@agent-relay/factory 0.1.58 → 0.1.60

package/dist/orchestrator/factory.js

@@ -8,7 +8,7 @@ import { GithubMergeGate, closeProbePr } from '../github/index.js';
 import { VerificationPipeline } from '../environments/verification-pipeline.js';
 import { factoryWorktreeIssueSlug, factoryWorktreePath } from '../git/agent-worktree.js';
 import { InMemoryStateStore } from '../state/in-memory-state-store.js';
-import { containsExplicitIssueReference, containsIssueKey } from '../issue-key-match.js';
+import { containsExplicitIssueReference, containsIssueKey, factoryBranchBelongsToIssue } from '../issue-key-match.js';
 import { normalizeLogger, normalizeLogValue, setSafeErrorStack, stringifyLogValue } from '../logging.js';
 import { isInFactoryScope } from '../safety/factory-scope.js';
 import { dispatchRelayflowForChangeEvent } from '../dispatch/relayflow-registry.js';
@@ -28,6 +28,7 @@ import { findAgentProcessByName, readProcessIdentity } from './process-identity.
 import { readFactoryInFlightRegistry, terminatePids } from './reaper.js';
 import { createFactoryCloudEventV1, factoryCloudReleaseReasonV1, } from '../observability/events.js';
 import { boundedRunCostTotal, CostLedger } from '../cost/ledger.js';
+import { createTicketDispatchDelivery } from '../delivery/ticket-dispatch.js';
 class ClarificationWakeLeaseLostError extends Error {
 }
 class ClarificationQuestionDeliveryLeaseLostError extends Error {
@@ -86,6 +87,29 @@ const BABYSITTER_SUBSCRIPTION_EVENT_TYPES = [
     'check_run.completed',
 ];
 const BABYSITTER_SUBSCRIPTION_TERMINAL_EVENT_TYPES = ['pull_request.closed'];
+// The PR-open snapshot read is the single gate that decides whether a PR ever
+// gets a babysitter, so a transient mount fetch failure must not be allowed to
+// settle that question. Retry in-line, then dead-letter for the reconcile sweep.
+const BABYSITTER_PR_SNAPSHOT_READ_ATTEMPTS = 3;
+const BABYSITTER_PR_SNAPSHOT_READ_BACKOFF_MS = 250;
+// Escalate from warn to error once in-line retries plus this many sweep retries
+// have all failed: the PR is durably unreadable, not momentarily unlucky.
+const BABYSITTER_PR_SNAPSHOT_DEAD_LETTER_ESCALATE_AFTER = 3;
+// Bound the dead-letter book so a sustained mount outage cannot grow it without
+// limit. Oldest entries are evicted first; the reconcile sweep still adopts
+// their PRs through the ownerless-record path.
+const BABYSITTER_PR_SNAPSHOT_DEAD_LETTER_LIMIT = 256;
+// Retries carry backoff sleeps, so a sweep drains a slice rather than the whole
+// book; failed entries rotate to the end so successive sweeps cover all of it.
+const BABYSITTER_PR_SNAPSHOT_DRAIN_PER_SWEEP = 16;
+// A durably faulted mount would otherwise log an error per path per sweep.
+const BABYSITTER_PR_SNAPSHOT_ESCALATED_LOG_EVERY = 20;
+// Adoption probes an issue's open PR through the (already gh-backed-off) probe
+// resolver, so it runs on its own slower cadence than the completion sweep.
+const BABYSITTER_ORPHAN_SWEEP_INTERVAL_MS = 60_000;
+// Warn once per PR identity that arrives unowned, then fall back to debug. The
+// counter carries the true volume; the log only has to make it discoverable.
+const BABYSITTER_UNOWNED_PR_WARN_LIMIT = 64;
 const BABYSITTER_RESOURCE_DELIVERY_RETRY_MS = 5_000;
 const BABYSITTER_RESOURCE_SUBSCRIPTION_RENEW_MS = (BABYSITTER_SUBSCRIPTION_TTL_SECONDS * 1_000) / 2;
 // A babysitter wake fails with a "registration lag" error (agent_not_found /
@@ -111,6 +135,8 @@ const STOP_TEARDOWN_TIMEOUT_MS = 2_500;
 const DISPATCH_LIFECYCLE_LEASE_MS = 5 * 60_000;
 const DISPATCH_LIFECYCLE_RENEW_MS = 60_000;
 const DISPATCH_LIFECYCLE_RETRY_MS = 1_000;
+const DISPATCH_WRITEBACK_MAX_ATTEMPTS = 3;
+const DISPATCH_WRITEBACK_RETRY_MS = 250;
 const STARTUP_AGENT_EXIT_DRAIN_TIMEOUT_MS = 30_000;
 const RECONCILED_AGENT_EXIT_CONCURRENCY = 4;
 const SLACK_EVENT_WATERMARK_CACHE_MS = 60_000;
@@ -124,6 +150,10 @@ const DISPATCH_FAILURE_HANDOFF_UNRESOLVED_TTL_MS = 5 * 60_000;
 const DEFAULT_LIVE_HEARTBEAT_INTERVAL_MS = 15_000;
 const REMOTE_OPERATION_PROGRESS_INTERVAL_MS = 15_000;
 const REMOTE_OPERATION_SLOW_WARN_MS = 30_000;
+const DISCOVERY_SWEEP_LEASE_MS = 5 * 60_000;
+const DISCOVERY_SWEEP_RENEW_MS = 30_000;
+const DISCOVERY_CHANGE_EVENT_LIMIT = 1_000;
+const DISCOVERY_OVERLOAD_BACKOFF_MAX_MS = 5 * 60_000;
 const GITHUB_FACTORY_LABEL = 'factory';
 const GITHUB_LIFECYCLE_LABELS = new Set(['factory:in-progress', 'factory:human-review']);
 const GITHUB_MIRROR_TITLE_PREFIX = '[factory]';
@@ -191,6 +221,7 @@ export class FactoryLoop {
     #mount;
     #states;
     #fleet;
+    #ticketDispatchDelivery;
     #triage;
     #linear;
     #github;
@@ -268,6 +299,7 @@ export class FactoryLoop {
     #clarificationWakeRetryTimers = new Map();
     #clarificationWakeOwner = `${process.pid}:${randomUUID()}`;
     #dispatchLifecycleOwner = `${process.pid}:${randomUUID()}`;
+    #discoverySweepOwner = `${process.pid}:${randomUUID()}`;
     #dispatchLifecycleEpochs = new Map();
     #dispatchTerminalWaiters = new Map();
     #dispatchLifecycleRetryTimers = new Map();
@@ -275,6 +307,7 @@ export class FactoryLoop {
     #abandonedDispatchReasons = new Map();
     #dispatchLifecycleCapacityWaitLogged = new Set();
     #dispatchLifecycleOwnershipWaitLogged = new Set();
+    #dispatchClaimStatuses = new Map();
     #localReleaseCheckpoints = new Map();
     #dispatchLifecycleRenewTimer;
     #clarificationSweepTimer;
@@ -305,6 +338,9 @@ export class FactoryLoop {
     #liveHeartbeatRefresh;
     #liveHeartbeatLastWriteMs = 0;
     #stoppingHeartbeatRefreshActive = false;
+    #readinessReconcileTimer;
+    #readinessReconcileInFlight;
+    #readinessReconcileIntervalMs = 60_000;
     #liveEventQueue = [];
     #liveEventDrainScheduled = false;
     #liveEventDrainActive = false;
@@ -335,6 +371,18 @@ export class FactoryLoop {
     // webhook-fed mount path so readiness can re-read PR meta without a gh call.
     #babysitterPr = new Map();
     #babysitterIssueRefs = new Map();
+    // PR meta paths whose snapshot read exhausted its in-line retries. Without
+    // this book a single failed read permanently orphans the PR: no babysitter is
+    // spawned, so no owner exists, so every later event for it is discarded. The
+    // reconcile sweep drains this and clears entries that recover.
+    #babysitterPrSnapshotDeadLetters = new Map();
+    // PR identities already warned about as unowned, so the routing log reports
+    // the condition at default level without repeating per event.
+    #babysitterUnownedPrWarned = new Set();
+    #babysitterOrphanSweepActive = false;
+    #babysitterOrphanSweepLastRunMs = 0;
+    #babysitterOrphanReportedFailures = 0;
+    #babysitterOrphanReportedUnowned = 0;
     // Relayfile matches subscription IDs server-side. This direct index means a
     // delivery claim never requires the legacy local repo/PR scan to find an
     // owning babysitter.
@@ -367,6 +415,13 @@ export class FactoryLoop {
     // undefined = readiness not yet probed; resolved lazily so the standalone
     // runOnce() path (which skips #start) still ingests when the mount is present.
     #githubIngestionEnabled;
+    #runOnceInFlight;
+    #runOnceInFlightDryRun;
+    #discoverySession;
+    #discoverySweepEpoch;
+    #discoverySweepRenewTimer;
+    #discoverySweepLeaseLost = false;
+    #discoveryOverloadError;
     #resolvedIssueSource;
     #integrationInstructions;
     #integrationInstructionsRefresh;
@@ -384,6 +439,9 @@ export class FactoryLoop {
         this.#states = ports.stateResolution ?? stateResolutionFromIds(config.stateIds, config.linear.states);
         installFactoryDraftPredicate(this.#mount, config);
         this.#fleet = ports.fleet;
+        this.#ticketDispatchDelivery = ports.ticketDispatchDelivery ?? createTicketDispatchDelivery({
+            mountRoot: config.localMountRoot,
+        });
         this.#triage = ports.triage ?? new TieredTriage(new HeuristicTriage());
         this.#linear = ports.linear ?? MountLinearWriteback(ports.mount, {
             safety: config.safety,
@@ -481,7 +539,7 @@ export class FactoryLoop {
                     }
                 },
                 listPaths: async (prefix) => {
-                    return this.#mount.listTree(prefix);
+                    return this.#listRelayfileTree(prefix, 'integration descriptor discovery');
                 },
             };
             const descriptors = await deriveDescriptorsFromMount(reader);
@@ -674,6 +732,7 @@ export class FactoryLoop {
                 await this.#rearmSlackReplyWatchers();
                 await this.#drainReadyClarificationWake();
                 await this.#rearmGithubIssueCommentWatchers();
+                this.#scheduleReadinessReconcile();
                 this.#scheduleCompletionSweep(0);
                 return;
             }
@@ -734,9 +793,13 @@ export class FactoryLoop {
         if (this.#completionSweepTimer)
             clearTimeout(this.#completionSweepTimer);
         this.#completionSweepTimer = undefined;
+        if (this.#readinessReconcileTimer)
+            clearTimeout(this.#readinessReconcileTimer);
+        this.#readinessReconcileTimer = undefined;
         if (this.#previewSweepTimer)
             clearTimeout(this.#previewSweepTimer);
         this.#previewSweepTimer = undefined;
+        await this.#readinessReconcileInFlight;
         await this.#previewSweepInFlight;
         this.#stoppingHeartbeatRefreshActive = await this.#stopLiveHeartbeat('stopping');
         try {
@@ -781,6 +844,9 @@ export class FactoryLoop {
             this.#babysitterSubscriptionOwners.clear();
             this.#babysitterReady.clear();
             this.#babysitterCriticalAgents.clear();
+            this.#babysitterPrSnapshotDeadLetters.clear();
+            this.#babysitterUnownedPrWarned.clear();
+            this.#babysitterOrphanSweepLastRunMs = 0;
             const subscription = this.#subscription;
             this.#subscription = undefined;
             await this.#boundedStopTeardown('factory subscription unsubscribe', () => subscription?.unsubscribe());
@@ -875,6 +941,7 @@ export class FactoryLoop {
     async #startLiveSubscription(issueSource, overrides = {}) {
         const options = this.#liveOptions(overrides);
         this.#liveTransport = options.transport;
+        this.#readinessReconcileIntervalMs = options.reconcileIntervalMs;
         this.#liveConnectStartedAtMs = this.#clock.now();
         this.#liveReplaySkewMarginMs = options.replaySkewMarginMs;
         const highWatermark = await this.#currentEventHighWatermark();
@@ -1005,6 +1072,7 @@ export class FactoryLoop {
             pollIntervalMs: overrides.pollIntervalMs ?? this.#config.liveSubscription.pollIntervalMs,
             eventLimit: overrides.eventLimit ?? this.#config.liveSubscription.eventLimit,
             replaySkewMarginMs: overrides.replaySkewMarginMs ?? this.#config.liveSubscription.replaySkewMarginMs,
+            reconcileIntervalMs: overrides.reconcileIntervalMs ?? this.#config.liveSubscription.reconcileIntervalMs,
         };
     }
     async #currentEventCursor(limit) {
@@ -1031,6 +1099,48 @@ export class FactoryLoop {
             };
         }
     }
+    #scheduleReadinessReconcile(delayMs = this.#readinessReconcileIntervalMs) {
+        if (!this.#started ||
+            this.#stopping ||
+            this.#readinessReconcileTimer ||
+            this.#readinessReconcileInFlight)
+            return;
+        this.#readinessReconcileTimer = setTimeout(() => {
+            this.#readinessReconcileTimer = undefined;
+            if (!this.#started || this.#stopping)
+                return;
+            const sweep = this.#reconcileReadyIssues();
+            this.#readinessReconcileInFlight = sweep;
+            void sweep.finally(() => {
+                if (this.#readinessReconcileInFlight === sweep) {
+                    this.#readinessReconcileInFlight = undefined;
+                }
+                if (this.#started && !this.#stopping)
+                    this.#scheduleReadinessReconcile();
+            });
+        }, delayMs);
+        this.#readinessReconcileTimer.unref?.();
+    }
+    async #reconcileReadyIssues() {
+        this.#increment('readinessReconcileSweeps');
+        this.#logger.info?.('[factory] periodic readiness reconciliation started', {
+            intervalMs: this.#readinessReconcileIntervalMs,
+        });
+        try {
+            const report = await this.runOnce();
+            this.#logger.info?.('[factory] periodic readiness reconciliation completed', {
+                candidates: report.pulled.length,
+                dispatched: report.dispatched.length,
+                skipped: report.skipped.length,
+            });
+        }
+        catch (error) {
+            this.#increment('readinessReconcileErrors');
+            this.#logger.warn?.('[factory] periodic readiness reconciliation failed; retry remains scheduled', {
+                error: describeError(error).errorMessage,
+            });
+        }
+    }
     #scheduleLivePoll(delayMs, options) {
         if (this.#livePollTimer || !this.#started)
             return;
@@ -1340,6 +1450,10 @@ export class FactoryLoop {
         // not this polling sweep. Disabling it here is what makes the babysitter path
         // webhook-driven rather than polled.
         if (this.#config.babysitter.enabled) {
+            // Webhook-driven is not the same as one-shot: a PR-open event that was
+            // missed or whose snapshot read failed leaves its PR with no shepherd
+            // forever. This is the reconciliation that recovers those.
