@defrex/autobuild 0.9.0 → 0.10.0

package/packages/core/src/processes/dispatcher.ts

@@ -55,7 +55,7 @@ import {
   type AutoMergeDefaultFact,
 } from '../kernel/auto-merge-default'
 import { reduceDispatchSettings } from '../kernel/dispatch-settings'
-import { decideNext } from '../kernel/engine'
+import { decideNextFromFacts } from '../kernel/engine'
 import {
   DEFAULT_MAX_HARVEST_RECOVERY_ATTEMPTS,
   decideHarvestControl,
@@ -75,18 +75,25 @@ import type {
   WorkspaceProvider,
 } from '../ports/types'
 import type { Exec } from '../ports/workspace/git-worktree'
-import type { ArtifactMeta, BuildRecord, BuildStore, Clock } from '../store/types'
+import type { ArtifactMeta, BuildDigest, BuildRecord, BuildStore, Clock } from '../store/types'
 import { samplePinnedAssets } from '../store/ticket-assets'
 import { resolveRepoOrigin } from '../cli/repo-state'
 import { specConformance } from '../spec-standard'
 export { specConformance, type SpecConformance } from '../spec-standard'
 import { recordInfrastructureFailure as appendInfrastructureFailure } from './infrastructure-failure-budget'
-import { lastExecutionOutcome, openExecution, settleExecution } from './execution-settlement'
+import { settleOpenExecution } from './execution-settlement'
 import { openHarvestExecutions } from './harvest-execution-state'
-import { readRepoEventsIfRecorded } from './harvest'
+import { isWorkDigest, RepoViewStore } from './repo-view'
+import {
+  baseBranchReducer,
+  openBuildWorkspace,
+  provisionMarkerReducer,
+  recoveryCheckpointReducer,
+  type OpenBuildWorkspace,
+  type ProvisionMarker,
+} from './dispatcher-selectors'
 import type { RepositoryEvent } from '../events/repository'
 import { sandboxStates } from './sandbox-state'
-import { abandonedPublicationPending, publicationPending } from './publication-state'
 import { settlePublicationBeforeRelease } from './publication-loss'
 
 // ── Readiness resolution (SPEC §3.3) ─────────────────────────────────────────
@@ -108,11 +115,22 @@ import { settlePublicationBeforeRelease } from './publication-loss'
  * is otherwise the directory, so it defaults to no label gate. Plugin sources
  * likewise receive no host-imposed label convention. An explicit
  * `readyLabels` wins for every source.
+ *
+ * `[tickets].readyAssignee` (Linear only) adds a third conjunctive gate: the
+ * ticket must be assigned to that user.
  */
-export function readyCriteria(config: Config): { labels: string[]; state: string } {
-  const { readyLabels, readyState } = config.tickets
+export function readyCriteria(config: Config): {
+  labels: string[]
+  state: string
+  assignee?: string
+} {
+  const { readyLabels, readyState, readyAssignee } = config.tickets
   if (config.tickets.source === 'linear') {
-    return { labels: readyLabels ?? ['autobuild'], state: readyState }
+    return {
+      labels: readyLabels ?? ['autobuild'],
+      state: readyState,
+      ...(readyAssignee !== undefined ? { assignee: readyAssignee } : {}),
+    }
   }
   return { labels: readyLabels ?? [], state: readyState }
 }
@@ -469,6 +487,10 @@ export interface TickOpts {
    * escalations remain human gates and are only reported as parked.
    */
   resumeCurrent?: boolean
+  /** The caller refreshed the repository view for this tick already (the CLI
+   * does, to sample the repository-wide controls from the same state). The
+   * tick then skips its own refresh so one tick performs one discovery read. */
+  viewRefreshed?: boolean
   /**
    * Repository-derived intake gate supplied by the CLI for this tick. False
    * skips only the ready-ticket list/claim/dispatch stage; janitor, startup
@@ -575,30 +597,14 @@ export interface DispatcherDeps {
 /** Latest `workspace.provisioned` not followed by a `workspace.released` —
  * the reducer deliberately ignores workspace events (liveness is the
  * dispatcher's concern), so the janitor scans the raw log. */
-function openWorkspace(
-  events: AbEvent[],
-): { provider: string; ref: string; path?: string; localPath?: string; branch: string } | null {
-  let open: {
-    provider: string
-    ref: string
-    path?: string
-    localPath?: string
-    branch: string
-  } | null = null
-  for (const event of events) {
-    if (event.type === 'workspace.provisioned') open = event.payload
-    else if (event.type === 'workspace.released') open = null
-  }
-  return open
+function openWorkspace(events: AbEvent[]): OpenBuildWorkspace | null {
+  return openBuildWorkspace(events)
 }
 
 /** The build's base branch, from its own `build.created` fact (§15.3);
  * falls back to the repo config for logs missing one. */
 function baseBranchOf(events: AbEvent[], config: Config): string {
-  for (const event of events) {
-    if (event.type === 'build.created') return event.payload.baseBranch
-  }
-  return config.baseBranch
+  return baseBranchReducer.reduce(events) ?? config.baseBranch
 }
 
 function artifactRefOf(deposited: ArtifactMeta[]): ArtifactRef {
@@ -656,7 +662,27 @@ export class Dispatcher {
    * slug here defers to the continuation; it never blocks on it. */
   private readonly continuations = new Map<string, ProvisionContinuation>()
 
