@defrex/autobuild 0.8.0 → 0.9.0

package/packages/core/src/cli/dispatch-frontend.ts

@@ -3,7 +3,7 @@ import { humanActor } from '../events/envelope'
 import type { RepositoryEvent } from '../events/repository'
 import { reduceDispatchStatus, type DispatchStatus } from '../kernel/dispatch-status'
 import type { BuildState } from '../kernel/reducer'
-import { scanUnclaimedObservations } from '../processes/harvest'
+import { sampleUnclaimedObservationCount } from '../processes/harvest'
 import {
   controlHarvestRun,
   OperatorControlError,
@@ -120,6 +120,9 @@ export class DispatchFrontend {
   private readonly keyboard
   private child: DispatchChildHandle | undefined
   private repositorySeq = 0
+  /** Set only after a successful initial fold; every later `events()` call
+   * takes the delta path. */
+  private seeded = false
   private repositoryEvents: RepositoryEvent[] = []
   private dispatchStatus: DispatchStatus = reduceDispatchStatus([], this.runId)
   private eventRefreshTail: Promise<void> = Promise.resolve()
@@ -164,6 +167,36 @@ export class DispatchFrontend {
    * are retained for their existing replay reducers. */
   private async events(): Promise<RepositoryEvent[]> {
     const refresh = this.eventRefreshTail.then(async () => {
+      if (!this.seeded) {
+        // Initial fold (AUT-534): the whole-journal read the first poll used
+        // to pay is replaced by AUT-489's bounded read where that is provably
+        // equivalent. The bounded attempt is confined to the pre-launch
+        // window (`this.child === undefined`): before `launchChild` no
+        // run-scoped journal fact can carry `this.runId` (only the supervised
+        // child appends run-scoped facts with it), so every run-scoped event
+        // in the bounded subset is skipped by `reduceDispatchStatus` exactly
+        // as it would be in a full replay, and the dashboard filter keeps
+        // only durable types, which the subset carries in full. After launch
+        // a bounded subset cannot guarantee the child's `run-started` under a
+        // competing dispatcher's later anchor — dropping it would leave
+        // `effectiveConfig` unset and the first frame would never render —
+        // so a post-launch seed always takes the full read (the pre-AUT-534
+        // behavior). `once` mode's teardown fold runs after the child exits,
+        // so the same guard routes it to the full read.
+        const seed =
+          this.child === undefined
+            ? await this.opts.store.getRepoStateEvents(this.opts.repo).catch(() =>
+                // Bounded-read failure falls back to the exact pre-AUT-534
+                // full read within this same seed attempt.
+                this.opts.store.getRepoEvents(this.opts.repo, 0),
+              )
+            : await this.opts.store.getRepoEvents(this.opts.repo, 0)
+        this.repositorySeq = seed.at(-1)?.seq ?? 0
+        this.dispatchStatus = reduceDispatchStatus(seed, this.runId)
+        this.repositoryEvents.push(...seed.filter(isDashboardRepositoryEvent))
+        this.seeded = true
+        return
+      }
       const delta = await this.opts.store.getRepoEvents(this.opts.repo, this.repositorySeq)
       if (delta.length === 0) return
       this.repositorySeq = delta.at(-1)!.seq
@@ -295,8 +328,14 @@ export class DispatchFrontend {
     }
     const config = await this.loadConfig(ref.kind, ref.rev)
     try {
-      const scan = await scanUnclaimedObservations(this.opts.store, this.opts.repo)
-      this.observationCount = scan.observations.length
+      // Journal + digests (AUT-487): one journal read for the claimed set
+      // (this class's cached `repositoryEvents` is dashboard-filtered, so the
+      // claimed set needs the full journal, exactly as the old per-build scan
+      // read it) plus one repo-scoped digest read — the sample's store
+      // traffic stays flat as finished builds accumulate. A journal record
+      // that does not yet exist reads as an empty journal (AUT-524); the
+      // sample writes nothing.
+      this.observationCount = await sampleUnclaimedObservationCount(this.opts.store, this.opts.repo)
     } catch {
       // Before the first successful sample there is no factual zero to place in
       // a complete frame. Leave the prior frame untouched and retry on the next
@@ -677,6 +716,7 @@ export class DispatchFrontend {
       repo: this.opts.repo,
       user: buildControlUser(this.opts.env),
       setting: 'intake',
+      run: this.runId,
     })
     await this.report(`dispatcher intake ${event.enabled ? 'ON' : 'OFF'}`)
     await this.renderOnce()
@@ -688,6 +728,7 @@ export class DispatchFrontend {
       repo: this.opts.repo,
       user: buildControlUser(this.opts.env),
       setting: 'auto-merge-default',
+      run: this.runId,
     })
     await this.report(`dispatcher auto-merge default ${event.enabled ? 'ON' : 'OFF'}`)
     await this.renderOnce()
@@ -990,17 +1031,25 @@ export class DispatchFrontend {
       await this.opts.store.appendRepo(this.opts.repo, {
         actor,
         type: 'dispatcher.intake-set',
-        payload: { enabled: this.opts.intake },
+        payload: { enabled: this.opts.intake, run: this.runId },
       })
     }
     if (this.opts.defaultAutoMerge !== undefined) {
       await this.opts.store.appendRepo(this.opts.repo, {
         actor,
         type: 'dispatcher.auto-merge-default-set',
-        payload: { enabled: this.opts.defaultAutoMerge },
+        payload: { enabled: this.opts.defaultAutoMerge, run: this.runId },
       })
     }
 