+            await this.#sweepOrphanedBabysitterPrs(reason);
             return;
         }
         if (this.#completionSweepActive) {
@@ -1401,6 +1515,207 @@ export class FactoryLoop {
             this.#completionSweepActive = false;
         }
     }
+    // Reconciliation for the babysitter's one-shot PR-open path. Two failure
+    // modes converge on the same end state — an open Factory PR that no
+    // babysitter owns, whose reviews, CI results and conflicts are then silently
+    // discarded by #routeBabysitterEvent:
+    //   1. the PR-open snapshot read failed and exhausted its retries, or
+    //   2. the PR-open event never arrived at all (restart, drain loss, gap).
+    // Neither is self-healing from events alone, so this sweep re-reads the
+    // dead-lettered paths and adopts still-ownerless in-flight records.
+    async #sweepOrphanedBabysitterPrs(reason = 'forced') {
+        if (!this.#config.babysitter.enabled || this.#stopping || this.#babysitterOrphanSweepActive) {
+            return;
+        }
+        const now = this.#clock.now();
+        // Adoption probes every ownerless in-flight record, so it runs on the slow
+        // cadence. A dead-lettered read is a PR we already know is unshepherded —
+        // it retries at every sweep opportunity rather than waiting out that cadence.
+        const adoptionDue = reason === 'forced' ||
+            now - this.#babysitterOrphanSweepLastRunMs >= BABYSITTER_ORPHAN_SWEEP_INTERVAL_MS;
+        if (!adoptionDue && this.#babysitterPrSnapshotDeadLetters.size === 0) {
+            return;
+        }
+        this.#babysitterOrphanSweepActive = true;
+        try {
+            this.#increment('babysitterOrphanSweepRuns');
+            await this.#retryDeadLetteredPrSnapshots();
+            if (adoptionDue) {
+                this.#babysitterOrphanSweepLastRunMs = now;
+                await this.#adoptOrphanedBabysitterPrs();
+            }
+            this.#reportBabysitterOrphanHealth();
+        }
+        finally {
+            this.#babysitterOrphanSweepActive = false;
+        }
+    }
+    async #retryDeadLetteredPrSnapshots() {
+        // Each retry costs up to BABYSITTER_PR_SNAPSHOT_READ_ATTEMPTS reads with
+        // backoff sleeps between them, so drain a bounded slice per sweep rather
+        // than stalling the sweep behind a full book during a mount outage. A
+        // failed retry re-inserts its entry at the end, so successive sweeps
+        // rotate through the whole book.
+        const batch = [...this.#babysitterPrSnapshotDeadLetters.keys()].slice(0, BABYSITTER_PR_SNAPSHOT_DRAIN_PER_SWEEP);
+        if (this.#babysitterPrSnapshotDeadLetters.size > batch.length) {
+            this.#logger.warn?.('[factory] babysitter dead-letter drain is rate limited', {
+                deadLettered: this.#babysitterPrSnapshotDeadLetters.size,
+                retryingThisSweep: batch.length,
+            });
+        }
+        for (const path of batch) {
+            if (this.#stopping)
+                return;
+            this.#increment('babysitterPrSnapshotDeadLettersRetried');
+            // #handlePrChange clears the entry itself on a successful read and
+            // re-records the failure (bumping `failures`, escalating the log) if the
+            // mount is still faulted, so the whole retry contract lives in one place.
+            await this.#handlePrChange(path);
+        }
+    }
+    async #adoptOrphanedBabysitterPrs() {
+        const batch = await this.#batch();
+        for (const record of batch.inFlight) {
+            if (this.#stopping)
+                return;
+            if (record.dryRun || this.#hasBabysitterForIssue(record.issue))
+                continue;
+            if (!await this.#assertIssueDispatchLifecycleOwner(record.issue))
+                continue;
+            this.#increment('babysitterOrphanCandidatesScanned');
+            try {
+                for (const path of await this.#orphanedPrMetaPaths(record)) {
+                    if (this.#stopping || this.#hasBabysitterForIssue(record.issue))
+                        break;
+                    // Replay the PR meta through the normal PR-open handler rather than
+                    // spawning directly. Adoption must be subject to exactly the same
+                    // ownership, weak-match and path/payload-identity guards as a live
+                    // PR-open event — a reconcile sweep is a second delivery of a missed
+                    // event, never a way around the checks that event would have faced.
+                    await this.#handlePrChange(path);
+                }
+            }
+            catch (error) {
+                this.#increment('babysitterOrphanAdoptionErrors');
+                this.#logger.warn?.('[factory] babysitter orphan adoption failed', {
+                    issue: record.issue.key,
+                    error: describeError(error).errorMessage,
+                });
+                continue;
+            }
+            if (!this.#hasBabysitterForIssue(record.issue))
+                continue;
+            this.#increment('babysitterOrphanedPrsAdopted');
+            this.#logger.warn?.('[factory] adopted an orphaned PR that no babysitter owned', {
+                issue: record.issue.key,
+                ...this.#babysitterPrForIssue(record.issue),
+            });
+        }
+    }
+    // Candidate PR meta paths for an ownerless record, newest PR first. Resolution
+    // reuses the durable dispatch receipts and then the probe resolver (which
+    // carries its own gh backoff, so a record whose implementer has not opened a
+    // PR yet costs no more than a cached miss).
+    async #orphanedPrMetaPaths(record) {
+        const wanted = [];
+        if (this.#usesDurableDispatchLifecycle()) {
+            const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+            const receipts = lifecycle?.pullRequests ?? (lifecycle?.pullRequest ? [lifecycle.pullRequest] : []);
+            for (const receipt of receipts)
+                wanted.push({ repo: receipt.repo, prNumber: receipt.number });
+        }
+        if (wanted.length === 0) {
+            const issue = await this.#readIssue(record.issue.path);
+            const pr = issue ? await this.#openPrForIssue(issue) : undefined;
+            if (pr)
+                wanted.push({ repo: pr.repo, prNumber: pr.prNumber });
+        }
+        const paths = [];
+        for (const { repo, prNumber } of wanted) {
+            for (const root of githubPullRoots(repo)) {
+                let candidates;
+                try {
+                    candidates = await this.#mount.listTree(root);
+                }
+                catch {
+                    continue;
+                }
+                const match = candidates.find((path) => {
+                    const parts = githubPullPathParts(path);
+                    return parts?.number === prNumber &&
+                        `${parts.owner}/${parts.repo}`.toLowerCase() === repo.toLowerCase();
+                });
+                if (match && !paths.includes(match)) {
+                    paths.push(match);
+                    break;
+                }
+            }
+        }
+        if (paths.length === 0 && wanted.length > 0) {
+            // The PR exists but its meta has not materialized in the mount yet. Leave
+            // it for the next sweep rather than spawning off an unvalidated receipt.
+            this.#increment('babysitterOrphanPrMetaUnavailable');
+        }
+        return paths;
+    }
+    #hasBabysitterForIssue(issue) {
+        return this.#babysitterPrForIssue(issue) !== undefined;
+    }
+    #babysitterPrForIssue(issue) {
+        const wanted = issueKey(issue);
+        for (const [key, ref] of this.#babysitterPr) {
+            // Ownership keys are composite (issue + PR), so resolve the issue the same
+            // way #babysitterOwnerFor does: the recorded ref, else the key itself for
+            // the legacy issue-keyed form. Never fall back to the issue being tested,
+            // which would make every entry match.
+            const owningIssue = this.#babysitterIssueRefs.get(key);
+            if ((owningIssue ? issueKey(owningIssue) : key) !== wanted)
+                continue;
+            // An empty agentName is the pre-spawn reservation #ensureBabysitter takes
+            // before its first await; that is ownership in progress, not an orphan.
+            return { repo: ref.repo, prNumber: ref.prNumber };
+        }
+        return undefined;
+    }
+    // The two counters that mark a PR losing its shepherd are otherwise only
+    // visible by diffing `status().counters`. Report the deltas so the condition
+    // reaches an operator reading logs at default level.
+    #reportBabysitterOrphanHealth() {
+        const readFailures = this.#counters.babysitterPrSnapshotReadFailures ?? 0;
+        const unownedEvents = this.#counters.babysitterEventsIgnoredUnownedPr ?? 0;
+        const newReadFailures = readFailures - this.#babysitterOrphanReportedFailures;
+        const newUnownedEvents = unownedEvents - this.#babysitterOrphanReportedUnowned;
+        const deadLettered = this.#babysitterPrSnapshotDeadLetters.size;
+        this.#counters.babysitterPrSnapshotDeadLetterDepth = deadLettered;
+        if (newReadFailures <= 0 && newUnownedEvents <= 0 && deadLettered === 0) {
+            return;
+        }
+        this.#babysitterOrphanReportedFailures = readFailures;
+        this.#babysitterOrphanReportedUnowned = unownedEvents;
+        // The oldest stuck entry is what an operator needs to act on: it names the
+        // PR and how long it has been unshepherded.
+        let oldest;
+        for (const [path, entry] of this.#babysitterPrSnapshotDeadLetters) {
+            if (!oldest || entry.firstFailedAtMs < oldest.entry.firstFailedAtMs)
+                oldest = { path, entry };
+        }
+        this.#logger.warn?.('[factory] babysitter PR routing is dropping work', {
+            prSnapshotReadFailures: readFailures,
+            newPrSnapshotReadFailures: Math.max(0, newReadFailures),
+            unownedPrEventsIgnored: unownedEvents,
+            newUnownedPrEventsIgnored: Math.max(0, newUnownedEvents),
+            deadLetteredPrSnapshots: deadLettered,
+            flatEventsUnreadable: this.#counters.babysitterFlatEventsUnreadable ?? 0,
+            orphanedPrsAdopted: this.#counters.babysitterOrphanedPrsAdopted ?? 0,
+            ...(oldest
+                ? {
+                    oldestDeadLetterPath: oldest.path,
+                    oldestDeadLetterError: oldest.entry.lastErrorMessage,
+                    oldestDeadLetterAgeMs: Math.max(0, this.#clock.now() - oldest.entry.firstFailedAtMs),
+                }
+                : {}),
+        });
+    }
     async #completionPrForIssue(issue) {
         if (this.#customProbePrResolver) {
             return this.#probePrResolver(issue);
@@ -1426,7 +1741,7 @@ export class FactoryLoop {
         if (cached && cached.expiresAtMs > now) {
             return cached.pr;
         }
-        const mountPr = await resolveIssuePrFromMount(this.#mount, this.#config, issue, opts);
+        const mountPr = await resolveIssuePrFromMount(this.#mount, this.#config, issue, opts, (prefix) => this.#listRelayfileTree(prefix, 'PR probe resolution'));
         if (mountPr) {
             return mountPr;
         }
@@ -1449,6 +1764,128 @@ export class FactoryLoop {
         return undefined;
     }
     async runOnce(opts = {}) {
+        const dryRun = opts.dryRun ?? this.#config.dryRun;
+        // Loop rather than a single check-then-wait: while this call was waiting
+        // out a mismatched sweep, another mismatched caller may have raced it to
+        // start the *next* sweep first — in which case that one might match us
+        // and we should coalesce onto it rather than starting a third.
+        for (;;) {
+            if (this.#runOnceInFlight && this.#runOnceInFlightDryRun === dryRun) {
+                this.#increment('discoverySweepsCoalesced');
+                this.#logger.info?.('[factory] coalesced overlapping discovery request into the in-flight sweep');
+                return await this.#runOnceInFlight;
+            }
+            // A mismatched dryRun cannot coalesce onto the in-flight sweep (it
+            // would hand a live caller a dry-run report, or vice versa), but it
+            // still must not race it — wait for it to settle before either
+            // re-checking for a newly-started matching sweep or claiming the lease.
