfaced. One predicate so every consumer cannot
+ * diverge from each other or from the row projection: the digest's `terminal`
+ * is a third consumer of the same gate — `terminal === 'done'` is exactly
+ * `reduceBuild(...).status === 'done'` — and the snapshot uses it to skip a
+ * finished build's history and pinned-config reads without weakening this
+ * predicate as the authority. If cli/dashboard/model.ts ever adds a
+ * non-visible status, this predicate must follow — the snapshot
+ * byte-identical differential test and the done/aborted query tests pin the
+ * coupling. */
+function projectsNoDashboardRow(state: BuildState): boolean {
+  return effectiveStatus(state) === 'done'
+}
+
+/** Attach the effective-config metadata (SPEC §16.1) to a projected row so an
+ * operator can see which autobuild.toml the build runs under. */
+function decorateWithPinnedMeta(row: DashboardBuild, pinned: PinnedProjection): DashboardBuild {
+  if (pinned.revision !== undefined) row.effectiveConfigRev = pinned.revision
+  if (pinned.pipelineSource !== undefined) row.pipelineSource = pinned.pipelineSource
+  return row
+}
+
 export async function getOperatorBuild(opts: {
   store: BuildStore
   repo: string
@@ -122,22 +219,32 @@ export async function getOperatorBuild(opts: {
   const events = await opts.store.getEvents(opts.slug)
   const state = reduceBuild(events)
   const { config } = await effectiveConfig(opts.store, opts.repo)
-  const dashboardRow = projectBuild(record, state, config, events)
-  return { detail: detail(record, events, opts.now), dashboardRow }
+  let dashboardRow: DashboardBuild | null = null
+  if (!projectsNoDashboardRow(state)) {
+    const pinned = await readPinnedConfig(opts.store, opts.slug, config)
+    const row = projectBuild(record, state, config, events, undefined, pinned.config)
+    // Implied by the gate; kept as an explicit check (not an assertion) so the
+    // code never lies if `effectiveStatus` and `projectBuild` ever drift.
+    if (row !== null) dashboardRow = decorateWithPinnedMeta(row, pinned)
+  }
+  return {
+    detail: detail(record, events, opts.now),
+    dashboardRow,
+  }
 }
 
 export async function getRepositoryStatus(
   store: BuildStore,
   repo: string,
 ): Promise<RepositoryStatus> {
-  return projectRepositoryStatus(repo, await repoEvents(store, repo))
+  return projectRepositoryStatus(repo, await readRepoEventsIfRecorded(store, repo))
 }
 
 export async function getHarvestStatus(
   store: BuildStore,
   repo: string,
 ): Promise<HarvestStatusView> {
-  return projectHarvestStatus(repo, await repoEvents(store, repo))
+  return projectHarvestStatus(repo, await readRepoEventsIfRecorded(store, repo))
 }
 