+    // Warm the initial fold before `launchChild` (AUT-534): the bounded seed
+    // is only safe while `this.child === undefined`, so the one opportunity
+    // to take it is here. A failed warm-up leaves the seed unset; the poll
+    // loop's existing failure reporting covers the retry, which then takes
+    // the full-read path post-launch. `once` mode gains no read — its single
+    // fold runs from `finishPresentation()` after the child exits.
+    if (!this.opts.once) await this.events().catch(() => {})
+
     const options: DispatchChildOptions = {
       targetRepo: this.opts.checkout ?? this.opts.repo,
       storeRef: this.opts.storeRef,

package/packages/core/src/cli/dispatch.ts

@@ -28,13 +28,25 @@ import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 import semver from 'semver'
 import { parseConfig } from '../config/load'
-import { DISPATCHER_CONFIG_ARTIFACT, LiveConfig, type ConfigSnapshot } from '../config/live'
+import {
+  composeBuildConfig,
+  DISPATCHER_CONFIG_ARTIFACT,
+  LiveConfig,
+  type ConfigSnapshot,
+} from '../config/live'
+import {
+  isActionablePipelineFailure,
+  resolvePipelineSource,
+  type PipelineSourceFailure,
+  type PipelineSourceMeta,
+} from '../config/pipeline-source'
 import { effectiveRuntimeReferences, roleKeyWarnings, SLUG_ROLE } from '../config/roles'
 import type { Config } from '../config/schema'
-import { loadPlugins } from '../plugins/load'
+import { loadPlugins, pluginResolutionKind } from '../plugins/load'
 import type { PluginRegistry } from '../plugins/registry'
 import { materializePluginRuntimes } from '../plugins/runtimes'
-import { DISPATCHER, humanActor } from '../events/envelope'
+import { DISPATCHER, KERNEL, humanActor } from '../events/envelope'
+import type { AbEvent } from '../events/catalog'
 import type { RepositoryEventWrite } from '../events/repository'
 import { randomIds, randomUuids, type IdSource, type UuidSource } from '../ids'
 import { reduceDispatchSettings } from '../kernel/dispatch-settings'
@@ -100,15 +112,21 @@ import {
   type BuildExecutionHandle,
 } from '../ports/workspace/build-execution'
 import type { Exec } from '../ports/workspace/git-worktree'
-import { validateVercelGithubOrigin } from '../ports/workspace/vercel-sandbox'
 import {
   BUILD_EFFECTIVE_CONFIG_ARTIFACT,
   BUILD_RUNNER_DIAGNOSTIC_ARTIFACT,
   effectiveBuildConfigContent,
+  parseBuildConfigMetadata,
   parseDiagnostic,
+  parseEffectiveBuildConfig,
+  selectOpenWorkspace,
 } from '../processes/build-execution-state'
 import { HarvestRunner, type HarvestRunnerResult } from '../processes/harvest-runner'
-import { scanUnclaimedObservations, evaluateHarvestPressure } from '../processes/harvest'
+import {
+  sampleUnclaimedObservationCount,
+  readRepoEventsIfRecorded,
+  evaluateHarvestPressureFromStore,
+} from '../processes/harvest'
 import { classifyHarvestOutcome } from '../processes/harvest-execution-state'
 import type { HarvestExecution } from '../ports/workspace/harvest-execution'
 import {
@@ -154,8 +172,12 @@ const DEFAULT_INTERVAL_MS = 10_000
 const REPO_LEASE_TTL_MS = 60_000
 const REPO_LEASE_HEARTBEAT_MS = 20_000
 /** Repository artifact containing the schema-validated composed Config used by
- * one dispatch run. It is the frontend's only config source. */
-export const DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT = 'dispatcher-effective-config'
+ * one dispatch run. It is the frontend's only config source. Defined in
+ * `store/retention.ts` beside the other kind constants and re-exported here
+ * (the long-standing import path). */
+export { DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT } from '../store/retention'
+// Local uses within this module.
+import { DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT as _effectiveConfigKind } from '../store/retention'
 