+            if (!this.#runOnceInFlight)
+                break;
+            await this.#runOnceInFlight.catch(() => undefined);
+        }
+        const sweep = this.#runOnceWithDiscoveryFence({ dryRun });
+        this.#runOnceInFlight = sweep;
+        this.#runOnceInFlightDryRun = dryRun;
+        try {
+            return await sweep;
+        }
+        finally {
+            if (this.#runOnceInFlight === sweep) {
+                this.#runOnceInFlight = undefined;
+                this.#runOnceInFlightDryRun = undefined;
+            }
+        }
+    }
+    async #runOnceWithDiscoveryFence(opts) {
+        let claim = await this.#state.claimDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, this.#clock.now(), DISCOVERY_SWEEP_LEASE_MS);
+        if (!claim.acquired && claim.reason === 'backoff') {
+            const delayMs = Math.max(0, claim.state.backoffUntilMs - this.#clock.now());
+            this.#increment('discoveryBackoffWaits');
+            this.#logger.warn?.('[factory] discovery sweep waiting for Relayfile overload backoff', {
+                delayMs,
+                backoffUntilMs: claim.state.backoffUntilMs,
+                consecutiveOverloads: claim.state.consecutiveOverloads,
+            });
+            await this.#clock.sleep(delayMs);
+            claim = await this.#state.claimDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, this.#clock.now(), DISCOVERY_SWEEP_LEASE_MS);
+        }
+        if (!claim.acquired || !claim.lease) {
+            this.#increment('discoverySweepsSkippedInFlight');
+            this.#logger.info?.('[factory] skipped discovery because another process owns the sweep lease', {
+                leaseUntilMs: claim.state.lease?.leaseUntilMs,
+            });
+            return {
+                pulled: [],
+                triaged: [],
+                dispatched: [],
+                skipped: [],
+                dryRun: opts.dryRun ?? this.#config.dryRun,
+                discoveryDeferred: 'sweep-in-flight',
+            };
+        }
+        this.#discoverySweepEpoch = claim.lease.epoch;
+        this.#discoverySweepLeaseLost = false;
+        this.#discoveryOverloadError = undefined;
+        this.#startDiscoverySweepRenewal(claim.lease.epoch);
+        let leaseReleased = false;
+        try {
+            this.#discoverySession = await this.#prepareDiscoverySession(claim);
+            const report = await this.#performRunOnce(opts);
+            if (this.#discoveryOverloadError)
+                throw this.#discoveryOverloadError;
+            const checkpoint = await this.#finalizeDiscoveryCheckpoint();
+            if (this.#discoverySweepLeaseLost) {
+                throw new Error('discovery sweep lease was lost before checkpoint commit');
+            }
+            const completed = await this.#state.completeDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, claim.lease.epoch, checkpoint);
+            leaseReleased = completed;
+            if (!completed)
+                throw new Error('discovery sweep lease was lost before completion');
+            return report;
+        }
+        catch (error) {
+            const overload = relayfileOverload(error);
+            if (overload) {
+                const consecutiveOverloads = claim.state.consecutiveOverloads + 1;
+                const delayMs = discoveryOverloadBackoffMs(overload.retryAfterSeconds, consecutiveOverloads);
+                const backoffUntilMs = this.#clock.now() + delayMs;
+                leaseReleased = await this.#state.deferDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, claim.lease.epoch, backoffUntilMs, consecutiveOverloads);
+                this.#increment('discoveryOverloadBackoffs');
+                this.#logger.warn?.('[factory] Relayfile discovery overloaded; backing off before another sweep', {
+                    status: overload.status,
+                    reason: overload.reason,
+                    retryAfterSeconds: overload.retryAfterSeconds,
+                    delayMs,
+                    backoffUntilMs,
+                    consecutiveOverloads,
+                });
+                // backoffUntilMs is already durable via deferDiscoverySweep, and the
+                // next runOnce() honors it at the pre-claim wait above — sleeping
+                // here too would additionally block this failing call (and every
+                // caller coalesced onto it) for up to the full backoff window while
+                // still holding the coalescing slot.
+            }
+            throw error;
+        }
+        finally {
+            if (this.#discoverySweepRenewTimer)
+                clearInterval(this.#discoverySweepRenewTimer);
+            this.#discoverySweepRenewTimer = undefined;
+            this.#discoverySession = undefined;
+            this.#discoverySweepEpoch = undefined;
+            this.#discoveryOverloadError = undefined;
+            // This sweep is over either way (committed, deferred, or lease lost) —
+            // a stale `true` here would otherwise make every #listRelayfileTree
+            // call outside a fresh claim (Slack lookups, PR confirmation, the
+            // merge-advance scan) throw "lease was lost" until the next sweep
+            // happens to run and reset it at the top of this method.
+            this.#discoverySweepLeaseLost = false;
+            if (!leaseReleased) {
+                await this.#state.releaseDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, claim.lease.epoch);
+            }
+        }
+    }
+    async #performRunOnce(opts = {}) {
         const dryRun = opts.dryRun ?? this.#config.dryRun;
         const startedAtMs = this.#clock.now();
         const relayfileWaitWarningsAtStart = this.#counters.relayfileOperationWaitWarnings ?? 0;
@@ -1479,6 +1916,14 @@ export class FactoryLoop {
             const triaged = [];
             const dispatched = [];
             const skipped = [];
+            const recordSkip = (entry) => {
+                skipped.push(entry);
+                this.#logger.info?.('[factory] readiness reconciliation skipped dispatch', {
+                    issue: entry.issue.key,
+                    path: entry.issue.path,
+                    reason: entry.reason,
+                });
+            };
             let lastReadyReadProgressAtMs = this.#clock.now();
             let readyIssueReads = 0;
             const issueEntries = [];
@@ -1523,7 +1968,6 @@ export class FactoryLoop {
                 const mayRecoverGithubOrphan = !wasReady &&
                     !dryRun &&
                     issueSource === 'github' &&
-                    Boolean(orphanRecovery) &&
                     Boolean(requiredLabel) &&
                     Boolean(labels?.has(requiredLabel)) &&
                     Boolean(labels?.has('factory:in-progress')) &&
@@ -1531,26 +1975,31 @@ export class FactoryLoop {
                 if (!mayRecoverGithubOrphan) {
                     const dispatchBlock = await this.#dispatchBlockReason(issue);
                     if (dispatchBlock) {
-                        skipped.push({ issue: issueRef(issue), reason: dispatchBlock });
+                        recordSkip({ issue: issueRef(issue), reason: dispatchBlock });
                         continue;
                     }
                 }
+                const orphanResult = mayRecoverGithubOrphan
+                    ? await this.#reconcileOrphanedGithubInProgress(issue, orphanRecovery, dryRun)
+                    : { recovered: false };
+                const recoveredOrphan = orphanResult.recovered;
                 const batch = await this.#batch();
                 if (batch.isInFlight(issue) || batch.isQueued(issue)) {
-                    skipped.push({ issue: issueRef(issue), reason: 'already tracked' });
+                    recordSkip({ issue: issueRef(issue), reason: orphanResult.reason ?? 'already tracked' });
                     continue;
                 }
-                const recoveredOrphan = mayRecoverGithubOrphan &&
-                    await this.#reconcileOrphanedGithubInProgress(issue, orphanRecovery, dryRun);
                 if (!wasReady && !recoveredOrphan) {
                     if (mayRecoverGithubOrphan) {
                         const dispatchBlock = await this.#dispatchBlockReason(issue);
                         if (dispatchBlock) {
-                            skipped.push({ issue: issueRef(issue), reason: dispatchBlock });
+                            recordSkip({ issue: issueRef(issue), reason: dispatchBlock });
                             continue;
                         }
                     }
-                    skipped.push({ issue: issueRef(issue), reason: 'live state is not ready-for-agent' });
+                    recordSkip({
+                        issue: issueRef(issue),
+                        reason: orphanResult.reason ?? 'live state is not ready-for-agent',
+                    });
                     continue;
                 }
                 const recoveredIdentity = recoveredOrphan ? githubIssueRefIdentity(issueRef(issue)) : undefined;
@@ -1558,16 +2007,16 @@ export class FactoryLoop {
                     if (recoveredOrphan) {
                         const dispatchBlock = await this.#dispatchBlockReason(issue);
                         if (dispatchBlock) {
-                            skipped.push({ issue: issueRef(issue), reason: dispatchBlock });
+                            recordSkip({ issue: issueRef(issue), reason: dispatchBlock });
                             continue;
                         }
                     }
                     if (!isInFactoryScope(issue, this.#config.safety)) {
-                        skipped.push({ issue: issueRef(issue), reason: 'not factory-e2e scope' });
+                        recordSkip({ issue: issueRef(issue), reason: 'not factory-e2e scope' });
                         continue;
                     }
                     if (!isDispatchableIssue(issue)) {
-                        skipped.push({ issue: issueRef(issue), reason: 'not reconciled real Linear issue' });
+                        recordSkip({ issue: issueRef(issue), reason: 'not reconciled real Linear issue' });
                         continue;
                     }
                     const decision = await this.triageIssue(issue);
@@ -1579,7 +2028,7 @@ export class FactoryLoop {
                     catch (error) {
                         if (!(error instanceof LiveDispatchStateChangedError))
                             throw error;
-                        skipped.push({ issue: decision.issue, reason: 'live state changed during dispatch' });
+                        recordSkip({ issue: decision.issue, reason: 'live state changed during dispatch' });
                         this.#logger.info?.('[factory] skipped issue whose live state changed during dispatch', {
                             issue: decision.issue.key,
                         });
@@ -1591,7 +2040,7 @@ export class FactoryLoop {
                             : result.hold?.kind === 'dependency'
                                 ? `parked on dependencies: ${result.hold.blockers?.join(', ') ?? 'unresolved dependency'}`
                                 : 'queued or escalated';
-                        skipped.push({ issue: decision.issue, reason });
+                        recordSkip({ issue: decision.issue, reason });
                     }
                     else {
                         dispatched.push(result);
@@ -1630,6 +2079,215 @@ export class FactoryLoop {
             }
         }
     }
+    #startDiscoverySweepRenewal(epoch) {
+        let renewalInFlight = false;
+        this.#discoverySweepRenewTimer = setInterval(() => {
+            if (renewalInFlight || this.#discoverySweepLeaseLost)
+                return;
+            renewalInFlight = true;
+            void this.#state.renewDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, epoch, this.#clock.now(), DISCOVERY_SWEEP_LEASE_MS).then((renewed) => {
+                if (!renewed && this.#discoverySweepEpoch === epoch) {
+                    this.#discoverySweepLeaseLost = true;
+                    this.#increment('discoverySweepLeaseLosses');
+                    this.#logger.warn?.('[factory] discovery sweep lease renewal was rejected; fencing further tree requests');
+                }
+            }).catch((error) => {
+                this.#logger.warn?.('[factory] discovery sweep lease renewal failed; retaining the current lease window', {
+                    error: describeError(error).errorMessage,
+                });
+            }).finally(() => {
+                renewalInFlight = false;
+            });
+        }, DISCOVERY_SWEEP_RENEW_MS);
+        this.#discoverySweepRenewTimer.unref?.();
+    }
+    async #prepareDiscoverySession(claim) {
+        const checkpoint = structuredClone(claim.state.checkpoint ?? {
+            trees: {},
+            updatedAtMs: 0,
+        });
+        const watermark = await this.#discoveryHighWatermark();
+        if (!watermark.available) {
+            this.#increment('discoveryIncrementalUnavailable');
+            return {
+                checkpoint,
+                mode: 'full',
+                highWatermarkAvailable: false,
+                listedPrefixes: new Set(),
+            };
+        }
+        if (claim.state.checkpoint) {
+            if (watermark.highWatermark === checkpoint.highWatermark) {
+                this.#increment('discoveryIncrementalUnchangedSweeps');
+                this.#logger.info?.('[factory] discovery checkpoint unchanged; reusing cached issue trees', {
+                    highWatermark: watermark.highWatermark,
+                    cachedPrefixes: Object.keys(checkpoint.trees).length,
+                });
+                return {
+                    checkpoint,
+                    mode: 'incremental',
+                    highWatermarkAvailable: true,
+                    observedHighWatermark: watermark.highWatermark,
+                    listedPrefixes: new Set(),
+                };
+            }
+            const changes = await this.#discoveryEventsSince(checkpoint.highWatermark, watermark.highWatermark);
+            if (changes) {
+                this.#applyDiscoveryEvents(checkpoint, changes);
+                this.#increment('discoveryIncrementalChangedSweeps');
+                this.#logger.info?.('[factory] updated discovery checkpoint from Relayfile changes', {
+                    previousHighWatermark: checkpoint.highWatermark,
+                    highWatermark: watermark.highWatermark,
+                    changes: changes.length,
+                    cachedPrefixes: Object.keys(checkpoint.trees).length,
+                });
+                return {
+                    checkpoint,
+                    mode: 'incremental',
+                    highWatermarkAvailable: true,
+                    observedHighWatermark: watermark.highWatermark,
+                    listedPrefixes: new Set(),
+                };
+            }
+            this.#increment('discoveryIncrementalGapFallbacks');
+            this.#logger.warn?.('[factory] discovery change window did not cover the prior checkpoint; refreshing tree prefixes once', {
+                previousHighWatermark: checkpoint.highWatermark,
+                highWatermark: watermark.highWatermark,
+            });
+        }
+        // A missing change window means no retained prefix can be trusted. Start
+        // the fallback snapshot empty so prefixes not touched by the current
+        // configuration cannot resurface later with stale membership.
+        checkpoint.trees = {};
+        return {
+            checkpoint,
+            mode: 'full',
+            highWatermarkAvailable: true,
+            observedHighWatermark: watermark.highWatermark,
+            listedPrefixes: new Set(),
+        };
+    }
+    async #finalizeDiscoveryCheckpoint() {
+        const session = this.#discoverySession;
+        if (!session?.highWatermarkAvailable)
+            return undefined;
+        const watermark = await this.#discoveryHighWatermark();
+        if (!watermark.available)
+            return undefined;
+        if (watermark.highWatermark !== session.observedHighWatermark) {
+            const changes = await this.#discoveryEventsSince(session.observedHighWatermark, watermark.highWatermark);
+            if (!changes) {
+                this.#increment('discoveryCheckpointCommitGaps');
+                this.#logger.warn?.('[factory] discovery checkpoint not saved because its change window overflowed during the sweep');
+                return undefined;
+            }
+            this.#applyDiscoveryEvents(session.checkpoint, changes);
+        }
+        session.checkpoint.highWatermark = watermark.highWatermark;
+        session.checkpoint.updatedAtMs = this.#clock.now();
+        for (const [prefix, paths] of Object.entries(session.checkpoint.trees)) {
+            session.checkpoint.trees[prefix] = [...new Set(paths)].sort();
+        }
+        return structuredClone(session.checkpoint);
+    }
+    async #discoveryHighWatermark() {
+        if (!this.#mount.getEventHighWatermark)
+            return { available: false };
+        try {
+            const highWatermark = await this.#mount.getEventHighWatermark();
+            // `undefined` also means that an older Relayfile client cannot expose a
+            // watermark. Treat it as unavailable so a compatibility fallback never
+            // turns into an indefinitely stale cache.