+  /** The incremental repository view every stage reads and writes through
+   * (AUT-647): `deps.store` itself when the caller already wrapped it. */
+  private readonly store: RepoViewStore
+
+  /** `deps.settlePublication`, followed by a delta read of the build: the
+   * guest-side settlement appends through its own store handle, which the view
+   * only learns of by reading. */
+  private get settlePublication(): ((slug: string) => Promise<void>) | undefined {
+    const settle = this.deps.settlePublication
+    if (settle === undefined) return undefined
+    return async (slug) => {
+      await settle(slug)
+      await this.store.refreshBuild(slug)
+    }
+  }
+
   constructor(private readonly deps: DispatcherDeps) {
+    this.store =
+      deps.store instanceof RepoViewStore
+        ? deps.store
+        : new RepoViewStore(deps.store, { repo: deps.repo })
     this.leaseTtlMs = deps.opts?.leaseTtlMs ?? 0
     this.doneState = deps.opts?.doneState ?? 'Done'
     this.slugNamingTimeoutMs = deps.opts?.slugNamingTimeoutMs ?? DEFAULT_SLUG_NAMING_TIMEOUT_MS
@@ -680,9 +706,21 @@ export class Dispatcher {
   }
 
   async tick(opts: TickOpts = {}): Promise<TickReport> {
+    try {
+      return await this.runTick(opts)
+    } finally {
+      // Leave this tick's reduced state behind for the next process (a cache;
+      // a failure to write it is never a tick failure). Throttled in a
+      // resident dispatcher, always run by a cold single-tick process.
+      await this.store.persistSnapshots()
+    }
+  }
+
+  private async runTick(opts: TickOpts): Promise<TickReport> {
     // One immutable config for this complete decision pass. A reload racing the
     // tick is observed by the next tick, never half-way through this one.
     this.deps.config = this.deps.getConfig?.() ?? this.deps.config
+    if (opts.viewRefreshed !== true) await this.store.refresh()
     let autoMergeUser: string | undefined
     if (opts.defaultAutoMerge === true) {
       autoMergeUser = opts.autoMergeUser?.trim()
@@ -699,7 +737,7 @@ export class Dispatcher {
     // likewise samples before calling `tick`); the auto-merge default fact is
     // the durable driver of this tick's fan-out below. Neither control
     // pretends to a serialization the store does not offer.
-    const repoEvents = await readRepoEventsIfRecorded(this.deps.store, this.deps.repo)
+    const repoEvents = this.store.recordedJournal()
     const paused = reduceDispatchSettings(repoEvents).paused
     const autoMergeDefault = latestAutoMergeDefault(repoEvents)
     // The claim-time seed cites the newest fact whose enabled state matches
@@ -776,7 +814,7 @@ export class Dispatcher {
         let sandbox: OperatorSandboxService | undefined
         try {
           sandbox = await createOperatorSandboxService({
-            store: this.deps.store,
+            store: this.store,
             repo: this.deps.repo,
             provider: this.deps.workspaces,
             sandbox: this.deps.config.orchestrator.sandbox,
@@ -789,7 +827,8 @@ export class Dispatcher {
           sandbox = undefined
         }
         await runOrchestratorTickStep({
-          store: this.deps.store,
+          store: this.store,
+          view: this.store,
           repo: this.deps.repo,
           config: this.deps.config,
           clock: this.deps.clock,
@@ -814,6 +853,46 @@ export class Dispatcher {
     return this.deps.opts?.triageState ?? defaultTriageState(this.deps.config)
   }
 