 /** JSON encoding in the config schema's declarative input shape. Parsed Config
  * has normalized `{steps, stepConfigs}` sections; flattening named step tables
@@ -196,8 +218,9 @@ function definedEnv(env: Record<string, string | undefined>): Record<string, str
  * the process-local display cache then polls dashboard-visible streams with
  * `getEvents(lastSeq)`, retaining abort cleanup until final completion and reusing unchanged
  * reductions/timing projections. Repository controls and Harvest are still
- * read fresh. The identical-frame check in `live.ts` makes an unchanged paint
- * cost zero terminal writes. */
+ * read fresh through the bounded journal read (AUT-489 subset; AUT-545). The
+ * identical-frame check in `live.ts` makes an unchanged paint cost zero
+ * terminal writes. */
 const DASHBOARD_POLL_MS = 500
 
 /** Dashboard repaint (not re-read) cadence in watch mode. A running step's
@@ -295,7 +318,13 @@ const DEFAULT_TIMERS: TimerScheduler = {
 
 export interface DispatchOpts {
   /** Repo the dispatcher serves (§12: one dispatcher per repo) — the cwd, or
-   * in origin mode a private scratch root. Filesystem consumers only. */
+   * in origin mode a private scratch root. Filesystem consumers only.
+   * Callers without a checkout may pass a non-filesystem identity token
+   * instead (e.g. hosted-dispatcher's `'<hosted-dispatcher>'`): it is a
+   * caller-facing label, not a path, and origin-mode state resolution
+   * replaces it with the per-origin scratch root before any filesystem
+   * consumer — plugin loading, worktrees, exec cwd — runs (AUT-604). The
+   * token therefore never participates in cwd-relative disk resolution. */
   targetRepo: string
   /** Checkout-less origin mode (AUT-302): serve the repository at this origin
    * with no local checkout. CLI `--repository <origin>`, env `AB_REPOSITORY`.
@@ -433,23 +462,37 @@ async function defaultWire(
   // Origin mode: no checkout exists, so the provider's host git seams are
   // replaced by the injected origin and the forge's remote reads.
   const originMode = opts.repository !== undefined
-  if (config.workspace.provider === 'vercel-sandbox') {
-    if (config.forge !== 'github') {
-      throw new Error('vercel-sandbox requires the builtin github forge')
-    }
-    if (!originMode) {
-      const origin = await opts.exec(['git', 'remote', 'get-url', 'origin'], {
-        cwd: opts.targetRepo,
-      })
-      if (origin.exitCode !== 0) throw new Error('vercel-sandbox requires a readable Git origin')
-      validateVercelGithubOrigin(origin.stdout.trim())
-    }
-    if (githubTokenFromEnv(opts.env) === undefined) {
+  // Dispatch preflight is capability-driven (AUT-516): forge support, origin
+  // validation, and required environment all read the selected provider's
+  // registration declarations — builtin and plugin alike — instead of naming
+  // a provider.
+  const workspaceCaps = plugins.workspaceProviders.get(config.workspace.provider)?.capabilities
+  if (workspaceCaps?.supportedForges !== undefined) {
+    if (!workspaceCaps.supportedForges.includes(config.forge)) {
       throw new Error(
-        'vercel-sandbox publication requires GITHUB_TOKEN or GH_TOKEN in the dispatcher environment',
+        workspaceCaps.forgeDispatchMessage ??
+          `workspace provider "${config.workspace.provider}" does not support forge "${config.forge}"`,
       )
     }
   }
+  if (workspaceCaps?.validateOrigin !== undefined && !originMode) {
+    const origin = await opts.exec(['git', 'remote', 'get-url', 'origin'], {
+      cwd: opts.targetRepo,
+    })
+    if (origin.exitCode !== 0)
+      throw new Error(
+        workspaceCaps.originReadFailureMessage ??
+          `workspace provider "${config.workspace.provider}" requires a readable Git origin`,
+      )
+    workspaceCaps.validateOrigin(origin.stdout.trim())
+  }
+  for (const group of workspaceCaps?.requiredEnv ?? []) {
+    if (group.dispatchMessage === undefined) continue
+    const satisfied = group.alternatives.some((names) =>
+      names.every((name) => opts.env[name] !== undefined && opts.env[name] !== ''),
+    )
+    if (!satisfied) throw new Error(group.dispatchMessage)
+  }
   // The builtin GitHub forge resolves its credential lazily on its first
   // request (GITHUB_TOKEN, GH_TOKEN, then the gh CLI login) and names the
   // miss reason on any request that had to go out anonymously; nothing is
@@ -505,6 +548,7 @@ async function defaultWire(
     sandboxSetupCommand: config.commands.setup,
     sandboxRoot: resolve(join(opened.localStateRoot, 'orchestrator-sandboxes')),
     sandboxEnvironmentVariables: config.orchestrator.sandbox.environmentVariables,
+    orchestratorSandboxEnabled: config.orchestrator.enabled,
     ...providerSeams,
     ...(opened.token !== undefined ? { storeToken: opened.token } : {}),
   })
@@ -779,22 +823,198 @@ class DispatchLoop {
     return this.liveConfig.current()
   }
 