+            return highWatermark === undefined
+                ? { available: false }
+                : { available: true, highWatermark };
+        }
+        catch (error) {
+            if (relayfileOverload(error))
+                throw error;
+            this.#increment('discoveryHighWatermarkFailures');
+            this.#logger.warn?.('[factory] discovery high-watermark unavailable; using a full sweep without caching', {
+                error: describeError(error).errorMessage,
+            });
+            return { available: false };
+        }
+    }
+    async #discoveryEventsSince(previousHighWatermark, currentHighWatermark) {
+        if (previousHighWatermark === currentHighWatermark)
+            return [];
+        if (!currentHighWatermark)
+            return undefined;
+        let events;
+        try {
+            const page = await this.#mount.getEvents({
+                last: DISCOVERY_CHANGE_EVENT_LIMIT,
+                limit: DISCOVERY_CHANGE_EVENT_LIMIT,
+            });
+            events = [...page.events].sort(compareDiscoveryEvents);
+        }
+        catch (error) {
+            if (relayfileOverload(error))
+                throw error;
+            this.#logger.warn?.('[factory] discovery change feed unavailable; refreshing tree prefixes once', {
+                error: describeError(error).errorMessage,
+            });
+            return undefined;
+        }
+        const currentIndex = events.findIndex((event) => discoveryEventId(event) === currentHighWatermark);
+        if (currentIndex < 0)
+            return undefined;
+        if (previousHighWatermark === undefined) {
+            return events.length < DISCOVERY_CHANGE_EVENT_LIMIT
+                ? events.slice(0, currentIndex + 1)
+                : undefined;
+        }
+        const previousIndex = events.findIndex((event) => discoveryEventId(event) === previousHighWatermark);
+        if (previousIndex >= 0 && previousIndex <= currentIndex) {
+            return events.slice(previousIndex + 1, currentIndex + 1);
+        }
+        const previousSequence = eventSequenceNumber(previousHighWatermark);
+        const currentSequence = eventSequenceNumber(currentHighWatermark);
+        const sequenced = events.map((event) => ({ event, sequence: eventSequenceNumber(discoveryEventId(event) ?? '') }));
+        if (previousSequence !== undefined &&
+            currentSequence !== undefined &&
+            sequenced.every((entry) => entry.sequence !== undefined) &&
+            sequenced.some((entry) => entry.sequence <= previousSequence)) {
+            return sequenced
+                .filter((entry) => entry.sequence > previousSequence && entry.sequence <= currentSequence)
+                .map((entry) => entry.event);
+        }
+        return undefined;
+    }
+    #applyDiscoveryEvents(checkpoint, events) {
+        for (const event of events) {
+            const path = changeEventPath(event);
+            if (!path)
+                continue;
+            const deletion = discoveryEventIsDeletion(event);
+            const indexRepoRoots = githubIssueIndexRepoRoots(path);
+            for (const [prefix, cachedPaths] of Object.entries(checkpoint.trees)) {
+                if (indexRepoRoots.some((root) => prefix === root || prefix.startsWith(`${root}/`))) {
+                    delete checkpoint.trees[prefix];
+                    continue;
+                }
+                // A plain startsWith would let `/…/issues-archive/…` match the
+                // cached prefix `/…/issues`, folding an unrelated path into it.
+                if (path !== prefix && !path.startsWith(prefix.endsWith('/') ? prefix : `${prefix}/`))
+                    continue;
+                const paths = new Set(cachedPaths);
+                if (deletion) {
+                    for (const candidate of paths) {
+                        if (candidate === path || candidate.startsWith(`${path}/`))
+                            paths.delete(candidate);
+                    }
+                }
+                else {
+                    paths.add(path);
+                }
+                checkpoint.trees[prefix] = [...paths];
+            }
+        }
+    }
     async #githubOrphanRecoveryContext() {
         try {
             const [registry, roster, lifecycles, waitingClarifications] = await Promise.all([
@@ -1641,18 +2299,42 @@ export class FactoryLoop {
             const onlineAgents = new Set(roster.agents.map((agent) => agent.name));
             const activeIssueIdentities = new Set();
             const legacyUnownedAgentsByIssue = new Map();
-            for (const [, lifecycle] of lifecycles) {
-                if (isTerminalDispatchLifecycle(lifecycle))
-                    continue;
-                const identity = githubIssueRefIdentity(lifecycle.issue);
-                if (identity)
-                    activeIssueIdentities.add(identity);
-            }
+            const orphanedLifecycleClaimsByIssue = new Map();
             for (const [, waiting] of waitingClarifications) {
                 const identity = githubIssueRefIdentity(waiting.issue);
                 if (identity)
                     activeIssueIdentities.add(identity);
             }
+            for (const [key, lifecycle] of lifecycles) {
+                const identity = githubIssueRefIdentity(lifecycle.issue);
+                if (!identity)
+                    continue;
+                if (isTerminalDispatchLifecycle(lifecycle)) {
+                    if (!activeIssueIdentities.has(identity)) {
+                        orphanedLifecycleClaimsByIssue.set(identity, { key, lifecycle });
+                    }
+                    continue;
+                }
+                const activeAgents = lifecycle.agents.filter((agent) => agent.releasedAtMs === undefined);
+                const hasLiveAgent = activeAgents.some((agent) => onlineAgents.has(agent.name));
+                const exitRecoveryActive = activeAgents.some((agent) => this.#agentExitsInFlight.has(agent.name));
+                const dispatchCallActive = this.#dispatchInFlight.has(issueKey(lifecycle.issue));
+                // The provider's `factory:in-progress` transition happens immediately
+                // before the durable lifecycle advances from dispatching to running.
+                // A crash can therefore leave any nonterminal phase behind while the
+                // external claim survives. The caller still verifies provider status,
+                // open-PR absence, a second roster, and the lifecycle lease before it
+                // releases this orphan-shaped row.
+                if (!activeIssueIdentities.has(identity) &&
+                    !hasLiveAgent &&
+                    !exitRecoveryActive &&
+                    !dispatchCallActive) {
+                    orphanedLifecycleClaimsByIssue.set(identity, { key, lifecycle });
+                }
+                else {
+                    activeIssueIdentities.add(identity);
+                }
+            }
             for (const agent of registry?.agents ?? []) {
                 if (!onlineAgents.has(agent.name) || !agent.issue)
                     continue;
@@ -1677,6 +2359,7 @@ export class FactoryLoop {
                 activeIssueIdentities,
                 onlineAgentNames: onlineAgents,
                 legacyUnownedAgentsByIssue,
+                orphanedLifecycleClaimsByIssue,
             };
         }
         catch (error) {
@@ -1688,15 +2371,19 @@ export class FactoryLoop {
         }
     }
     async #reconcileOrphanedGithubInProgress(issue, context, dryRun) {
-        if (dryRun || !context || !isGithubIssue(issue))
-            return false;
+        if (dryRun)
+            return { recovered: false, reason: 'dry run does not release an in-progress claim' };
+        if (!context)
+            return { recovered: false, reason: 'orphan-recovery safety context is unavailable' };
+        if (!isGithubIssue(issue))
+            return { recovered: false, reason: 'issue is not GitHub-native' };
         const labels = new Set(issue.labels.map((label) => label.trim().toLowerCase()));
         const required = this.#config.safety.requireLabel.trim().toLowerCase();
         if (!required ||
             !labels.has(required) ||
             !labels.has('factory:in-progress') ||
             labels.has('factory:human-review'))
-            return false;
+            return { recovered: false, reason: 'issue is not an orphan-recovery candidate' };
         const identity = githubIssueRefIdentity(issueRef(issue));
         const legacyUnownedAgents = identity
             ? (context.legacyUnownedAgentsByIssue.get(identity) ?? [])
@@ -1707,12 +2394,12 @@ export class FactoryLoop {
             context.activeIssueIdentities.has(identity) ||
             [...context.onlineAgentNames].some((name) => githubAgentNameMatchesIssue(name, issue) && !legacyUnownedAgentNames.has(name))) {
             this.#increment('githubOrphanRecoveriesBlockedActive');
-            return false;
+            return { recovered: false, reason: 'active dispatch claim or live agent still owns the issue' };
         }
         const getProviderStatus = this.#githubWriteback.getIssueStatus;
         if (!getProviderStatus) {
             this.#increment('githubOrphanRecoveryStatusLookupUnavailable');
-            return false;
+            return { recovered: false, reason: 'provider-authoritative issue status lookup is unavailable' };
         }
         let providerStatus;
         try {
@@ -1724,11 +2411,16 @@ export class FactoryLoop {
                 issue: issue.key,
                 error: describeError(error).errorMessage,
             });
-            return false;
+            return { recovered: false, reason: 'provider-authoritative issue status could not be verified' };
         }
         if (!providerStatus || providerStatus === 'human-review') {
             this.#increment('githubOrphanRecoveriesBlockedProviderStatus');
-            return false;
+            return {
+                recovered: false,
+                reason: providerStatus === 'human-review'
+                    ? 'provider-authoritative issue status is human-review'
+                    : 'provider-authoritative issue status is unavailable',
+            };
         }
         let openPr;
         try {
@@ -1740,7 +2432,7 @@ export class FactoryLoop {
                 issue: issue.key,
                 error: describeError(error).errorMessage,
             });
-            return false;
+            return { recovered: false, reason: 'matching open-PR absence could not be verified' };
         }
         if (openPr) {
             let adopted = false;
@@ -1764,7 +2456,12 @@ export class FactoryLoop {
                 repo: openPr.repo,
                 prNumber: openPr.prNumber,
             });
-            return false;
+            return {
+                recovered: false,
+                reason: adopted
+                    ? 'matching open PR was adopted'
+                    : 'matching open PR still owns the issue',
+            };
         }
         // A pre-durable local Factory may have left live, registry-proven workers
         // without a lifecycle record. They are safe to adopt only once their open
@@ -1772,7 +2469,11 @@ export class FactoryLoop {
         // and workers instead of redispatching duplicate agents.
         if (legacyUnownedAgents.length > 0) {
             this.#increment('githubOrphanRecoveriesBlockedActive');
-            return false;
+            return { recovered: false, reason: 'legacy registry-proven agents still own the issue' };
+        }
+        const lifecycleClaim = context.orphanedLifecycleClaimsByIssue.get(identity);
+        if (lifecycleClaim && !await this.#releaseOrphanedGithubLifecycle(issue, identity, lifecycleClaim)) {
+            return { recovered: false, reason: 'orphaned durable lifecycle claim could not be safely released' };
         }
         try {
             if (providerStatus === 'in-progress') {
@@ -1781,14 +2482,25 @@ export class FactoryLoop {
             // A crashed dispatch may leave its durable attempt marked in-flight even
             // after every agent and lifecycle disappeared. Only clear that stale bit
             // after all provider, agent, lifecycle, and open-PR safety checks pass.
-            await this.#clearDispatchInFlight(issue);
+            const attempt = await this.#state.getDispatchAttempts(this.#workspaceId, issueStateKey(issue));
+            if (attempt?.terminal) {
+                await this.#state.recordDispatchAttempt(this.#workspaceId, issueStateKey(issue), {
+                    attempts: 0,
+                    inFlight: false,
+                    terminal: false,
+                    backoffUntilMs: 0,
+                });
+            }
+            else {
+                await this.#clearDispatchInFlight(issue);
+            }
             this.#reconciledGithubInProgress.add(identity);
             this.#increment('githubOrphanedInProgressRecovered');
             this.#logger.warn?.('[factory] recovered orphaned GitHub in-progress issue for redispatch', {
                 issue: issue.key,
                 path: issue.path,
             });
-            return true;
+            return { recovered: true };
         }
         catch (error) {
             this.#increment('githubOrphanRecoveryWritebackFailures');
@@ -1796,6 +2508,116 @@ export class FactoryLoop {
                 issue: issue.key,
                 error: describeError(error).errorMessage,
             });
+            return { recovered: false, reason: 'orphaned provider lifecycle status could not be cleared' };
+        }
+    }
+    async #releaseOrphanedGithubLifecycle(issue, identity, candidate) {
+        let key = candidate.key;
+        let lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
+        if (!lifecycle)
+            return true;
+        if (lifecycle.runId !== candidate.lifecycle.runId ||
+            githubIssueRefIdentity(lifecycle.issue) !== identity) {
+            this.#logger.info?.('[factory] preserved orphan-shaped GitHub claim because its durable lifecycle changed', {
+                issue: issue.key,
+                lifecycleKey: key,
+            });
+            return false;
+        }
+        const activeAgents = lifecycle.agents.filter((agent) => agent.releasedAtMs === undefined);
+        const roster = await this.#fleet.roster();
+        const online = new Set(roster.agents.map((agent) => agent.name));
+        if (activeAgents.some((agent) => online.has(agent.name)) ||
+            roster.agents.some((agent) => githubAgentNameMatchesIssue(agent.name, issue))) {
+            this.#increment('githubOrphanRecoveriesBlockedActive');
+            return false;
+        }
+        let epoch;
+        if (!isTerminalDispatchLifecycle(lifecycle)) {
+            epoch = this.#dispatchLifecycleEpochs.get(key);
+            if (epoch !== undefined) {
+                const renewed = await this.#state.renewDispatchLifecycle(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch, this.#clock.now(), DISPATCH_LIFECYCLE_LEASE_MS);
+                if (!renewed) {
+                    this.#dispatchLifecycleEpochs.delete(key);
+                    return false;
+                }
+            }
+            else {
+                const claim = await this.#state.claimDispatchLifecycle(this.#workspaceId, key, lifecycle, this.#dispatchLifecycleOwner, this.#clock.now(), DISPATCH_LIFECYCLE_LEASE_MS);
+                if (!claim.acquired || !claim.lease) {
+                    this.#logger.info?.('[factory] preserved orphan-shaped GitHub claim because another publisher still owns its lease', {
+                        issue: issue.key,
+                        owner: claim.lifecycle.lease?.owner,
+                        leaseUntilMs: claim.lifecycle.lease?.leaseUntilMs,
+                    });
+                    return false;
+                }
+                key = claim.key ?? key;
+                lifecycle = claim.lifecycle;
+                epoch = claim.lease.epoch;
+                this.#dispatchLifecycleEpochs.set(key, epoch);
+            }
+        }
+        try {
+            for (const agent of lifecycle.agents.filter((entry) => entry.releasedAtMs === undefined)) {
+                try {
+                    await this.#fleet.release(agent.name, 'orphaned-claim');
+                }
+                catch (error) {
+                    // The roster was checked twice before fencing this lifecycle, so a
+                    // missing/dead worker is the expected crash-recovery shape. Do not
+                    // let a control-plane "agent not found" response make the durable
+                    // claim immortal; a failed fresh spawn remains visible to the normal
+                    // dispatch retry machinery.