+  /** This repository's builds paired with their digests, from one record
+   * listing and one digest read — the tick loops' per-build event reads start
+   * from here so a settled terminal build costs none. Records are read before
+   * digests (as `operator/query.ts` does) so a concurrent create cannot fail
+   * the completeness check. */
+  private async repoBuildDigests(): Promise<{ record: BuildRecord; digest: BuildDigest }[]> {
+    const store = this.store
+    const { repo } = this.deps
+    const records = (await store.listBuilds()).filter((record) => record.repo === repo)
+    const digests = await store.getRepoBuildDigests(repo)
+    return records.map((record) => {
+      const digest = digests.get(record.slug)
+      if (digest === undefined) {
+        throw new Error(
+          `build digest missing for ${record.slug}: the digest read broke completeness`,
+        )
+      }
+      return { record, digest }
+    })
+  }
+
+  /** Builds with no terminal fact: the only ones whose tick duties change
+   * their state (decide, resume, lease sweep, capacity). */
+  private async nonterminalBuilds(): Promise<BuildRecord[]> {
+    return (await this.repoBuildDigests())
+      .filter(({ digest }) => digest.terminal === undefined)
+      .map(({ record }) => record)
+  }
+
+  /** Builds that still have work: nonterminal ones, plus terminal builds whose
+   * post-terminal duty is outstanding — an `aborted` build awaiting its
+   * cleanup's `build.completed`, a `done` build with an unreclaimed release
+   * asset, or any build with an execution the provider has not been seen to
+   * end. A terminal, settled build costs no event reads. */
+  private async workBuilds(): Promise<BuildRecord[]> {
+    return (await this.repoBuildDigests())
+      .filter(({ digest }) => isWorkDigest(digest))
+      .map(({ record }) => record)
+  }
+
   /** Observation-only ready listing for Store-backed frontends while intake is
    * disabled. It shares the active-ticket exclusion with dispatch but performs
    * no dependency fetch, claim, bounce, build, workspace, or launch side
@@ -824,11 +903,10 @@ export class Dispatcher {
     ticketDiagnostics: string[]
   }> {
     this.deps.config = this.deps.getConfig?.() ?? this.deps.config
+    await this.store.refresh()
     const activeTicketIds = new Set<string>()
-    for (const record of await this.deps.store.listBuilds()) {
-      if (record.repo !== this.deps.repo || record.ticket === undefined) continue
-      const state = reduceBuild(await this.deps.store.getEvents(record.slug))
-      if (state.status !== 'done' && state.status !== 'aborted') {
+    for (const { record, digest } of await this.repoBuildDigests()) {
+      if (record.ticket !== undefined && digest.terminal === undefined) {
         activeTicketIds.add(record.ticket.id)
       }
     }
@@ -857,13 +935,14 @@ export class Dispatcher {
    * report shape stays compatible. */
   private async applyAutoMergeDefault(fact: AutoMergeDefaultFact | undefined): Promise<void> {
     if (fact === undefined) return
-    const { store } = this.deps
-    for (const record of (await store.listBuilds())
-      .filter((candidate) => candidate.repo === this.deps.repo)
-      .sort((a, b) => a.slug.localeCompare(b.slug))) {
+    const store = this.store
+
+    // Terminal builds are never eligible (`autoMergeDefaultEligible`).
+    for (const record of (await this.nonterminalBuilds()).sort((a, b) =>
+      a.slug.localeCompare(b.slug),
+    )) {
       while (true) {
-        const events = await store.getEvents(record.slug)
-        const state = reduceBuild(events)
+        const { state } = await store.buildFacts(record.slug)
         const target = autoMergeDefaultTarget(state, fact)
         if (target === undefined) break
         if (target === 'observed') {
@@ -890,13 +969,15 @@ export class Dispatcher {
   private async triggerHarvest(): Promise<void> {
     const start = this.deps.startHarvest
     if (start === undefined) return
-    const record = await this.deps.store.getRepo(this.deps.repo)
-    if (record === null) {
+    // The journal moves under foreign harvest writers while the stages run, so
+    // take the delta before deciding.
+    await this.store.refreshJournal()
+    if (!this.store.journalRecorded()) {
       start()
       return
     }
-    // Bounded read (AUT-489): the harvest reducer consumes durable types only.
-    const state = reduceHarvest(await this.deps.store.getRepoStateEvents(this.deps.repo))
+    // Bounded subset (AUT-489): the harvest reducer consumes durable types only.
+    const state = reduceHarvest(this.store.recordedJournal())
     if (decideHarvestControl(state, this.maxHarvestRecoveryAttempts).kind !== 'park') {
       start()
     }
@@ -925,28 +1006,26 @@ export class Dispatcher {
    * the stage still settles. */
   private async settleForeignExecutions(report: TickReport, opts: TickOpts = {}): Promise<void> {
     const active = this.deps.activeExecutions?.() ?? new Set<string>()
-    for (const record of await this.deps.store.listBuilds()) {
-      if (record.repo !== this.deps.repo) continue
+    for (const record of await this.workBuilds()) {
       if (active.has(record.slug)) continue
       // Budget gate: once spent, stop settling further foreign executions.
       if (this.outOfBudget(opts)) break
       try {
-        const events = await this.deps.store.getEvents(record.slug)
-        const open = openExecution(events)
+        const { open } = await this.store.buildFacts(record.slug)
         if (open === null) continue
         const owner = this.executionOwner(open.provider)
         const execution = owner?.buildExecution
         if (execution?.observe === undefined || open.commandId === undefined) continue
-        const settlement = await settleExecution(
+        const settlement = await settleOpenExecution(
           {
-            store: this.deps.store,
+            store: this.store,
             execution,
-            ...(this.deps.settlePublication !== undefined
-              ? { settlePublication: this.deps.settlePublication }
+            ...(this.settlePublication !== undefined
+              ? { settlePublication: this.settlePublication }
               : {}),
           },
           record.slug,
-          events,
+          open,
         )
         if (settlement === 'settled') report.settled += 1
       } catch {
@@ -971,7 +1050,11 @@ export class Dispatcher {
     const active = this.deps.activeHarvestExecutions?.() ?? new Set<string>()
     let events: RepositoryEvent[]
     try {
-      events = await readRepoEventsIfRecorded(this.deps.store, this.deps.repo)
+      // The earlier stages awaited providers; take the journal delta so a
+      // foreign append (operator activity, harvest facts) made meanwhile is
+      // seen before any destructive decision below.
+      await this.store.refreshJournal()
+      events = this.store.recordedJournal()
     } catch {
       // The read itself failed (a transient store error — a missing record
       // answers `[]` inside the helper, so it never reaches this arm):
@@ -1027,7 +1110,7 @@ export class Dispatcher {
             branch: '',
           })
         }
-        await this.deps.store.appendRepo(this.deps.repo, {
+        await this.store.appendRepo(this.deps.repo, {
           actor: DISPATCHER,
           type: 'harvest.execution.released',
           payload: {
@@ -1070,7 +1153,11 @@ export class Dispatcher {
     const providerName = this.deps.workspaces.name
     let events: RepositoryEvent[]
     try {
-      events = await readRepoEventsIfRecorded(this.deps.store, this.deps.repo)
+      // The earlier stages awaited providers; take the journal delta so a
+      // foreign append (operator activity, harvest facts) made meanwhile is
+      // seen before any destructive decision below.
+      await this.store.refreshJournal()
+      events = this.store.recordedJournal()
     } catch {
       // The read itself failed (a transient store error — a missing record
       // answers `[]` inside the helper, so it never reaches this arm):
@@ -1097,7 +1184,7 @@ export class Dispatcher {
           // never a stop: nothing was stopped through a provider this
           // dispatcher no longer owns. If the provider returns, the next
           // operator ensure() re-provisions and re-brackets the environment.
-          await this.deps.store.appendRepo(this.deps.repo, {
+          await this.store.appendRepo(this.deps.repo, {
             actor: DISPATCHER,
             type: 'orchestrator.sandbox.released',
             payload: {
@@ -1118,7 +1205,7 @@ export class Dispatcher {
         })
         if (outcome.outcome === 'unsupported') continue
         if (outcome.outcome === 'stopped') {
-          await this.deps.store.appendRepo(this.deps.repo, {
+          await this.store.appendRepo(this.deps.repo, {
             actor: DISPATCHER,
             type: 'orchestrator.sandbox.stopped',
             payload: {
@@ -1133,7 +1220,7 @@ export class Dispatcher {
           // dead host): close the orphan's trail with an unconfirmed-purge
           // release fact, dispatcher-authored exactly as
           // `harvest.execution.released` is.
-          await this.deps.store.appendRepo(this.deps.repo, {
+          await this.store.appendRepo(this.deps.repo, {
             actor: DISPATCHER,
             type: 'orchestrator.sandbox.released',
             payload: {
@@ -1161,23 +1248,8 @@ export class Dispatcher {
 
