[itswl]

The watch scanner wrote its new cursors before the model ran. A round whose run failed — a model error, a dead gateway, a refused delivery, a timer restart between scan and POST — was never looked at again, and nothing said so: the next tick scanned from the new cursor as if the round had been judged. A second deployment running a copy of this scanner measured it on 2026-10-12 (two rounds lost to one configuration fault) and fixed it by staging the cursor and reconciling against the job's run record. This is that shape, built from the pieces this family already has.

How it works (deploy/watch/watch_scan.py, hookprobe/examples/patrols/patrol-timer.sh, the work compose)

• A round that fires stages its new cursors under staged in scan.json and runs Jira against a staged copy of its state; feeds keeps the committed cursors.
• After each POST the timer writes what the pipe answered to round.json (posted, event id, outcome, fired-at).
• The next tick settles first, before the window check: the scanner reads the node's own run record for probe:watch-due:<event id> under the timer's read-only /node-state/results mount. completed commits the cursors and the Jira copy. failed, a POST that failed, an answer other than routed, or no finished record within WATCH_RUN_TIMEOUT (30 min) puts the cursors back; the next scan re-offers from them and says so in the digest. A run still going holds the tick instead of offering the same messages twice.
• After two replays and an hour since the first failure, only the first lost round's content is skipped (its cursors are committed) and the skipped span is named in the digest until a round lands. Jira is never skipped: its lookback re-reports the span, and a repeat is a nuisance where a miss is a failure.
• offered and previous keep their meaning for the signer and the poster; a quiet round (no model asked) commits directly as before.

Tests — twelve in deploy/watch/tests/test_scan.py: commit on completed, replay on failed / not posted / posted before the scan / not routed / no event id, hold while a run is young or still running, lost past the timeout, give up after two replays and an hour (and not before), a stray Jira copy dropped, the skipped note cleared by a delivered round, the record found by its key, and Jira running against the staged copy with the committed state untouched.

Docs — a paragraph in docs/deployments.md under the work shape; decision note .agents/notes/implemented/2026-10-19-the-cursor-moves-when-the-round-is-known-to-have-landed.md.

Nothing is running; the work stack picks this up at its next recreate (the timer's two new variables are in the compose). Gate: STACK GATE GREEN locally; CI read back below before merging.