+                    this.#increment('githubOrphanedLifecycleAgentReleaseFailures');
+                    this.#logger.warn?.('[factory] dead claim agent release failed; clearing fenced lifecycle anyway', {
+                        issue: issue.key,
+                        agent: agent.name,
+                        error: describeError(error).errorMessage,
+                    });
+                }
+                this.#fleet.markAgentTerminal?.(agent.name, 'orphaned-claim');
+            }
+            if (epoch !== undefined && !await this.#state.renewDispatchLifecycle(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch, this.#clock.now(), DISPATCH_LIFECYCLE_LEASE_MS)) {
+                this.#dispatchLifecycleEpochs.delete(key);
+                return false;
+            }
+            const retryTimer = this.#dispatchLifecycleRetryTimers.get(key);
+            if (retryTimer)
+                clearTimeout(retryTimer);
+            this.#dispatchLifecycleRetryTimers.delete(key);
+            const batch = await this.#batch();
+            batch.abandon(lifecycle.issue);
+            await this.#state.clearDispatchLifecycle(this.#workspaceId, key);
+            await this.#state.clearBabysitterSession(this.#workspaceId, issueKey(lifecycle.issue));
+            this.#dispatchLifecycleEpochs.delete(key);
+            this.#abandonedDispatchReasons.delete(key);
+            this.#resolveDispatchTerminalWaiters(lifecycle.issue);
+            await this.#writeInFlightRegistry().catch((error) => {
+                this.#logger.warn?.('[factory] failed to rewrite registry after orphaned claim release', {
+                    issue: issue.key,
+                    error: describeError(error).errorMessage,
+                });
+            });
+            this.#increment('githubOrphanedLifecycleClaimsReleased');
+            this.#logger.warn?.('[factory] released orphaned GitHub dispatch claim with no live agents', {
+                issue: issue.key,
+                lifecycleKey: key,
+                runId: lifecycle.runId,
+                agents: activeAgents.map((agent) => agent.name),
+            });
+            return true;
+        }
+        catch (error) {
+            if (epoch !== undefined) {
+                await this.#state.releaseDispatchLifecycleLease(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch).catch(() => undefined);
+                this.#dispatchLifecycleEpochs.delete(key);
+            }
+            this.#logger.warn?.('[factory] failed to release orphaned GitHub dispatch claim; preserving it', {
+                issue: issue.key,
+                lifecycleKey: key,
+                error: describeError(error).errorMessage,
+            });
             return false;
         }
     }
@@ -1954,13 +2776,60 @@ export class FactoryLoop {
         this.#increment('githubOrphanedPullRequestsAdopted');
         return true;
     }
-    async #listRelayfileTree(prefix, phase) {
-        return this.#withRelayfileOperation('listTree', { phase, prefix }, () => this.#mount.listTree(prefix), {
+    // `cache` is opt-in and must stay limited to call sites that walk a full
+    // repository/issue root to enumerate everything under it — the sweep this
+    // whole feature exists to make incremental. A cached listing can lag the
+    // live tree by up to one sweep, which is fine for enumeration but wrong
+    // for a point lookup that needs the current state: a PR-confirmation poll
+    // that expects a specific PR to appear, or an escalation/comment-replay
+    // scan that must not miss a marker or reply that landed after the cache
+    // was populated. Those callers must omit `cache` and pay for a fresh list.
+    async #listRelayfileTree(prefix, phase, opts = {}) {
+        if (this.#discoverySweepLeaseLost) {
+            throw new Error('discovery sweep lease was lost; refusing another tree request');
+        }
+        const cached = opts.cache ? this.#cachedDiscoveryTree(prefix) : undefined;
+        if (cached) {
+            this.#increment('discoveryTreeCacheHits');
+            this.#logger.debug?.('[factory] reused cached Relayfile tree', { phase, prefix, count: cached.length });
+            return cached;
+        }
+        if (opts.cache)
+            this.#increment('discoveryTreeCacheMisses');
+        const paths = await this.#withRelayfileOperation('listTree', { phase, prefix }, () => this.#mount.listTree(prefix), {
             count: (paths) => paths.length,
             logFailure: true,
             logStart: true,
             logComplete: true,
         });
+        if (opts.cache)
+            await this.#rememberDiscoveryTree(prefix, paths);
+        return paths;
+    }
+    #cachedDiscoveryTree(prefix) {
+        const session = this.#discoverySession;
+        if (!session)
+            return undefined;
+        if (session.mode === 'full' && !session.listedPrefixes.has(prefix))
+            return undefined;
+        const paths = session.checkpoint.trees[prefix];
+        return paths ? [...paths] : undefined;
+    }
+    async #rememberDiscoveryTree(prefix, paths) {
+        const session = this.#discoverySession;
+        if (!session)
+            return;
+        const uniquePaths = new Set();
+        for (let index = 0; index < paths.length; index += 1) {
+            uniquePaths.add(paths[index]);
+            if ((index + 1) % LIVE_EVENT_DRAIN_BATCH_SIZE === 0) {
+                await this.#refreshLiveHeartbeatIfDue();
+                if (index + 1 < paths.length)
+                    await liveEventYield();
+            }
+        }
+        session.checkpoint.trees[prefix] = [...uniquePaths].sort();
+        session.listedPrefixes.add(prefix);
     }
     async #ensureRelayfileSubRoot(prefix, phase, opts) {
         return this.#withRelayfileOperation('ensureSubRoot', { phase, prefix }, () => this.#mount.ensureSubRoot(prefix, opts), {
@@ -2013,6 +2882,9 @@ export class FactoryLoop {
             return result;
         }
         catch (error) {
+            if (relayfileOverload(error) && this.#discoverySweepEpoch !== undefined) {
+                this.#discoveryOverloadError ??= error;
+            }
             if (opts.logFailure || waitWarnings > 0) {
                 this.#increment('relayfileOperationFailures');
                 this.#logger.warn?.('[factory] relayfile operation failed', {
@@ -2235,7 +3107,10 @@ export class FactoryLoop {
         // ones. Without it, every worker starts in the configured shared checkout
         // and concurrent issues can switch each other back to the base branch.
         const isolateLocalWorktree = this.#fleet.placementLocality === 'local' && Boolean(this.#worktrees);
-        const lifecycleRunId = !dryRun && (durableDispatch || isolateLocalWorktree) ? randomUUID() : undefined;
+        // Every live dispatch gets an issue-owned branch, including legacy local
+        // fleets without a durable lifecycle or worktree manager. The publication
+        // boundary uses this exact ref to reject a stale shared checkout.
+        const lifecycleRunId = !dryRun ? randomUUID() : undefined;
         if (lifecycleRunId) {
             dispatchDecision = decisionWithLifecycleBranches(dispatchDecision, lifecycleRunId, {
                 isolateLocalWorktree,
@@ -2370,6 +3245,13 @@ export class FactoryLoop {
                 }
                 agents.push({ name: spawned.name, role: spec.role });
             }
+            if (!dryRun) {
+                record.dispatchClaim = {
+                    state: 'pending',
+                    updatedAtMs: this.#clock.now(),
+                };
+                this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+            }
             await this.#writeInFlightRegistry();
             const comment = dispatchComment(dispatchDecision, agents);
             let implementingStateId;
@@ -2378,19 +3260,7 @@ export class FactoryLoop {
                 if (!issue || !this.#isIssueReady(issue)) {
                     throw new LiveDispatchStateChangedError(dispatchDecision.issue.key);
                 }
-                try {
-                    await this.#postIssueComment(issue, comment);
-                }
-                catch (error) {
-                    this.#logger.warn?.('[factory] comment writeback skipped', error);
-                }
-                if (isGithubIssue(issue)) {
-                    await this.#githubWriteback.setStatus(issue, 'in-progress');
-                }
-                else {
-                    implementingStateId = this.#states.idFor(issue.team, 'agentImplementing');
-                    await this.#linear.setState(issue, implementingStateId);
-                }
+                implementingStateId = await this.#applyDispatchClaim(record, issue, comment);
                 this.#emit('writeback-verified', { issue: dispatchDecision.issue, path: issue.path });
             }
             const result = {
@@ -2404,9 +3274,13 @@ export class FactoryLoop {
                 dryRun,
             };
             record.result = result;
-            await this.#saveDispatchLifecycle(record, 'running');
+            if (!await this.#saveDispatchLifecycle(record, 'running'))
+                return result;
             this.#increment('dispatched');
             this.#emit('dispatched', { issue: dispatchDecision.issue, result });
+            if (!dryRun && this.#config.hooks?.onTicketDispatch) {
+                await this.#notifyTicketDispatch(dispatchDecision, liveIssue, record, result);
+            }
             if (!dryRun) {
                 await this.#ensureSlackDispatchThread(record, result);
             }
@@ -2501,8 +3375,27 @@ export class FactoryLoop {
     }
     status() {
         const batch = this.#batchView;
+        const inFlightDispatches = batch?.inFlight
+            .filter((record) => !record.dryRun)
+            .map((record) => ({
+            issue: { ...record.issue },
+            agents: [...record.agents].map(([name, tracked]) => ({
+                name,
+                role: tracked.spec.role,
+                ...(tracked.sessionRef ? { sessionRef: tracked.sessionRef } : {}),
+                ...(tracked.spec.invocationId ? { invocationId: tracked.spec.invocationId } : {}),
+                ...(tracked.result?.node ? { node: tracked.result.node } : {}),
+            })),
+            claim: {
+                ...(record.dispatchClaim ?? this.#dispatchClaimStatuses.get(issueKey(record.issue)) ?? {
+                    state: 'pending',
+                    updatedAtMs: this.#clock.now(),
+                }),
+            },
+        })) ?? [];
         return {
             inFlight: batch?.inFlight.map((record) => record.issue) ?? [],
+            ...(inFlightDispatches.length > 0 ? { inFlightDispatches } : {}),
             queued: batch?.queued.map((queued) => queued.issue) ?? [],
             parked: batch?.parked.map((parked) => ({
                 issue: parked.issue,
@@ -2653,10 +3546,11 @@ export class FactoryLoop {
                 if (claim.lifecycle.phase === 'waiting-for-human')
                     continue;
                 const durableRecord = inFlightRecordFromLifecycle(claim.lifecycle);
+                let liveIssue;
                 if (!durableRecord.dryRun &&
                     claim.lifecycle.phase !== 'writeback-applied' &&
                     claim.lifecycle.phase !== 'releasing') {
-                    const liveIssue = await this.#readIssue(durableRecord.issue.path);
+                    liveIssue = await this.#readIssue(durableRecord.issue.path);
                     // A babysat Linear issue already at Done may have merged while this
                     // process was down. Let authoritative PR restoration drive the
                     // normal `complete` path so merged work is not mislabeled abandoned.