   /** The latest `workspace.provision-started` not yet followed by a
    * provisioned/released fact — an open provisioning marker. */
-  private openProvisionMarker(
-    events: AbEvent[],
-  ): { provider: string; branch: string; generation: number; ts: string; seq: number } | undefined {
-    let marker:
-      | { provider: string; branch: string; generation: number; ts: string; seq: number }
-      | undefined
-    for (const event of events) {
-      if (event.type === 'workspace.provision-started') {
-        marker = { ...event.payload, ts: event.ts, seq: event.seq }
-      } else if (
-        marker !== undefined &&
-        (event.type === 'workspace.provisioned' || event.type === 'workspace.released')
-      ) {
-        marker = undefined
-      }
-    }
-    return marker
+  private openProvisionMarker(events: AbEvent[]): ProvisionMarker | undefined {
+    return provisionMarkerReducer.reduce(events)
   }
 
   /** Liveness of the lease behind an open provision marker: `live` means a
@@ -1186,7 +1258,7 @@ export class Dispatcher {
    * may have crashed between marker and claim — adopted only after the
    * `provisionStaleMs` backstop. */
   private async provisionMarkerLiveness(slug: string): Promise<'live' | 'expired' | 'absent'> {
-    const record = await this.deps.store.getBuild(slug)
+    const record = await this.store.getBuild(slug)
     if (record?.lease === undefined) return 'absent'
     return new Date(record.lease.expiresAt).getTime() > this.deps.clock().getTime()
       ? 'live'
@@ -1235,7 +1307,7 @@ export class Dispatcher {
     }
     const branch = record.branch ?? `ab/${slug}`
     const generation = events.filter((event) => event.type === 'workspace.provisioned').length
-    await this.deps.store.append(slug, {
+    await this.store.append(slug, {
       actor: DISPATCHER,
       type: 'workspace.provision-started',
       payload: { provider: this.deps.workspaces.name, branch, generation },
@@ -1283,7 +1355,8 @@ export class Dispatcher {
       tail: 'dispatch' | 'launch'
     },
   ): Promise<void> {
-    const { store, workspaces, config } = this.deps
+    const store = this.store
+    const { workspaces, config } = this.deps
     const slug = entry.slug
     let leaseClaimed = false
     let heartbeat: ReturnType<typeof setInterval> | undefined
@@ -1422,10 +1495,10 @@ export class Dispatcher {
     for (const entry of entries) entry.controller.abort()
     for (const entry of entries) {
       try {
-        const events = await this.deps.store.getEvents(entry.slug)
+        const events = await this.store.getEvents(entry.slug)
         if (this.openProvisionMarker(events) !== undefined) {
           const attempt = events.filter((event) => event.type === 'dispatch.failed').length + 1
-          await this.deps.store.append(entry.slug, {
+          await this.store.append(entry.slug, {
             actor: DISPATCHER,
             type: 'dispatch.failed',
             payload: {
@@ -1440,7 +1513,7 @@ export class Dispatcher {
         // The durable marker plus the released lease still gate adoption.
       }
       try {
-        await this.deps.store.releaseLease(entry.slug, entry.instance)
+        await this.store.releaseLease(entry.slug, entry.instance)
       } catch {
         // Expiry fences an ambiguous release.
       }
@@ -1456,12 +1529,11 @@ export class Dispatcher {
   ): Promise<void> {
     // Listing is repository-wide work: if it fails there is no individual
     // build to attribute, so the caller's existing top-level boundary owns it.
-    const records = await this.deps.store.listBuilds()
-    for (const record of records) {
-      // One dispatcher per repo (§12), but the store is shared by design
-      // (§7.2) — another repo's builds are another dispatcher's duty. Acting
-      // on them would poll foreign PRs and break single-writer discipline.
-      if (record.repo !== this.deps.repo) continue
+    // Only this repo's builds that still have work (§12: another repo's
+    // builds are another dispatcher's duty; settled terminal builds cost no
+    // event reads).
+    const entries = (await this.repoBuildDigests()).filter(({ digest }) => isWorkDigest(digest))
+    for (const { record, digest } of entries) {
       // Budget gate: the janitor's per-build path issues forge/store transport
       // calls (PR probes, closePr, deleteBranch); once the budget is spent,
       // stop starting new ones. The remaining builds stay janitor due — the
@@ -1471,14 +1543,22 @@ export class Dispatcher {
         // Once a record is known, contain its complete janitor path: loading
         // and reducing facts, cleanup, forge/ticket calls, and store writes.
         // Existing partial facts leave the same work due on the next tick.
-        const events = await this.deps.store.getEvents(record.slug)
-        const state = reduceBuild(events)
+        const { state, workspace } = await this.store.buildFacts(record.slug)
         const executionLeaseLive = this.hasLiveExecutionLease(record)
+        // Raw history, read at most once and only by a branch that acts on it:
+        // the facts above answer every quiet-path question without it.
+        let loaded: AbEvent[] | undefined
+        const history = async (): Promise<AbEvent[]> => {
+          loaded ??= await this.store.getEvents(record.slug)
+          return loaded
+        }
         // Pipeline/ticket/workspace state is settled, but release-asset cleanup
         // has its own crash window after build.completed. Revisit only pending
         // hosted handles; this never relaunches a runner or consumes capacity.
         if (state.status === 'done') {
-          await this.reclaimPrAttachments(record.slug, events)
+          if (digest.reclaimPending === true) {
+            await this.reclaimPrAttachments(record.slug, await history())
+          }
           continue
         }
         // Abort is destructive human judgment and therefore outranks a queued
@@ -1488,13 +1568,15 @@ export class Dispatcher {
           state.status === 'queued' &&
           state.pendingCommands.some((command) => command.command === 'abort')
         ) {
-          const acknowledged = await this.deps.store.append(record.slug, {
+          const acknowledged = await this.store.append(record.slug, {
             actor: DISPATCHER,
             type: 'build.aborted',
             payload: {},
           } satisfies EventWrite<'build.aborted'>)
-          events.push(acknowledged)
-          await this.cleanupAborted(record, events, report)
+          void acknowledged
+          // The view folded the acknowledgement it just appended.
+          loaded = undefined
+          await this.cleanupAborted(record, await history(), report)
           continue
         }
         // Discard is a queued-only recovery control. A request that raced with
@@ -1505,15 +1587,23 @@ export class Dispatcher {
           state.status === 'queued' &&
           state.discardRequest !== undefined
         ) {
-          await this.cleanupDiscarded(record, events, report)
+          await this.cleanupDiscarded(record, await history(), report)
           continue
         }
         if (!executionLeaseLive && state.status === 'aborted') {
-          await this.cleanupAborted(record, events, report)
+          await this.cleanupAborted(record, await history(), report)
           continue
         }
-        if (state.pr)
-          await this.checkPr(record, events, state, report, launched, executionLeaseLive)
+        if (state.pr) {
+          await this.checkPr(
+            record,
+            { history, workspace },
+            state,
+            report,
+            launched,
+            executionLeaseLive,
+          )
+        }
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error)
         report.janitorFailed += 1
@@ -1523,7 +1613,10 @@ export class Dispatcher {
   }
 