+  /** Resolve this build's pinned pipeline source (SPEC §16.1). Never throws:
+   * every failure — missing build record, absent forge capability, unreadable
+   * branch/base, malformed TOML, store read failure — degrades to `source:
+   * undefined` with the failed attempts classified, never failing the
+   * deposit. The failures feed the caller's fallback diagnostic. */
+  private async resolveBuildPipeline(slug: string): Promise<{
+    source: Awaited<ReturnType<typeof resolvePipelineSource>>
+    failures: PipelineSourceFailure[]
+    events: AbEvent[]
+  }> {
+    const failures: PipelineSourceFailure[] = []
+    try {
+      // The workspace event carries the branch the build was provisioned on;
+      // the record's `branch` (when present) is the same fact. Using the event
+      // keeps this read to the events the caller already needs and avoids an
+      // extra build-record lookup on the hot launch path.
+      const events = await this.wiring.store.getEvents(slug)
+      const workspace = selectOpenWorkspace(events)
+      const source = await resolvePipelineSource({
+        slug,
+        record: { ...(workspace !== null ? { branch: workspace.branch } : {}) },
+        events,
+        mode: this.opts.repository !== undefined ? 'origin' : 'checkout',
+        forge: this.wiring.forge,
+        checkout: this.opts.targetRepo,
+        exec: this.opts.exec,
+        ...(workspace !== null ? { workspacePath: workspace.path } : {}),
+        onFailure: (failure) => failures.push(failure),
+      })
+      return { source, failures, events }
+    } catch (error) {
+      failures.push({
+        kind: 'store',
+        detail: `build-event read failed: ${error instanceof Error ? error.message : String(error)}`,
+      })
+      return { source: undefined, failures, events: [] }
+    }
+  }
+
   /** Publish the exact composed snapshot into one build-owned namespace. The
-   * child samples only this artifact and never receives config over IPC. */
+   * child samples only this artifact and never receives config over IPC.
+   *
+   * Build-owned sections (verify/finalize/commands/workspace) come from the
+   * build's own branch at its recorded pipeline-source commit; every other
+   * section comes from the live dispatcher snapshot. The source commit travels
+   * in the artifact metadata so status can report which autobuild.toml the
+   * build runs under (SPEC §16.1).
+   *
+   * A failed resolution never rewrites a pinned pipeline: when the build
+   * already has a deposit, its build-owned sections are reused verbatim (the
+   * reload path's rule), because depositing the live base-branch snapshot on a
+   * transient forge/store/git failure is exactly the AUT-366 poisoning. Only
+   * a build with no pinned artifact at all (legacy build, or a first deposit
+   * during an outage) takes the live snapshot. An actionable degradation — a
+   * missing forge capability, a build-branch source that resolved but cannot
+   * be read or parsed, a store failure — files a build-scoped observation
+   * naming the failed attempts; the documented fallbacks (an unpublished
+   * branch, an unreadable legacy base) stay quiet. */
   private async publishBuildConfig(slug: string, snapshot = this.currentConfig()): Promise<void> {
+    const { source, failures, events } = await this.resolveBuildPipeline(slug)
+    if (source !== undefined) {
+      await this.depositBuildConfig(
+        slug,
+        snapshot,
+        composeBuildConfig(source.config, snapshot.config),
+        source.meta,
+      )
+      return
+    }