@@ -2683,6 +3577,18 @@ export class FactoryLoop {
                 const restored = claim.lifecycle.phase === 'queued' || claim.lifecycle.phase === 'releasing'
                     ? durableRecord
                     : batch.restore(durableRecord);
+                if (claim.lifecycle.phase === 'running' &&
+                    this.#ticketDispatchNotificationIsPending(claim.lifecycle)) {
+                    if (!liveIssue) {
+                        this.#dispatchLifecycleEpochs.delete(claim.key ?? key);
+                        this.#scheduleDispatchLifecycleRetry(restored);
+                        throw new Error(`Unable to recover ticket-dispatch notification ${restored.issue.key}: issue is not currently readable`);
+                    }
+                    if (!restored.result) {
+                        throw new Error(`Unable to recover ticket-dispatch notification ${restored.issue.key}: dispatch result is missing`);
+                    }
+                    await this.#notifyTicketDispatch(restored.decision, liveIssue, restored, restored.result);
+                }
                 if (claim.lifecycle.phase !== 'running')
                     this.#scheduleDispatchLifecycleRetry(restored);
                 // Parking agents are cleanup-only. Hydrating them makes relay
@@ -3277,6 +4183,9 @@ export class FactoryLoop {
                 ? this.#finalizeRunCost(record, lifecycleRunId)
                 : previous?.cost;
             const lifecycle = lifecycleFromInFlightRecord(record, lifecycleRunId, phase, this.#clock.now(), primaryPullRequest, pullRequests, releaseReason ?? previous?.releaseReason, cost);
+            if (previous?.ticketDispatchNotification) {
+                lifecycle.ticketDispatchNotification = structuredClone(previous.ticketDispatchNotification);
+            }
             for (const agent of lifecycle.agents) {
                 const previousAgent = previous?.agents.find((candidate) => candidate.name === agent.name);
                 if (previousAgent?.releasedAtMs !== undefined)
@@ -3473,6 +4382,15 @@ export class FactoryLoop {
                 await this.#abandonDurableResume(record, 'source issue became terminal before lifecycle cleanup');
                 return;
             }
+            if (this.#ticketDispatchNotificationIsPending(lifecycle)) {
+                if (!liveIssue) {
+                    throw new Error(`Unable to recover ticket-dispatch notification ${record.issue.key}: issue is not currently readable`);
+                }
+                if (!record.result) {
+                    throw new Error(`Unable to recover ticket-dispatch notification ${record.issue.key}: dispatch result is missing`);
+                }
+                await this.#notifyTicketDispatch(record.decision, liveIssue, record, record.result);
+            }
         }
         if (acquiredNow && lifecycle.phase === 'running') {
             const activeAgents = lifecycle.agents.filter((agent) => agent.releasedAtMs === undefined);
@@ -3649,18 +4567,22 @@ export class FactoryLoop {
             const spawned = await this.#spawnAgent(record, spec, record.dryRun);
             agents.push({ name: spawned.name, role: spec.role });
         }
+        const comment = dispatchComment(record.decision, agents);
+        let implementingStateId;
+        if (!record.dryRun) {
+            record.dispatchClaim = {
+                state: 'pending',
+                updatedAtMs: this.#clock.now(),
+            };
+            this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+        }
         await this.#writeInFlightRegistry();
         if (!record.dryRun) {
             const issue = liveIssue ?? await this.#readIssue(record.issue.path);
             if (!issue)
                 throw new Error(`Unable to recover durable dispatch ${record.issue.key}: issue is no longer readable`);
             await this.#ensureGithubAgentQuestionWatch(record, issue);
-            if (isGithubIssue(issue)) {
-                await this.#githubWriteback.setStatus(issue, 'in-progress');
-            }
-            else {
-                await this.#linear.setState(issue, this.#states.idFor(issue.team, 'agentImplementing'));
-            }
+            implementingStateId = await this.#applyDispatchClaim(record, issue, comment);
         }
         const recoveredPreviews = uniquePreviewReferences([
             ...dispatchSpecs(record.decision).map((spec) => spec.preview),
@@ -3669,7 +4591,8 @@ export class FactoryLoop {
         record.result ??= {
             issue: record.issue,
             agents,
-            comments: [dispatchComment(record.decision, agents)],
+            comments: [comment],
+            stateId: implementingStateId,
             ...(recoveredPreviews.length > 0 ? { previews: recoveredPreviews } : {}),
             dryRun: record.dryRun,
         };
@@ -3678,7 +4601,8 @@ export class FactoryLoop {
         }
         if (!await this.#saveDispatchLifecycle(record, 'running'))
             return;
-        if (!record.dryRun) {
+        if (liveIssue) {
+            await this.#notifyTicketDispatch(record.decision, liveIssue, record, record.result);
             await this.#ensureSlackDispatchThread(record, record.result);
             for (const tracked of record.agents.values()) {
                 const owned = tracked.spec.ownedPullRequest;
@@ -3967,6 +4891,97 @@ export class FactoryLoop {
         }
         await this.#linear.postComment(issue, body);
     }
+    async #applyDispatchClaim(record, issue, comment) {
+        let implementingStateId;
+        if (isGithubIssue(issue)) {
+            await this.#retryDispatchWriteback(record, issue, 'GitHub label factory:in-progress', async () => {
+                await this.#githubWriteback.setStatus(issue, 'in-progress');
+            });
+            const commentApplied = this.#githubWriteback.hasCommentMarker
+                ? async () => this.#githubWriteback.hasCommentMarker(issue, comment)
+                : undefined;
+            await this.#retryDispatchWriteback(record, issue, 'GitHub dispatch comment', async () => this.#githubWriteback.postComment(issue, comment), commentApplied);
+        }
+        else {
+            implementingStateId = this.#states.idFor(issue.team, 'agentImplementing');
+            await this.#retryDispatchWriteback(record, issue, `Linear state ${implementingStateId}`, async () => {
+                await this.#linear.setState(issue, implementingStateId);
+            });
+            await this.#retryDispatchWriteback(record, issue, 'Linear dispatch comment', async () => {
+                await this.#linear.postComment(issue, comment);
+            });
+        }
+        record.dispatchClaim = {
+            state: 'verified',
+            updatedAtMs: this.#clock.now(),
+        };
+        this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+        await this.#writeDispatchClaimRegistry(record.issue);
+        return implementingStateId;
+    }
+    async #retryDispatchWriteback(record, issue, write, apply, isApplied) {
+        let lastError;
+        for (let attempt = 1; attempt <= DISPATCH_WRITEBACK_MAX_ATTEMPTS; attempt += 1) {
+            try {
+                if (isApplied && await isApplied())
+                    return;
+                await apply();
+                if (isApplied && !await isApplied()) {
+                    throw new Error(`${write} returned without a provider read-back acknowledgement`);
+                }
+                return;
+            }
+            catch (error) {
+                lastError = error;
+                const deadLettered = attempt === DISPATCH_WRITEBACK_MAX_ATTEMPTS;
+                this.#increment('dispatchWritebackFailures');
+                record.dispatchClaim = {
+                    state: 'degraded',
+                    write,
+                    attempts: attempt,
+                    maxAttempts: DISPATCH_WRITEBACK_MAX_ATTEMPTS,
+                    error: describeError(error).errorMessage,
+                    ...(deadLettered ? { deadLettered: true } : {}),
+                    updatedAtMs: this.#clock.now(),
+                };
+                this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+                await this.#writeDispatchClaimRegistry(record.issue);
+                if (deadLettered) {
+                    this.#increment('dispatchWritebackDeadLetters');
+                    this.#logger.error?.('[factory] dispatch writeback dead-lettered after retries exhausted', {
+                        issue: issue.key,
+                        write,
+                        attempts: attempt,
+                        error: describeError(error).errorMessage,
+                    });
+                    throw error;
+                }
+                this.#increment('dispatchWritebackRetries');
+                this.#logger.error?.('[factory] dispatch writeback failed; retrying', {
+                    issue: issue.key,
+                    write,
+                    attempt,
+                    maxAttempts: DISPATCH_WRITEBACK_MAX_ATTEMPTS,
+                    retryMs: DISPATCH_WRITEBACK_RETRY_MS,
+                    error: describeError(error).errorMessage,
+                });
+                await this.#clock.sleep(DISPATCH_WRITEBACK_RETRY_MS);
+            }
+        }
+        throw lastError;
+    }
+    async #writeDispatchClaimRegistry(issue) {
+        try {
+            await this.#writeInFlightRegistry();
+        }
+        catch (error) {
+            this.#increment('dispatchClaimRegistryWriteFailures');
+            this.#logger.error?.('[factory] failed to persist dispatch claim visibility', {
+                issue: issue.key,
+                error: describeError(error).errorMessage,
+            });
+        }
+    }
     // Probes the GitHub issue sub-root at most once and caches the verdict so
     // repeated iterations skip listTree calls when the mount is absent.
     async #ensureGithubIngestionReady() {
@@ -4024,7 +5039,7 @@ export class FactoryLoop {
         const candidates = [];
         let scanned = 0;
         let lastProgressAtMs = startedAtMs;
-        for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'GitHub mirror candidate loading')) {
+        for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'GitHub mirror candidate loading', { cache: true })) {
             await this.#refreshLiveHeartbeatIfDue();
             if (!isLinearIssueMirrorCandidatePath(path)) {
                 continue;
@@ -4047,18 +5062,35 @@ export class FactoryLoop {
         try {
             const issuePaths = new Map();
             for (const { owner, repo } of configuredGithubRepoParts(this.#config)) {
-                const indexedPaths = await this.#githubIssuePathsFromIndex(owner, repo);
                 const roots = githubIssueRepoRoots(owner, repo);
+                const cachedBatches = roots.map((root) => this.#cachedDiscoveryTree(root));
+                const allRootsCached = cachedBatches.every((paths) => paths !== undefined);
+                const indexedPaths = allRootsCached
+                    ? undefined
+                    : await this.#githubIssuePathsFromIndex(owner, repo);
                 // Keep the fallback roots as separate batches. Flattening a very large
                 // provider result is synchronous work and can starve the durable loop
                 // heartbeat before the bounded scan below gets a chance to yield.
-                const pathBatches = indexedPaths
-                    ? [indexedPaths]
-                    : await Promise.all(roots.map(async (root) => await this.#listRelayfileTree(root, 'GitHub issue ingestion')));
-                if (indexedPaths) {
+                let pathBatches;
+                if (allRootsCached) {
+                    pathBatches = cachedBatches;
+                    this.#increment('githubIssueDiscoveryCacheReposUsed');
+                }
+                else if (indexedPaths) {
+                    // Do not feed this into the discovery cache: the index only covers
+                    // open, labeled issues, so it is a filtered subset of the real
+                    // tree (and an empty result for whichever root form the index
+                    // doesn't use) — not something a later fresh listTree call may
+                    // treat as "the tree", including on the escalation-marker and
+                    // comment-replay call sites that share this cache.
+                    pathBatches = [indexedPaths];
                     this.#increment('githubIssueIndexReposUsed');
                 }
                 else {
+                    pathBatches = [];
+                    for (const root of roots) {
+                        pathBatches.push(await this.#listRelayfileTree(root, 'GitHub issue ingestion', { cache: true }));
+                    }
                     this.#increment('githubIssueIndexFallbacks');
                 }
                 for (const paths of pathBatches) {
@@ -4103,6 +5135,8 @@ export class FactoryLoop {
             return [...issuePaths.values()].sort();
         }
         catch (error) {
+            if (relayfileOverload(error))
+                throw error;
             this.#githubIssuePathIndexReady = false;
             this.#increment('githubIssueListFailures');
             this.#logger.warn?.('[factory] failed to list GitHub issue source tree', error);
@@ -4116,7 +5150,9 @@ export class FactoryLoop {
             const { content } = await this.#readRelayfileFile(indexPath, 'GitHub issue index discovery');
             parsed = parseJsonContent(content);
         }
-        catch {
+        catch (error) {
+            if (relayfileOverload(error))
+                throw error;
             return undefined;
         }
         if (!Array.isArray(parsed))
@@ -4203,6 +5239,8 @@ export class FactoryLoop {
             this.#increment('githubIssueMirrorsCreated');
         }
         catch (error) {
+            if (relayfileOverload(error))
+                throw error;
             this.#logger.error?.('[factory] failed to ingest GitHub issue', error);
         }
     }
@@ -4520,7 +5558,7 @@ export class FactoryLoop {
                 // The pass-scoped flag also lets every later blocked issue reuse the
                 // resulting dependency index instead of rescanning the full tree.