   private forgeWorkspacePath(events: AbEvent[]): string {
-    const open = openWorkspace(events)
+    return this.forgeWorkspacePathOf(openWorkspace(events))
+  }
+
+  private forgeWorkspacePathOf(open: OpenBuildWorkspace | null): string {
     if (open !== null && isRemoteWorkspace(open)) return this.deps.repo
     // Local forges run git with cwd = workspacePath: it must be the physical
     // checkout, never the store identity (an origin URL since the identity
@@ -1546,7 +1639,8 @@ export class Dispatcher {
     events: AbEvent[],
     report: TickReport,
   ): Promise<void> {
-    const { store, tickets, forge } = this.deps
+    const store = this.store
+    const { tickets, forge } = this.deps
     const branch = record.branch
     // Whether this build ever owned a local checkout workspace, judged on the
     // provisioned facts (not the open one, which is null when the build never
@@ -1709,7 +1803,8 @@ export class Dispatcher {
     events: AbEvent[],
     report: TickReport,
   ): Promise<void> {
-    const { store, tickets } = this.deps
+    const store = this.store
+    const { tickets } = this.deps
     await this.releaseWorkspace(record.slug, events, 'discard')
     if (record.lease !== undefined) {
       await store.releaseLease(record.slug, record.lease.holder)
@@ -1733,18 +1828,21 @@ export class Dispatcher {
    * against the reduced `prState`), release/complete, project to the ticket. */
   private async checkPr(
     record: BuildRecord,
-    events: AbEvent[],
+    // `workspace` is the open workspace fact; `history` loads the raw log, which
+    // only the branches that act on a PR transition need.
+    source: { history: () => Promise<AbEvent[]>; workspace: OpenBuildWorkspace | null },
     state: BuildState,
     report: TickReport,
     launched: Set<string>,
     executionLeaseLive: boolean,
   ): Promise<void> {
-    const { store, tickets, forge } = this.deps
+    const store = this.store
+    const { tickets, forge } = this.deps
     const pr = state.pr
     if (!pr) return
     // Forge calls run from the workspace when it still exists (it does until
     // the build completes); fall back to the repo itself for odd logs.
-    const workspacePath = this.forgeWorkspacePath(events)
+    const workspacePath = this.forgeWorkspacePathOf(source.workspace)
     const prState = await forge.getPrState(workspacePath, pr.number)
     const autoMerge = prState.state === 'open' ? pendingAutoMerge(state) : undefined
 