+    let reused: PipelineSourceMeta | undefined
+    try {
+      const artifact = await this.wiring.store.getArtifact(slug, BUILD_EFFECTIVE_CONFIG_ARTIFACT)
+      if (artifact !== null) {
+        const pinned = parseEffectiveBuildConfig(artifact)
+        reused = parseBuildConfigMetadata(artifact).pipelineSource
+        await this.depositBuildConfig(
+          slug,
+          snapshot,
+          composeBuildConfig(pinned, snapshot.config),
+          reused,
+        )
+      } else {
+        await this.depositBuildConfig(slug, snapshot, snapshot.config)
+      }
+    } catch {
+      // Even the artifact read failed; the live snapshot deposit is the only
+      // option left that keeps the launch alive.
+      await this.depositBuildConfig(slug, snapshot, snapshot.config)
+    }
+    await this.filePipelineFallbackObservation(slug, reused, failures, events)
+  }
+
+  /** File a build-scoped observation when a deposit hit an actionable
+   * pipeline-source failure (SPEC §16.1): the operator must know the deposit
+   * degraded to the last good pipeline or the live snapshot, and why. The
+   * documented fallbacks (unpublished branch, unreadable legacy base) are
+   * normal resolution order and stay quiet. A diagnostic, never a launch
+   * dependency. */
+  private async filePipelineFallbackObservation(
+    slug: string,
+    reused: PipelineSourceMeta | undefined,
+    failures: PipelineSourceFailure[],
+    events: readonly AbEvent[],
+  ): Promise<void> {
+    const actionable = failures.filter(isActionablePipelineFailure)
+    if (actionable.length === 0) return
+    const degradedTo =
+      reused !== undefined
+        ? 'kept the last pinned pipeline' +
+          (reused.commit !== undefined ? ` at ${reused.ref}@${reused.commit}` : ` (${reused.ref})`)
+        : 'deposited the live dispatcher snapshot (legacy fallback)'
+    const summary =
+      `pipeline-source resolution failed; ${degradedTo}. ` +
+      `Failed attempts: ${
+        actionable.map((failure) => `${failure.kind}: ${failure.detail}`).join('; ') ||
+        'none recorded'
+      }`
+    // Deduplicated against the build's log: a parked build re-attaches every
+    // sweep, and an outage must not harvest one identical diagnostic per tick.
+    if (
+      events.some(
+        (event) => event.type === 'observation.recorded' && event.payload.summary === summary,
+      )
+    ) {
+      return
+    }
+    try {
+      await this.wiring.store.append(slug, {
+        // The catalog admits kernel/agent actors for observations (§8.2); the
+        // dispatcher's system-side diagnostic rides the kernel actor, like the
+        // finalize-failure and auto-merge-deferral observations.
+        actor: KERNEL,
+        type: 'observation.recorded',
+        payload: {
+          id: this.wiring.ids('obs'),
+          kind: 'followup',
+          summary,
+          files: ['autobuild.toml'],
+        },
+      })
+    } catch {
+      // The build's pipeline is already deposited; the observation is best-effort.
+    }
+  }
+
+  private async depositBuildConfig(
+    slug: string,
+    snapshot: ConfigSnapshot,
+    config: Config,
+    pipelineSource?: PipelineSourceMeta,
+  ): Promise<void> {
     await this.wiring.store.putArtifact(slug, {
       kind: BUILD_EFFECTIVE_CONFIG_ARTIFACT,
-      content: effectiveBuildConfigContent(snapshot.config),
+      content: effectiveBuildConfigContent(config),
       metadata: {
         revision: snapshot.revision,
         run: this.runId,
+        ...(pipelineSource !== undefined ? { pipelineSource } : {}),
       },
     })
   }
 