 export interface OperatorDashboardSnapshot {
@@ -157,17 +264,50 @@ export async function getOperatorDashboard(opts: {
   clock: Clock
 }): Promise<OperatorDashboardSnapshot> {
   const { config, repositoryEvents, status } = await effectiveConfig(opts.store, opts.repo)
+  const records = await opts.store.listBuilds()
+  // One digest read covers every build of the repository (AUT-487): the
+  // row gate (a `done` digest means no row) and the observation count no
+  // longer need per-build histories, so the snapshot's store traffic stays
+  // flat as finished builds accumulate. Row-rendering builds still get their
+  // full history below, and the digest itself is derived from the event log
+  // on every call — nothing is persisted or cached between snapshots.
+  const digests = await opts.store.getRepoBuildDigests(opts.repo)
   const projected: DashboardBuild[] = []
   let activeCount = 0
-  for (const record of await opts.store.listBuilds()) {
+  for (const record of records) {
     if (record.repo !== opts.repo) continue
+    const digest = digests.get(record.slug)
+    // Completeness is contractual (one entry per repo build); a missing entry
+    // is an adapter bug and must fail loudly rather than silently drop the
+    // build from the active count or the row list.
+    if (digest === undefined) {
+      throw new Error(`getRepoBuildDigests is missing an entry for build "${record.slug}"`)
+    }
+    // Reduced status is `done`/`aborted` exactly when a terminal fact exists,
+    // so `terminal === undefined` is exactly the old active test — no history
+    // read needed for the count.
+    if (digest.terminal === undefined) activeCount += 1
+    if (digest.terminal === 'done') continue
+    // Both query surfaces share the `projectsNoDashboardRow` gate (AUT-486
+    // snapshot, AUT-496 detail query): a build that projects no row —
+    // `effectiveStatus` maps only `done` outside the visible set — never
+    // reads its pinned effective-config artifact, because the read result
+    // could never be surfaced. The digest already excluded `done` builds
+    // above; the gate stays as the authority for the row projection so the
+    // digest and the reducer cannot silently diverge. Every row-rendering
+    // build still gets its full history and pinned pipeline.
     const events = await opts.store.getEvents(record.slug)
     const state = reduceBuild(events)
-    if (state.status !== 'done' && state.status !== 'aborted') activeCount += 1
-    const row = projectBuild(record, state, config, events)
-    if (row !== null) projected.push(row)
+    if (projectsNoDashboardRow(state)) continue
+    const pinned = await readPinnedConfig(opts.store, record.slug, config)
+    const row = projectBuild(record, state, config, events, undefined, pinned.config)
+    if (row !== null) projected.push(decorateWithPinnedMeta(row, pinned))
   }
-  const scan = await scanUnclaimedObservations(opts.store, opts.repo)
+  // The unclaimed-observation count comes from the digests and the journal
+  // `effectiveConfig` already returned — no per-build history reads (AUT-487).
+  // The pure core writes nothing — a snapshot performs no store writes and
+  // never creates or locks the repository record.
+  const observationCount = unclaimedObservationCount({ digests, harvestEvents: repositoryEvents })
   const warningLines = [
     ...status.roleWarnings,
     ...(status.warningNotice !== undefined ? [status.warningNotice] : []),
@@ -179,7 +319,7 @@ export async function getOperatorDashboard(opts: {
       queued: status.queued ?? 0,
       activeCount,
       capacity: config.capacity,
-      observationCount: scan.observations.length,
+      observationCount,
       observationLimit: config.policy.harvestThreshold,
       ...(status.availableUpgrade !== undefined
         ? { availableUpgrade: status.availableUpgrade }
@@ -199,3 +339,52 @@ export async function getOperatorDashboard(opts: {
     },
   }
 }
+
+/** Thrown when a deposited `dispatcher-effective-config` artifact exists but
+ * cannot be parsed or validated: the hosted message route maps this to a 500
+ * `internal` — a broken config must never silently disable the orchestrator
+ * (AUT-342). */
+export class OrchestratorConfigError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'OrchestratorConfigError'
+  }
+}
+
+/** The repository's orchestrator configuration, resolved from the latest
+ * deposited `dispatcher-effective-config` artifact (AUT-342). Returns null
+ * when no artifact exists — the orchestrator is disabled, and message
+ * posting behaves exactly as it did before this feature. Throws
+ * `OperatorQueryError` (code `effective-config-unavailable`) when an
+ * artifact exists but is unreadable or invalid: a deployment that deposited
+ * a broken config must fail loudly (a 500 on the message route), never
+ * silently disable the orchestrator. */
+export async function orchestratorConfig(store: BuildStore, repo: string): Promise<Config | null> {
+  // A repository the store has no record for has no deposited artifact and
+  // no dispatcher history: the orchestrator is disabled there.
+  if ((await store.getRepo(repo)) === null) return null
+  const artifacts = await store.listRepoArtifacts(repo, DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT)
+  if (artifacts.length === 0) return null
+  const latest = [...artifacts].sort((a, b) => b.revision - a.revision)[0]!
+  const artifact = await store.getRepoArtifact(repo, latest.kind, latest.revision)
+  if (artifact === null) {
+    throw new OrchestratorConfigError(
+      `effective config ${latest.kind}@${latest.revision} is not retrievable`,
+    )
+  }
+  let raw: unknown
+  try {
+    raw = JSON.parse(new TextDecoder().decode(artifact.content))
+  } catch {
+    throw new OrchestratorConfigError(
+      `effective config ${latest.kind}@${latest.revision} is not valid JSON`,
+    )
+  }
+  const parsed = configSchema.safeParse(raw)
+  if (!parsed.success) {
+    throw new OrchestratorConfigError(
+      `effective config ${latest.kind}@${latest.revision} is invalid: ${parsed.error.message}`,
+    )
+  }
+  return parsed.data.orchestrator.enabled ? parsed.data : null
+}