@@ -1770,6 +1868,7 @@ export class Dispatcher {
       // Dedupe: a reduced prState of 'conflicted' means reconcile is already
       // pending (a `reconcile.completed` returns it to 'open').
       if (state.prState === 'conflicted') return
+      const events = await source.history()
       const baseSha = await this.baseSha(baseBranchOf(events, this.deps.config))
       const conflicted = await store.append(record.slug, {
         actor: DISPATCHER,
@@ -1818,10 +1917,11 @@ export class Dispatcher {
         // Re-read at the last possible point. A cancellation, replacement
         // command, newly due pipeline work, or application fact suppresses
         // this attempt; the next tick reclassifies from fresh forge state.
-        const latestEvents = await store.getEvents(record.slug)
-        const latestState = reduceBuild(latestEvents)
+        await store.refreshBuild(record.slug)
+        const latest = await store.buildFacts(record.slug)
+        const latestState = latest.state
         const latestIntent = pendingAutoMerge(latestState)
-        const decision = decideNext(latestEvents, this.deps.config)
+        const decision = decideNextFromFacts(latest.state, latest.log, this.deps.config)
         if (
           latestState.pr?.number === pr.number &&
           latestIntent?.enabled === true &&
@@ -1837,6 +1937,7 @@ export class Dispatcher {
     switch (prState.state) {
       case 'merged': {
         if (executionLeaseLive) return
+        const events = await source.history()
         // Emit the fact once (a crash between steps re-runs this block; the
         // reduced prState dedupes the event, the log dedupes the release).
         if (state.prState !== 'merged') {
@@ -1862,6 +1963,7 @@ export class Dispatcher {
       }
       case 'closed': {
         if (executionLeaseLive) return
+        const events = await source.history()
         // Closed without merge is a human decision — back to Triage (§15.7).
         if (state.prState !== 'closed') {
           await store.append(record.slug, {
@@ -1918,14 +2020,14 @@ export class Dispatcher {
           workspacePath: this.deps.checkout ?? this.deps.repo,
           asset: hosted.payload.asset,
         })
-        await this.deps.store.append(slug, {
+        await this.store.append(slug, {
           actor: DISPATCHER,
           type: 'pr-attachment.reclaimed',
           payload: { hostedSeq: hosted.seq },
         })
       } catch (error) {
         try {
-          await this.deps.store.append(slug, {
+          await this.store.append(slug, {
             actor: DISPATCHER,
             type: 'pr-attachment.reclaim-failed',
             payload: {
@@ -1945,24 +2047,7 @@ export class Dispatcher {
   }
 
   private recoveryCheckpoint(events: AbEvent[]): string | undefined {
-    let settled: string | undefined
-    let original: string | undefined
-    for (const event of events) {
-      if (event.type === 'workspace.provisioned' && original === undefined) {
-        original = event.payload.base.sha
-      } else if (event.type === 'implement.completed') {
-        settled = event.payload.commits.head
-      } else if (event.type === 'reconcile.completed') {
-        settled = event.payload.mergeCommit
-      } else if (
-        event.type === 'finalize.step-completed' &&
-        event.payload.ok &&
-        event.payload.headSha !== undefined
-      ) {
-        settled = event.payload.headSha
-      }
-    }
-    return settled ?? original
+    return recoveryCheckpointReducer.reduce(events)
   }
 
   private async recordInfrastructureFailure(
@@ -1978,7 +2063,7 @@ export class Dispatcher {
   ): Promise<void> {
     const execution = [...events].reverse().find((event) => event.type === 'execution.started')
     const appended = await appendInfrastructureFailure(
-      { store: this.deps.store, ids: this.deps.ids },
+      { store: this.store, ids: this.deps.ids },
       {
         slug,
         events,
@@ -2028,7 +2113,7 @@ export class Dispatcher {
     // failure propagates — a stale workspace with an unrecorded pending
     // request is never reaped (the next tick retries).
     events = await settlePublicationBeforeRelease(
-      { store: this.deps.store, settlePublication: this.deps.settlePublication },
+      { store: this.store, settlePublication: this.settlePublication },
       slug,
       events,
       reason,
@@ -2047,7 +2132,7 @@ export class Dispatcher {
         ...(open.localPath !== undefined ? { localPath: open.localPath } : {}),
         branch: open.branch,
       })
-      const cleaned = await this.deps.store.append(slug, {
+      const cleaned = await this.store.append(slug, {
         actor: DISPATCHER,
         type: 'infrastructure.cleanup-attempted',