+  /** Re-deposit deployment-owned sections to active builds on a reload. The
+   * build-owned sections are reused verbatim from the build's last deposit, so
+   * a base-branch reload can never retarget an in-flight build's pipeline; a
+   * build picks up pipeline changes only from its own branch at its next
+   * launch (SPEC §16.1). */
   private async publishActiveBuildConfigs(snapshot: ConfigSnapshot): Promise<void> {
     await Promise.all(
-      [...this.activeBuildRuns.keys()].map((slug) => this.publishBuildConfig(slug, snapshot)),
+      [...this.activeBuildRuns.keys()].map(async (slug) => {
+        const artifact = await this.wiring.store.getArtifact(slug, BUILD_EFFECTIVE_CONFIG_ARTIFACT)
+        if (artifact === null) {
+          await this.publishBuildConfig(slug, snapshot)
+          return
+        }
+        let existing: Config
+        try {
+          existing = parseEffectiveBuildConfig(artifact)
+        } catch {
+          // A corrupt or pre-pin artifact cannot pin a pipeline; fall back to
+          // the launch-path resolution instead of failing the reload.
+          await this.publishBuildConfig(slug, snapshot)
+          return
+        }
+        const meta = parseBuildConfigMetadata(artifact)
+        await this.depositBuildConfig(
+          slug,
+          snapshot,
+          composeBuildConfig(existing, snapshot.config),
+          meta.pipelineSource,
+        )
+      }),
     )
   }
 
@@ -805,7 +1025,10 @@ class DispatchLoop {
   private async refreshConfig(): Promise<void> {
     if (this.opts.once === true) return
     // Origin mode reloads from the forge: autobuild.toml at the CURRENT
-    // effective base branch (hot — a rename converges within two ticks).
+    // effective base branch (hot — a rename converges within two ticks). This
+    // read feeds the dispatcher's own snapshot; a reload re-deposits only the
+    // deployment-owned sections to active builds (build-owned pipeline
+    // sections stay pinned to each build's own branch, SPEC §16.1).
     // Restart-required changes keep startup-built adapters and file the
     // existing restart-required observation (LiveConfig semantics).
     const outcome =
@@ -861,7 +1084,8 @@ class DispatchLoop {
   }
 
   private async readDispatchSettings(): Promise<ReturnType<typeof reduceDispatchSettings>> {
-    const events = await this.wiring.store.getRepoEvents(this.repoIdentity)
+    // Bounded read (AUT-489): the settings reducer consumes durable types only.
+    const events = await this.wiring.store.getRepoStateEvents(this.repoIdentity)
     return reduceDispatchSettings(events)
   }
 
@@ -884,12 +1108,17 @@ class DispatchLoop {
       })
 