                 this.#dependencyLinearTreeLoaded = true;
-                for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'dependency blocker discovery')) {
+                for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'dependency blocker discovery', { cache: true })) {
                     if (isIssueFilePath(path))
                         await this.#readIssue(path);
                 }
@@ -4575,7 +5613,7 @@ export class FactoryLoop {
         const pullRequest = await resolveIssuePrFromMount(this.#mount, this.#config, issue, {
             allowLegacyGithubBranch: true,
             repo,
-        });
+        }, (prefix) => this.#listRelayfileTree(prefix, 'dependency PR probe resolution'));
         if (normalizePrState(pullRequest?.state) !== 'MERGED')
             return false;
         this.#terminalDependencyIdentities.add(identity);
@@ -4898,14 +5936,14 @@ export class FactoryLoop {
         }
         const pathsByKey = new Map();
         const canonicalPathsByKey = new Map();
-        for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'Linear ready issue canonical discovery')) {
+        for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'Linear ready issue canonical discovery', { cache: true })) {
             if (isIssueFilePath(path)) {
                 const key = keyFromPath(path);
                 canonicalPathsByKey.set(key, path);
                 pathsByKey.set(key, path);
             }
         }
-        for (const path of await this.#listRelayfileTree(linearByStatePath('ready-for-agent'), 'Linear ready issue alias discovery')) {
+        for (const path of await this.#listRelayfileTree(linearByStatePath('ready-for-agent'), 'Linear ready issue alias discovery', { cache: true })) {
             if (isIssueAliasFilePath(path)) {
                 const canonicalPath = canonicalPathsByKey.get(keyFromPath(path));
                 if (canonicalPath) {
@@ -4946,6 +5984,8 @@ export class FactoryLoop {
             return resolvedIssue;
         }
         catch (error) {
+            if (relayfileOverload(error))
+                throw error;
             if (isMissingIssueFileError(error) && isIssuePathUnderRoot(path)) {
                 this.#increment('phantomSkipped');
                 this.#logger.debug?.('[factory] skipped missing issue file discovered from issue tree', { path });
@@ -5189,6 +6229,7 @@ export class FactoryLoop {
                 }
             }
             const fleetTracked = this.#fleet.trackedAgents?.().get(agentName);
+            const dispatchClaim = this.#dispatchClaimStatuses.get(issueKey(issue));
             agents.push({
                 name: agentName,
                 role: tracked.spec.role,
@@ -5198,12 +6239,16 @@ export class FactoryLoop {
                 processes,
                 ...(fleetTracked?.invocationId ? { invocationId: fleetTracked.invocationId } : {}),
                 ...(fleetTracked?.node ? { node: fleetTracked.node } : {}),
+                ...(dispatchClaim ? { dispatchClaim: { ...dispatchClaim } } : {}),
             });
         };
         if (!empty) {
             for (const record of (await this.#batch()).inFlight) {
                 if (record.dryRun)
                     continue;
+                if (record.dispatchClaim) {
+                    this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+                }
                 for (const [agentName, tracked] of record.agents) {
                     await appendAgent(record.issue, agentName, tracked);
                 }
@@ -5739,10 +6784,25 @@ export class FactoryLoop {
     }
     async #publishImplementerPullRequest(record, implementer, opts = {}) {
         const key = `${issueKey(record.issue)}:${implementer.spec.repo}`;
+        const expectedHeadRef = implementer.spec.branch;
+        if (!expectedHeadRef) {
+            throw new Error(`Refusing to publish ${record.issue.key}: implementer has no Factory-derived branch`);
+        }
+        const matchesCurrentConvention = factoryBranchBelongsToIssue(expectedHeadRef, record.issue.key);
+        const matchesAuthorizedLegacyBranch = implementer.spec.existingPullRequestBranch === true &&
+            /^\d+$/u.test(record.issue.key) &&
+            expectedHeadRef.toLowerCase().startsWith(`${record.issue.key.toLowerCase()}-`);
+        if (!matchesCurrentConvention && !matchesAuthorizedLegacyBranch) {
+            throw new Error(`Refusing to publish ${record.issue.key}: branch ${expectedHeadRef} belongs to a different issue`);
+        }
         const durable = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
         const cached = this.#publishedPullRequests.get(key);
-        if (cached)
+        if (cached) {
+            if (cached.headRef !== expectedHeadRef) {
+                throw new Error(`Refusing cached PR for ${record.issue.key}: expected head branch ${expectedHeadRef}, found ${cached.headRef}`);
+            }
             return cached;
+        }
         const { identity, publisher } = this.#githubPullRequestPublisher();
         const remoteBranch = implementer.result?.locality === 'remote' && implementer.spec.branch
             ? implementer.spec.branch
@@ -5762,11 +6822,13 @@ export class FactoryLoop {
             : undefined;
         const repo = normalizeGithubRepo(implementer.spec.repo, this.#config.repos.org ?? sourceOwner);
         const durableReceipt = publishedPullRequests(durable).find((receipt) => receipt.repo.toLowerCase() === repo.toLowerCase());
-        const expectedHeadRef = implementer.spec.branch ?? remoteBranch;
-        if (durableReceipt &&
-            (!opts.reconcileExisting || !expectedHeadRef || durableReceipt.headRef === expectedHeadRef))
+        if (durableReceipt) {
+            if (durableReceipt.headRef !== expectedHeadRef) {
+                throw new Error(`Refusing durable PR receipt for ${record.issue.key}: expected head branch ${expectedHeadRef}, found ${durableReceipt.headRef}`);
+            }
             return durableReceipt;
-        if (opts.reconcileExisting && expectedHeadRef) {
+        }
+        if (opts.reconcileExisting) {
             const existing = await this.#openPullRequestByHead(repo, expectedHeadRef);
             if (existing) {
                 this.#publishedPullRequests.set(key, existing);
@@ -5784,6 +6846,7 @@ export class FactoryLoop {
         const result = await publisher.publishPullRequest({
             repo,
             ...(remoteBranch ? { headRef: remoteBranch } : { clonePath: implementer.spec.clonePath }),
+            expectedHeadRef,
             baseRef,
             title: `${issue.key}: ${issue.title}`,
             body: githubPullRequestBody(issue, implementer.spec.preview),
@@ -5793,7 +6856,7 @@ export class FactoryLoop {
             ? result
             : { ...result, author: identity };
         if (published.repo.toLowerCase() !== repo.toLowerCase() ||
-            published.headRef !== (remoteBranch ?? published.headRef) ||
+            published.headRef !== expectedHeadRef ||
             !Number.isInteger(published.number) ||
             published.number <= 0 ||
             !published.url) {
@@ -5894,9 +6957,11 @@ export class FactoryLoop {
         for (const root of roots) {
             let paths;
             try {
-                paths = await this.#mount.listTree(root);
+                paths = await this.#listRelayfileTree(root, 'exact-head PR confirmation');
             }
-            catch {
+            catch (error) {
+                if (relayfileOverload(error))
+                    throw error;
                 continue;
             }
             for (const path of paths) {
@@ -6162,9 +7227,11 @@ export class FactoryLoop {
         for (let attempt = 0; attempt < PUBLISHED_PR_CONFIRM_ATTEMPTS; attempt += 1) {
             const paths = (await Promise.all(roots.map(async (root) => {
                 try {
-                    return await this.#mount.listTree(root);
+                    return await this.#listRelayfileTree(root, 'published PR confirmation');
                 }
-                catch {
+                catch (error) {
+                    if (relayfileOverload(error))
+                        throw error;
                     return [];
                 }
             }))).flat();
@@ -7415,7 +8482,7 @@ export class FactoryLoop {
             `${GITHUB_ISSUE_ROOT}/${owner}__${repo}/issues`,
         ]) {
             try {
-                for (const path of await this.#mount.listTree(prefix)) {
+                for (const path of await this.#listRelayfileTree(prefix, 'GitHub escalation marker listing')) {
                     const parts = githubIssueCommentPathParts(path);
                     if (parts &&
                         parts.owner.toLowerCase() === source.owner.toLowerCase() &&
@@ -7709,7 +8776,7 @@ export class FactoryLoop {
             ];
         for (const prefix of prefixes) {
             try {
-                for (const path of await this.#mount.listTree(prefix)) {
+                for (const path of await this.#listRelayfileTree(prefix, 'GitHub issue comment replay listing')) {
                     const parts = githubIssueCommentPathParts(path);
                     if (parts &&
                         parts.owner.toLowerCase() === source.owner.toLowerCase() &&
@@ -7720,6 +8787,8 @@ export class FactoryLoop {
                 }
             }
             catch (error) {
+                if (relayfileOverload(error))
+                    throw error;
                 this.#logger.warn?.('[factory] unable to list GitHub issue comments for replay', { prefix, error });
             }
         }
@@ -8879,7 +9948,24 @@ export class FactoryLoop {
             const owner = await this.#babysitterOwnerFor(`${event.owner}/${event.repo}`, target.prNumber);
             if (!owner) {
                 this.#increment('babysitterEventsIgnoredUnownedPr');
-                this.#logger.debug?.('[factory] ignored unowned PR event for babysitter routing', { ...event, prNumber: target.prNumber });
+                // "Unowned" means no babysitter was ever registered for this PR — the
+                // downstream symptom of a missed or failed PR-open. Warn once per PR so
+                // it is visible at default level, then fall back to debug for the
+                // repeats; #sweepOrphanedBabysitterPrs is what actually recovers it.
+                const identity = githubPrIdentity(`${event.owner}/${event.repo}`, target.prNumber);
+                const detail = { ...event, prNumber: target.prNumber };
+                // The size cap gates the warn itself, not just the bookkeeping: an
+                // unbounded set of identities must not become an unbounded warn stream.
+                const firstForPr = Boolean(identity) &&
+                    !this.#babysitterUnownedPrWarned.has(identity) &&
+                    this.#babysitterUnownedPrWarned.size < BABYSITTER_UNOWNED_PR_WARN_LIMIT;
+                if (firstForPr) {
+                    this.#babysitterUnownedPrWarned.add(identity);
+                    this.#logger.warn?.('[factory] ignored unowned PR event for babysitter routing', detail);
+                }
+                else {
+                    this.#logger.debug?.('[factory] ignored unowned PR event for babysitter routing', detail);
+                }
                 continue;
             }
             if (this.#mount.resourceSubscriptions &&
@@ -9333,19 +10419,92 @@ export class FactoryLoop {
     // through the durable Relay lifecycle action; the orchestrator never runs `gh`. PR meta events here
     // only (a) spawn the babysitter on open and (b) carry the latest open/draft/
     // merged state used to guard the final transition.
+    async #readPrSnapshotContent(path) {
+        let lastError;
+        for (let attempt = 1; attempt <= BABYSITTER_PR_SNAPSHOT_READ_ATTEMPTS; attempt += 1) {
+            try {
+                const { content } = await this.#mount.readFile(path);
+                if (attempt > 1)
+                    this.#increment('babysitterPrSnapshotReadRetrySucceeded');
+                return content;
+            }
+            catch (error) {
+                lastError = error;
+                if (attempt < BABYSITTER_PR_SNAPSHOT_READ_ATTEMPTS && !this.#stopping) {
+                    this.#increment('babysitterPrSnapshotReadRetries');
+                    await this.#clock.sleep(BABYSITTER_PR_SNAPSHOT_READ_BACKOFF_MS * attempt);
+                    continue;
+                }
+                break;
+            }
+        }
+        throw lastError;
+    }
+    #recordBabysitterPrSnapshotFailure(path, error) {
+        const { errorMessage } = describeError(error);
+        const existing = this.#babysitterPrSnapshotDeadLetters.get(path);
+        const failures = (existing?.failures ?? 0) + 1;
+        // Re-insert last so the eviction below stays insertion-ordered by recency.
+        this.#babysitterPrSnapshotDeadLetters.delete(path);
+        this.#babysitterPrSnapshotDeadLetters.set(path, {
+            failures,
+            lastErrorMessage: errorMessage,
+            firstFailedAtMs: existing?.firstFailedAtMs ?? this.#clock.now(),
+        });
+        while (this.#babysitterPrSnapshotDeadLetters.size > BABYSITTER_PR_SNAPSHOT_DEAD_LETTER_LIMIT) {
+            const oldest = this.#babysitterPrSnapshotDeadLetters.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.#babysitterPrSnapshotDeadLetters.delete(oldest);
+            this.#increment('babysitterPrSnapshotDeadLettersEvicted');
+        }
+        this.#increment('babysitterPrSnapshotReadFailures');
+        const detail = {
+            path,
+            error: errorMessage,
+            failures,
+            attemptsPerTry: BABYSITTER_PR_SNAPSHOT_READ_ATTEMPTS,
+            deadLettered: this.#babysitterPrSnapshotDeadLetters.size,
+        };
+        // A PR whose meta cannot be read is a PR with no shepherd, which is not
+        // debug-level information. Escalate once the sweep retries also fail.
+        if (failures >= BABYSITTER_PR_SNAPSHOT_DEAD_LETTER_ESCALATE_AFTER) {
+            this.#increment('babysitterPrSnapshotReadFailuresEscalated');
+            // The sweep keeps retrying for as long as the mount stays faulted, so the
+            // escalation logs on the transition and then only periodically. The
+            // counters carry the true volume.
+            const sinceEscalation = failures - BABYSITTER_PR_SNAPSHOT_DEAD_LETTER_ESCALATE_AFTER;
+            if (sinceEscalation % BABYSITTER_PR_SNAPSHOT_ESCALATED_LOG_EVERY === 0) {
+                this.#logger.error?.('[factory] babysitter PR snapshot still unreadable after repeated retries', detail);
+            }
+            return;
+        }
+        this.#logger.warn?.('[factory] babysitter could not read PR snapshot', detail);
+    }
     async #handlePrChange(path) {
         const parts = githubPullPathParts(path);
         if (!parts) {
             return;
         }
-        let snapshot;
+        // This read is the only gate between a PR opening and it getting a
+        // babysitter, so it retries rather than treating one `fetch failed` as a
+        // verdict. On exhaustion the path is dead-lettered for the reconcile sweep
+        // (#sweepOrphanedBabysitterPrs) instead of being dropped.
+        let content;
         try {
-            snapshot = parsePullSnapshot((await this.#mount.readFile(path)).content, parts.number);
+            content = await this.#readPrSnapshotContent(path);
         }
         catch (error) {
-            this.#logger.debug?.('[factory] babysitter could not read PR snapshot', { path, error: describeError(error).errorMessage });
+            this.#recordBabysitterPrSnapshotFailure(path, error);
             return;
         }
+        if (this.#babysitterPrSnapshotDeadLetters.delete(path)) {
+            this.#increment('babysitterPrSnapshotDeadLettersRecovered');
+            this.#logger.info?.('[factory] babysitter recovered a dead-lettered PR snapshot read', { path });
+        }
+        // parsePullSnapshot never throws; an undefined result is a structurally
+        // mismatched payload, which a retry cannot fix.
+        const snapshot = parsePullSnapshot(content, parts.number);
         if (!snapshot) {
             return;
         }
@@ -9543,7 +10702,7 @@ export class FactoryLoop {
         // tracked PR identity left. Keep the scan simple and prefer branch identity
         // over title/body references to avoid "related to AR-N" body false positives.