         payload: {
@@ -2060,7 +2145,7 @@ export class Dispatcher {
         },
       })
       events.push(cleaned)
-      const released = await this.deps.store.append(slug, {
+      const released = await this.store.append(slug, {
         actor: DISPATCHER,
         type: 'workspace.released',
         payload: { ref: open.ref, reason },
@@ -2069,7 +2154,7 @@ export class Dispatcher {
       return true
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error)
-      const failed = await this.deps.store.append(slug, {
+      const failed = await this.store.append(slug, {
         actor: DISPATCHER,
         type: 'infrastructure.cleanup-attempted',
         payload: {
@@ -2117,7 +2202,7 @@ export class Dispatcher {
     // workspace still exists. The guard's append failure propagates — the
     // release never proceeds past an unrecorded pending request.
     events = await settlePublicationBeforeRelease(
-      { store: this.deps.store, settlePublication: this.deps.settlePublication },
+      { store: this.store, settlePublication: this.settlePublication },
       slug,
       events,
       reason,
@@ -2132,7 +2217,7 @@ export class Dispatcher {
         ).length + 1
       try {
         const outcome = await recovery.reap(handle)
-        const cleaned = await this.deps.store.append(slug, {
+        const cleaned = await this.store.append(slug, {
           actor: DISPATCHER,
           type: 'infrastructure.cleanup-attempted',
           payload: {
@@ -2147,7 +2232,7 @@ export class Dispatcher {
         events.push(cleaned)
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error)
-        const failed = await this.deps.store.append(slug, {
+        const failed = await this.store.append(slug, {
           actor: DISPATCHER,
           type: 'infrastructure.cleanup-attempted',
           payload: {
@@ -2172,7 +2257,7 @@ export class Dispatcher {
     } else {
       await owner.release(handle)
     }
-    return this.deps.store.append(slug, {
+    return this.store.append(slug, {
       actor: DISPATCHER,
       type: 'workspace.released',
       payload: { ref: open.ref, reason },
@@ -2270,7 +2355,8 @@ export class Dispatcher {
       assets?: PinnedAsset[]
     },
   ): Promise<DispatchOutcome> {
-    const { store, config } = this.deps
+    const store = this.store
+    const { config } = this.deps
     let stage: EventPayload<'dispatch.failed'>['stage'] = 'create'
     try {
       let events = await store.getEvents(record.slug)
@@ -2406,7 +2492,8 @@ export class Dispatcher {
     report?: TickReport,
     launched?: Set<string>,
   ): Promise<Exclude<DispatchOutcome, 'deferred'>> {
-    const { store } = this.deps
+    const store = this.store
+
     let stage: EventPayload<'dispatch.failed'>['stage'] = 'spec'
     let authored = false
     try {
@@ -2487,6 +2574,7 @@ export class Dispatcher {
       // Discard validation and recovery selection happened before several
       // provider awaits. Re-read immediately before launch so a request made
       // during those boundaries parks cleanly for the next janitor pass.
+      await store.refreshBuild(record.slug)
       const launchState = reduceBuild(await store.getEvents(record.slug))
       if (launchState.status !== 'queued' || launchState.discardRequest !== undefined) {
         return 'parked'
@@ -2519,9 +2607,8 @@ export class Dispatcher {
     paused: boolean,
     opts: TickOpts = {},
   ): Promise<void> {
-    for (const record of await this.deps.store.listBuilds()) {
+    for (const record of await this.nonterminalBuilds()) {
       if (
-        record.repo !== this.deps.repo ||
         record.ticket === undefined ||
         launched.has(record.slug) ||
         this.continuations.has(record.slug)
@@ -2530,8 +2617,7 @@ export class Dispatcher {
       }
       // Budget gate: recovery issues store transport calls per build.
       if (this.outOfBudget(opts)) break
-      const events = await this.deps.store.getEvents(record.slug)
-      const state = reduceBuild(events)
+      const { state } = await this.store.buildFacts(record.slug)
       if (
         state.status !== 'queued' ||
         state.discardRequest !== undefined ||
@@ -2567,14 +2653,15 @@ export class Dispatcher {
     paused: boolean,
     opts: TickOpts = {},
   ): Promise<void> {
-    const { store, config } = this.deps
-    for (const record of await store.listBuilds()) {
-      if (record.repo !== this.deps.repo || launched.has(record.slug)) continue
+    const store = this.store
+    const { config } = this.deps
+    for (const record of await this.nonterminalBuilds()) {
+      if (launched.has(record.slug)) continue
       // Budget gate: resume launches runners (transport-backed work).
       if (this.outOfBudget(opts)) break
 