       // Unclaimed observations are display-only and sampled once per interactive
-      // dispatcher tick. A failed scan must neither fail dispatch nor replace
-      // the last complete measurement with a fabricated zero.
+      // dispatcher tick from the journal and one repo-scoped digest read
+      // (AUT-487) — flat in the finished-build count. A journal record that
+      // does not yet exist reads as an empty journal (AUT-524); the sample
+      // writes nothing. Any other failed sample must neither fail dispatch nor
+      // replace the last complete measurement with a fabricated zero.
       if (this.dashboard) {
         try {
-          const scan = await scanUnclaimedObservations(this.wiring.store, this.repoIdentity)
-          this.observationCount = scan.observations.length
+          this.observationCount = await sampleUnclaimedObservationCount(
+            this.wiring.store,
+            this.repoIdentity,
+          )
         } catch {
           // Display-only sampling failures retain the last factual count and
           // retry on the next tick; they are not dashboard failures.
@@ -1175,6 +1404,7 @@ class DispatchLoop {
       repo: this.repoIdentity,
       user: buildControlUser(this.opts.env),
       setting: 'intake',
+      run: this.runId,
     })
     this.say(`dispatcher intake ${event.enabled ? 'ON' : 'OFF'}`)
     await this.renderOnce()
@@ -1439,6 +1669,7 @@ class DispatchLoop {
         repo: this.repoIdentity,
         user: buildControlUser(this.opts.env),
         setting: 'auto-merge-default',
+        run: this.runId,
       })
       this.say(`dispatcher auto-merge default ${event.enabled ? 'ON' : 'OFF'}`)
       await this.renderOnce()
@@ -2056,7 +2287,9 @@ class DispatchLoop {
       // once provisioned, so a threshold crossing between gate and guest scan
       // is never suppressed by this check.
       const record = await store.getRepo(repo)
-      const events = record === null ? [] : await store.getRepoEvents(repo)
+      // Bounded read (AUT-489): the harvest control decision reduces durable
+      // types only.
+      const events = record === null ? [] : await store.getRepoStateEvents(repo)
       const state = reduceHarvest(events)
       const control = decideHarvestControl(state, this.maxHarvestRecoveryAttempts)
       const resumePending =
@@ -2066,8 +2299,16 @@ class DispatchLoop {
         control.kind === 'request-recovery' ||
         control.kind === 'exhaust-recovery'
       if (!resumePending) {
-        const scan = await scanUnclaimedObservations(store, repo)
-        const pressure = evaluateHarvestPressure(scan, this.currentConfig().config.policy)
+        // Flat-cost gate (AUT-521): the journal read above plus one
+        // repo-scoped digest batch read — no per-build history reads, so the
+        // per-evaluation cost no longer grows with accumulated finished
+        // builds. The guest rescans authoritatively once provisioned.
+        const pressure = await evaluateHarvestPressureFromStore({
+          store,
+          repo,
+          harvestEvents: events,
+          policy: this.currentConfig().config.policy,
+        })
         if (pressure.trigger === undefined) return
       }
 
@@ -2165,7 +2406,8 @@ class DispatchLoop {
     startedSeq: number,
   ): Promise<HarvestRunnerResult> {
     const { store } = this.wiring
-    const events = await store.getRepoEvents(repo)
+    // Bounded read (AUT-489): classifyHarvestOutcome reduces harvest facts only.
+    const events = await store.getRepoStateEvents(repo)
     const record = await store.getRepo(repo)
     return classifyHarvestOutcome(events, {
       executionStartedSeq: startedSeq,
@@ -2839,9 +3081,14 @@ class DispatchLoop {
       configSnapshot.config,
       configSnapshot.revision,
     )
-    const repoRecord = await this.wiring.store.getRepo(this.repoIdentity)
-    const repositoryEvents =
-      repoRecord === null ? [] : await this.wiring.store.getRepoEvents(this.repoIdentity)
+    // Bounded read (AUT-489, AUT-545): every repository consumer of this frame —
+    // projectRepositoryHarvest (reduceHarvest plus the harvest-only raw scans in
+    // projectHarvestRun/escalationAttentionDismissed) and reduceDispatchSettings —
+    // reduces durable types only, so the AUT-489 subset is replay-equivalent with
+    // no anchor dependence (anchor analysis recorded; the frontend seed needed one
+    // only because reduceDispatchStatus folds here too — it does not here).
+    // Missing journal record stays a read-only empty journal (AUT-524).
+    const repositoryEvents = await readRepoEventsIfRecorded(this.wiring.store, this.repoIdentity)
 
     // Action-triggered and timer refreshes share the cache but may finish their
     // repository reads out of order. Never let an older build snapshot replace
@@ -3502,10 +3749,23 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
         `origin-mode dispatch requires the builtin github forge, but the fetched autobuild.toml selects ${JSON.stringify(config.forge)}`,
       )
     }
-    if (config.plugins !== undefined && config.plugins.length > 0) {
+    // Origin mode has no checkout, so repository-path plugin specifiers
+    // (relative, absolute, file:) cannot resolve — reject them with the
+    // existing remediation tone before any wiring. Bare package specifiers
+    // are accepted: the shared loadPlugins below resolves them from the
+    // dispatcher's own installation when the scratch root lacks them
+    // (AUT-517), which is exactly "resolvable from the dispatcher's own
+    // installation". The caller-supplied `targetRepo` is an identity token,
+    // not a path, and never reaches plugin resolution: the candidate roots
+    // are the scratch checkout and the installation, per the loadPlugins
+    // call below (AUT-604).
+    const repoPathPlugin = (config.plugins ?? []).find(
+      (moduleSpecifier) => pluginResolutionKind(moduleSpecifier) === 'repo-path',
+    )
+    if (repoPathPlugin !== undefined) {
       throw new Error(
-        'origin-mode dispatch cannot load configured plugins: plugin code is checkout-relative ' +
-          'and there is no checkout. Remove [plugins] from the base branch autobuild.toml or run from a checkout',
+        `origin-mode dispatch cannot load the repository-path plugin ${JSON.stringify(repoPathPlugin)}: ` +
+          'plugin code is checkout-relative and there is no checkout. Remove repository-path entries from [plugins] in the base branch autobuild.toml or run from a checkout',
       )
     }
   } else {
@@ -3524,8 +3784,22 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
   }
   // Configured plugin code is trusted like configured shell commands, but it
   // must resolve, evaluate, validate, and register before production wiring
-  // opens a store, claims a ticket, or launches a runner.
-  const plugins = await loadPlugins(config.plugins, resolvedOpts.targetRepo)
+  // opens a store, claims a ticket, or launches a runner. Skipped-module
+  // notices (builtin duplicate-skip, guest tolerance) surface on dispatch's
+  // own stderr channel.
+  // AUT-604: origin mode's repository candidate root for plugin loading is
+  // the per-origin scratch checkout, never the caller-supplied `targetRepo`
+  // token (e.g. hosted-dispatcher's `'<hosted-dispatcher>'`) — that token is
+  // a caller-facing identity label which `resolveOriginModeState` replaced
+  // with `state.checkout` above, so it never participates in cwd-relative
+  // disk resolution. `state.checkout` equals `resolvedOpts.targetRepo` in
+  // both modes, so passing it as `packageRoot` is behavior-preserving; the
+  // installation candidate (AUT-517) and the disk-first EROFS gate (AUT-587)
+  // are unchanged.
+  const plugins = await loadPlugins(config.plugins, resolvedOpts.targetRepo, {
+    packageRoot: state.checkout,
+    onNotice: (line) => resolvedOpts.stderr(line),
+  })
   // Validate the selector against the complete catalog before either custom
   // wiring or production wiring can open state or perform side effects.
   resolveForgeRegistration(config.forge, plugins)
@@ -3580,7 +3854,7 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
             metadata: { restartRequired: [...restartRequired], effectiveChanged },
           },
           {
-            kind: DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT,
+            kind: _effectiveConfigKind,
             content: effectiveConfigContent(effectiveConfig),
             metadata: { run: runId, effectiveChanged },
           },
@@ -3636,7 +3910,7 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
     state.repo,
     [
       {
-        kind: DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT,
+        kind: _effectiveConfigKind,
         content: effectiveConfigContent(config),
         metadata: { run: runId, revision: 0 },
       },