-      const events = await store.getEvents(record.slug)
-      const state = reduceBuild(events)
+      const facts = await store.buildFacts(record.slug)
+      const state = facts.state
       if (
         state.status === 'done' ||
         state.status === 'aborted' ||
@@ -2584,7 +2671,7 @@ export class Dispatcher {
         continue
       }
 
-      const decision = decideNext(events, config)
+      const decision = decideNextFromFacts(state, facts.log, config)
       if (decision.kind === 'wait') {
         if (decision.reason === 'blocked' && state.openEscalations.length > 0) {
           report.blockedDiagnostics.push(
@@ -2635,8 +2722,9 @@ export class Dispatcher {
     opts: TickOpts = {},
   ): Promise<void> {
     const now = this.deps.clock().getTime()
-    for (const record of await this.deps.store.listBuilds()) {
-      if (record.repo !== this.deps.repo) continue // §12: not this dispatcher's build
+    // Terminal builds are filtered on the digest before the lease and TTL
+    // checks, so a zero TTL cannot fall through to a log read.
+    for (const record of await this.nonterminalBuilds()) {
       if (launched.has(record.slug)) continue
       // Budget gate: the sweep re-attaches runners per expired build.
       if (this.outOfBudget(opts)) break
@@ -2645,16 +2733,22 @@ export class Dispatcher {
       } else if (now - new Date(record.updatedAt).getTime() < this.leaseTtlMs) {
         continue // absent lease within the first-claim grace (see DispatcherOpts)
       }
-      const events = await this.deps.store.getEvents(record.slug)
-      const state = reduceBuild(events)
+      const facts = await this.store.buildFacts(record.slug)
+      const state = facts.state
       if (
         (state.status === 'queued' && state.discardRequest !== undefined) ||
         heldByRepositoryPause(state, paused)
       ) {
         continue
       }
-      const decision = decideNext(events, this.deps.config)
+      const decision = decideNextFromFacts(state, facts.log, this.deps.config)
       if (state.status === 'done' || state.status === 'aborted') continue
+      // Raw history, read at most once and only by a branch that acts on it.
+      let loaded: AbEvent[] | undefined
+      const history = async (): Promise<AbEvent[]> => {
+        loaded ??= await this.store.getEvents(record.slug)
+        return loaded
+      }
       // Liveness gate (durable supervision): a recorded execution the provider
       // observes as RUNNING is left completely alone — no settle, no reap, no
       // replacement, no re-attach. This is the change that stops a supervisor
@@ -2662,13 +2756,12 @@ export class Dispatcher {
       // proved end settles first (completion facts, lease release, publication)
       // and then falls through to the normal decision; a provider-proved loss
       // falls through to the existing stale path below.
-      const foreignExecution = openExecution(events)
+      const foreignExecution = facts.open
       // A provider- or log-proved end in the same generation re-attaches in
       // place: the guest finished its work, the workspace is still the
       // build's, and replacing the environment would discard a healthy
       // generation. Only an unproven stale lease or a proved loss reaps.
-      const lastExecution = lastExecutionOutcome(events)
-      let endedInPlace = lastExecution === 'completed'
+      let endedInPlace = facts.lastExecution === 'completed'
       if (
         foreignExecution !== null &&
         foreignExecution.commandId !== undefined &&
@@ -2677,16 +2770,16 @@ export class Dispatcher {
         const owner = this.executionOwner(foreignExecution.provider)
         const execution = owner?.buildExecution
         if (execution?.observe !== undefined) {
-          const settlement = await settleExecution(
+          const settlement = await settleOpenExecution(
             {
-              store: this.deps.store,
+              store: this.store,
               execution,
-              ...(this.deps.settlePublication !== undefined
-                ? { settlePublication: this.deps.settlePublication }
+              ...(this.settlePublication !== undefined
+                ? { settlePublication: this.settlePublication }
                 : {}),
             },
             record.slug,
-            events,
+            foreignExecution,
           )
           if (settlement === 'running') continue
           if (settlement === 'settled') {
@@ -2698,8 +2791,8 @@ export class Dispatcher {
       const publicationRecoveryDue =
         state.status !== 'paused' &&
         state.status !== 'blocked' &&
-        (publicationPending(events) || abandonedPublicationPending(events))
-      const open = openWorkspace(events)
+        (facts.publication.pending() || facts.publication.abandonedPending())
+      const open = facts.workspace
       // A provider- or log-proved END in the same generation re-attaches in
       // place: the guest finished its work, the workspace is still the
       // build's, and replacing the environment would discard a healthy
@@ -2712,13 +2805,13 @@ export class Dispatcher {
             : state.status === 'blocked'
               ? ('blocked' as const)
               : ('replacement' as const)
-        const reaped = await this.reapStaleWorkspace(record.slug, events, reason)
+        const reaped = await this.reapStaleWorkspace(record.slug, await history(), reason)
         if (!reaped) continue
         if (!parked) {
           // Recovery-capable provider: reap inline (bounded), then kick the
           // same background continuation — it provisions and launches without
           // blocking this tick. Local providers never enter this branch.
-          const kicked = await this.ensureProvisionContinuation(record, events, 'launch')
+          const kicked = await this.ensureProvisionContinuation(record, await history(), 'launch')
           if (kicked === 'kicked') {
             report.provisioning += 1
             report.swept += 1
@@ -2735,11 +2828,11 @@ export class Dispatcher {
       // already continued earlier.
       if (decision.kind === 'wait' && !publicationRecoveryDue) continue
       if (
-        openWorkspace(events) === null &&
+        facts.workspace === null &&
         this.deps.workspaces.recovery !== undefined &&
-        events.some((event) => event.type === 'workspace.provisioned')
+        (await history()).some((event) => event.type === 'workspace.provisioned')
       ) {
-        const kicked = await this.ensureProvisionContinuation(record, events, 'launch')
+        const kicked = await this.ensureProvisionContinuation(record, await history(), 'launch')
         if (kicked === 'kicked') {
           report.provisioning += 1
           report.swept += 1
@@ -2764,16 +2857,15 @@ export class Dispatcher {
     opts: TickOpts = {},
     autoMergeSeedFact: AutoMergeDefaultFact | undefined = undefined,
   ): Promise<void> {
-    const { store, tickets, config } = this.deps
+    const store = this.store
+    const { tickets, config } = this.deps
     // Blocked and paused builds still occupy a slot: their workspaces and
     // pending work are live, only waiting on a human. Capacity is per repo
     // (§16.1) — another repo's builds never consume this repo's slots.
     let active = 0
     const activeTicketIds = new Set<string>()
-    for (const record of await store.listBuilds()) {
-      if (record.repo !== this.deps.repo) continue
-      const state = reduceBuild(await store.getEvents(record.slug))
-      if (state.status !== 'done' && state.status !== 'aborted') {
+    for (const { record, digest } of await this.repoBuildDigests()) {
+      if (digest.terminal === undefined) {
         active += 1
         if (record.ticket) activeTicketIds.add(record.ticket.id)
       }
@@ -2784,9 +2876,11 @@ export class Dispatcher {
     // standing queue-depth report and must stay honest exactly when the
     // dispatcher is saturated. Sources that keep a claimed ticket in the
     // ready state are deduped against the active builds embodying them.
-    const journalBeforeReady = await readRepoEventsIfRecorded(this.deps.store, this.deps.repo)
+    await this.store.refreshJournal()
+    const journalBeforeReady = this.store.recordedJournal()
     const listing = await tickets.listReady(readyCriteria(config))
-    const journalAfterReady = await readRepoEventsIfRecorded(this.deps.store, this.deps.repo)
+    await this.store.refreshJournal()
+    const journalAfterReady = this.store.recordedJournal()
     const creationHolds = new Map(
       harvestCreationsDuringReadyScan(journalBeforeReady, journalAfterReady).map((creation) => [
         creation.creationKey.toLowerCase(),
@@ -3023,7 +3117,7 @@ export class Dispatcher {
   /** Valid bounded base, deduped store-wide with -2/-3/… suffixes. */
   private async uniqueSlug(base: string): Promise<string> {
     let slug = base
-    for (let n = 2; (await this.deps.store.getBuild(slug)) !== null; n += 1) {
+    for (let n = 2; (await this.store.getBuild(slug)) !== null; n += 1) {
       slug = `${base}-${n}`
     }
     return slug