         const githubSource = await this.#issueSource() === 'github';
-        const paths = githubSource ? await this.#githubIssuePaths() : await this.#mount.listTree(ISSUE_ROOT);
+        const paths = githubSource ? await this.#githubIssuePaths() : await this.#listRelayfileTree(ISSUE_ROOT, 'merge advance issue scan');
         for (const path of paths) {
             if (githubSource ? !isGithubIssueFilePath(path) : !isIssueFilePath(path)) {
                 continue;
@@ -10009,10 +11168,12 @@ export class FactoryLoop {
         const found = [];
         for (const root of roots) {
             try {
-                const tree = await this.#mount.listTree(root);
+                const tree = await this.#listRelayfileTree(root, 'PR meta path discovery');
                 found.push(...tree.filter((path) => path.endsWith('.json') && numberSegment.test(path)));
             }
-            catch {
+            catch (error) {
+                if (relayfileOverload(error))
+                    throw error;
                 // try the next root
             }
         }
@@ -10205,6 +11366,124 @@ export class FactoryLoop {
             }
         }
     }
+    async #notifyTicketDispatch(decision, issue, record, result) {
+        const hook = this.#config.hooks?.onTicketDispatch;
+        if (!hook || result.dryRun)
+            return;
+        const agent = result.agents.find((candidate) => candidate.role === 'implementer')
+            ?? result.agents.find((candidate) => candidate.role === 'workflow')
+            ?? result.agents[0];
+        if (!agent)
+            return;
+        if (!await this.#claimTicketDispatchNotification(record))
+            return;
+        const tracked = record.agents.get(agent.name);
+        const payload = {
+            eventType: 'ticket.dispatched',
+            summary: `Ticket dispatched: ${issue.title} → ${agent.name}.`,
+            issue: {
+                id: issue.uuid,
+                title: issue.title,
+                url: dispatchIssueUrl(issue),
+            },
+            agent: {
+                name: agent.name,
+                sessionRef: tracked?.sessionRef ?? null,
+            },
+            sessionOwner: dispatchSessionOwner(decision) ?? null,
+            timestamp: new Date(this.#clock.now()).toISOString(),
+        };
+        const text = ticketDispatchNotificationText(payload);
+        for (const target of hook.notify) {
+            if (target.surface === 'linear' && !target.commentOnIssue)
+                continue;
+            try {
+                switch (target.surface) {
+                    case 'relay':
+                        await this.#fleet.sendMessage({
+                            to: `#${target.channel.replace(/^#/u, '')}`,
+                            text,
+                        });
+                        break;
+                    case 'slack':
+                        if (!target.channel && !target.dm) {
+                            throw new Error('Slack ticket-dispatch notification needs channel and/or dm');
+                        }
+                        await this.#ticketDispatchDelivery.slack({
+                            channel: target.channel,
+                            dm: target.dm,
+                            text,
+                        });
+                        break;
+                    case 'telegram':
+                        await this.#ticketDispatchDelivery.telegram({ chatId: target.chatId, text });
+                        break;
+                    case 'linear':
+                        if (isGithubIssue(issue)) {
+                            throw new Error('Linear ticket-dispatch comments require a Linear issue');
+                        }
+                        await this.#linear.postComment(issue, text);
+                        break;
+                }
+                this.#increment('ticketDispatchHookNotifications');
+            }
+            catch (error) {
+                this.#increment('ticketDispatchHookFailures');
+                this.#logger.warn?.('[factory] onTicketDispatch notification failed', {
+                    issue: issue.key,
+                    surface: target.surface,
+                    error: describeError(error).errorMessage,
+                });
+            }
+        }
+    }
+    async #claimTicketDispatchNotification(record) {
+        if (record.dryRun || !this.#usesDurableDispatchLifecycle())
+            return true;
+        const key = issueKey(record.issue);
+        return this.#serializeDispatchLifecyclePersistence(key, async () => {
+            const epoch = this.#dispatchLifecycleEpochs.get(key);
+            if (epoch === undefined) {
+                this.#scheduleDispatchLifecycleRetry(record);
+                return false;
+            }
+            const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
+            if (!lifecycle) {
+                this.#scheduleDispatchLifecycleRetry(record);
+                return false;
+            }
+            const workUnitId = lifecycle.runId;
+            if (lifecycle.ticketDispatchNotification?.workUnitId === workUnitId)
+                return false;
+            // Reserve the work unit before external side effects. Hook delivery is
+            // best-effort per target, so takeover must prefer at-most-once fan-out
+            // over replaying a notification whose provider acknowledgement was lost.
+            // Follow-up for provider-idempotent retries: https://github.com/AgentWorkforce/factory/issues/239
+            const claimedAtMs = this.#clock.now();
+            const claimedLifecycle = {
+                ...lifecycle,
+                ticketDispatchNotification: { workUnitId, claimedAtMs },
+                updatedAtMs: claimedAtMs,
+            };
+            const saved = await this.#state.saveDispatchLifecycle(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch, claimedAtMs, claimedLifecycle);
+            if (!saved) {
+                this.#dispatchLifecycleEpochs.delete(key);
+                this.#increment('dispatchLifecycleFencesRejected');
+                await this.#reportLifecycle(claimedLifecycle, 'factory.anomaly', {
+                    level: 'error',
+                    errorCode: 'fence_rejected',
+                });
+                this.#scheduleDispatchLifecycleRetry(record);
+                return false;
+            }
+            return true;
+        });
+    }
+    #ticketDispatchNotificationIsPending(lifecycle) {
+        return Boolean(this.#config.hooks?.onTicketDispatch) &&
+            !lifecycle.dryRun &&
+            lifecycle.ticketDispatchNotification?.workUnitId !== lifecycle.runId;
+    }
     #error(error, issue) {
         this.#increment('errors');
         const details = describeError(error);
@@ -10999,9 +12278,11 @@ export class FactoryLoop {
     async #findSlackUserIdByIdentity(identity) {
         const list = async (prefix) => {
             try {
-                return await this.#mount.listTree(prefix);
+                return await this.#listRelayfileTree(prefix, 'Slack identity lookup');
             }
-            catch {
+            catch (error) {
+                if (relayfileOverload(error))
+                    throw error;
                 return [];
             }
         };
@@ -11978,7 +13259,7 @@ export class FactoryLoop {
         }
         let paths;
         try {
-            paths = await this.#mount.listTree('/slack/channels');
+            paths = await this.#listRelayfileTree('/slack/channels', 'Slack channel resolution');
         }
         catch (error) {
             this.#logger.warn?.('[factory] unable to resolve Slack channel from mount; using configured channel value', {
@@ -12487,6 +13768,25 @@ function dispatchSpecs(decision) {
     }
     return [...decision.implementers, decision.reviewer];
 }
+function dispatchSessionOwner(decision) {
+    for (const spec of dispatchSpecs(decision)) {
+        const sessionOwner = spec.principal?.trim() || spec.owner?.trim();
+        if (sessionOwner)
+            return sessionOwner;
+    }
+    return undefined;
+}
+function dispatchIssueUrl(issue) {
+    const payload = wrappedPayload(issue.raw);
+    const source = asRecord(payload.source);
+    return stringValue(payload.url)
+        ?? stringValue(payload.html_url)
+        ?? stringValue(source?.url)
+        ?? issue.path;
+}
+function ticketDispatchNotificationText(payload) {
+    return `${payload.summary}\n${JSON.stringify(payload)}`;
+}
 function previewServiceForRepo(config, repo) {
     const services = config.preview?.services;
     if (!services)
@@ -12819,7 +14119,8 @@ function decisionWithLifecycleBranches(decision, runId, opts = {}) {
             ...(opts.isolateLocalWorktree && baseClonePath && branch ? { baseClonePath, clonePath } : {}),
             // The same persisted lifecycle reuses this id after takeover, while a
             // genuine reopen gets a new id and cannot replay an old placement ack.
-            invocationId: `factory:${decision.issue.key}:${runId}:${spec.role}:${sanitizeAgentSlug(spec.name)}`,
+            invocationId: spec.invocationId ??
+                `factory:${decision.issue.key}:${runId}:${spec.role}:${sanitizeAgentSlug(spec.name)}`,
         };
         return branch ? { ...lifecycleSpec, branch } : lifecycleSpec;
     };
@@ -13226,17 +14527,19 @@ const linearIssueMirrorsGithubIssue = (issue, ghIssue) => {
         .split(/\r?\n/u)
         .some((line) => line.trim() === `${GITHUB_MIRROR_SOURCE_PREFIX}${ghIssue.url}`);
 };
-const resolveIssuePrFromMount = async (mount, config, issue, opts = {}) => {
+const resolveIssuePrFromMount = async (mount, config, issue, opts = {}, listTree = (prefix) => mount.listTree(prefix)) => {
     const candidates = [];
     const listErrors = [];
     for (const repo of opts.repo ? [opts.repo] : reposFromConfig(config)) {
         const paths = new Set();
         for (const root of githubPullRoots(repo)) {
             try {
-                for (const path of await mount.listTree(root))
+                for (const path of await listTree(root))
                     paths.add(path);
             }
             catch (error) {
+                if (relayfileOverload(error))
+                    throw error;
                 listErrors.push(error);
             }
         }
@@ -13503,8 +14806,7 @@ const issuePrMatchScore = (pr, issue, marker, opts = {}) => {
 };
 const hasTitlePrefix = (title, marker) => title === marker || title.startsWith(`${marker} `);
 const factoryBranchMatchesIssue = (headRef, issueKey) => /^\d+$/u.test(issueKey)
-    ? headRef.toLowerCase() === `factory/${issueKey.toLowerCase()}` ||
-        headRef.toLowerCase().startsWith(`factory/${issueKey.toLowerCase()}-`)
+    ? factoryBranchBelongsToIssue(headRef, issueKey)
     : containsIssueKey(headRef, issueKey);
 // Legacy Factory runs created GitHub-native branches as `<issue-number>-*`
 // before the current `factory/<issue>-*` convention. Keep this matcher out of
@@ -14068,6 +15370,75 @@ const eventOccurredAtMs = (event) => {
     const parsed = timestamp ? Date.parse(timestamp) : Number.NaN;
     return Number.isFinite(parsed) ? parsed : undefined;
 };
+const discoveryEventId = (event) => {
+    const flat = asRecord(event) ?? {};
+    const id = flat.id ?? flat.eventId ?? flat.event_id ?? flat.seq;
+    return typeof id === 'string' || typeof id === 'number' ? String(id) : undefined;
+};
+const compareDiscoveryEvents = (left, right) => {
+    const leftOccurredAt = eventOccurredAtMs(left);
+    const rightOccurredAt = eventOccurredAtMs(right);
+    if (leftOccurredAt !== undefined && rightOccurredAt !== undefined && leftOccurredAt !== rightOccurredAt) {
+        return leftOccurredAt - rightOccurredAt;
+    }
+    const leftId = discoveryEventId(left) ?? '';
+    const rightId = discoveryEventId(right) ?? '';
+    const leftSequence = eventSequenceNumber(leftId);
+    const rightSequence = eventSequenceNumber(rightId);
+    if (leftSequence !== undefined && rightSequence !== undefined && leftSequence !== rightSequence) {
+        return leftSequence - rightSequence;
+    }
+    return leftId.localeCompare(rightId);
+};
+const discoveryEventIsDeletion = (event) => {
+    const flat = asRecord(event) ?? {};
+    const summary = asRecord(flat.summary) ?? {};
+    const type = stringValue(flat.type)?.toLowerCase();
+    // filesystemEventToChangeEvent normalizes filesystem watcher events to
+    // type: 'relayfile.changed' and stashes the real operation here, so a
+    // deletion arrives as filesystemEventType: 'file.deleted' / 'dir.deleted'
+    // with an outer type that does not itself say "deleted".
+    const filesystemEventType = stringValue(flat.filesystemEventType)?.toLowerCase();
+    const action = stringValue(flat.action)?.toLowerCase();
+    const status = stringValue(summary.status)?.toLowerCase();
+    const digest = stringValue(flat.digest)?.toLowerCase();
+    return type === 'file.deleted' || type === 'dir.deleted' ||
+        filesystemEventType === 'file.deleted' || filesystemEventType === 'dir.deleted' ||
+        action === 'delete' || status === 'deleted' || digest?.startsWith('deleted:') === true;
+};
+const githubIssueIndexRepoRoots = (path) => {
+    const slash = /^\/github\/repos\/([^/]+)\/([^/]+)\/issues\/_index\.json$/u.exec(path);
+    const flat = /^\/github\/repos\/([^/]+)__([^/]+)\/issues\/_index\.json$/u.exec(path);
+    const parts = slash ?? flat;
+    if (!parts)
+        return [];
+    const [, owner, repo] = parts;
+    return [
+        `/github/repos/${owner}/${repo}/issues`,
+        `/github/repos/${owner}__${repo}/issues`,
+    ];
+};
+const relayfileOverload = (error) => {
+    const flat = asRecord(error) ?? {};
+    const response = asRecord(flat.response) ?? {};
+    const data = asRecord(flat.data) ?? asRecord(response.data) ?? {};
+    const details = asRecord(flat.details) ?? asRecord(data.details) ?? {};
+    const statusValue = flat.status ?? flat.statusCode ?? response.status ?? response.statusCode;
+    const status = typeof statusValue === 'number' ? statusValue : Number(statusValue);
+    if (status !== 429)
+        return undefined;
+    const retryValue = flat.retryAfterSeconds ?? details.retryAfterSeconds ?? data.retryAfterSeconds;
+    const parsedRetry = typeof retryValue === 'number' ? retryValue : Number(retryValue);
+    const retryAfterSeconds = Number.isFinite(parsedRetry) && parsedRetry >= 0 ? parsedRetry : undefined;
+    const reason = stringValue(flat.reason) ?? stringValue(details.reason) ?? stringValue(data.reason) ??
+        stringValue(flat.code) ?? stringValue(data.code) ?? 'rate_limited';
+    return { status, reason, ...(retryAfterSeconds === undefined ? {} : { retryAfterSeconds }) };
+};
+const discoveryOverloadBackoffMs = (retryAfterSeconds, consecutiveOverloads) => {
+    const retryAfterMs = Math.max(0, Math.ceil((retryAfterSeconds ?? 0) * 1_000));
+    const exponentialMs = Math.min(DISCOVERY_OVERLOAD_BACKOFF_MAX_MS, 5_000 * (2 ** Math.min(10, Math.max(0, consecutiveOverloads - 1))));
+    return Math.max(retryAfterMs, exponentialMs);
+};
 const eventSequenceNumber = (eventId) => {
     const whole = Number(eventId);
     if (Number.isFinite(whole))
@@ -14183,7 +15554,8 @@ const eventIdentity = (event) => {
 // subscription/poll handler) crash-loops. Returns undefined for such events so
 // callers skip them and keep processing the well-formed ones.
 export const changeEventPath = (event) => {
-    const path = event?.resource?.path;
+    const candidate = event;
+    const path = candidate?.resource?.path ?? candidate?.path;
     return typeof path === 'string' && path ? path : undefined;
 };
 const describeError = (error) => {
@@ -14390,6 +15762,7 @@ const lifecycleFromInFlightRecord = (record, runId, phase, updatedAtMs, pullRequ
     agents: [...record.agents].map(([name, tracked]) => ({ name, tracked: cloneTrackedAgent(tracked) })),
     invocationIds: [...record.invocationIds],
     result: record.result ? structuredClone(record.result) : undefined,
+    ...(record.dispatchClaim ? { dispatchClaim: { ...record.dispatchClaim } } : {}),
     ...(pullRequests.length > 0 ? { pullRequests: pullRequests.map((receipt) => ({ ...receipt })) } : {}),
     ...(pullRequest ? { pullRequest: { ...pullRequest } } : {}),
     ...(releaseReason ? { releaseReason } : {}),
@@ -14403,6 +15776,7 @@ const inFlightRecordFromLifecycle = (lifecycle) => ({
     agents: new Map(lifecycle.agents.map((agent) => [agent.name, cloneTrackedAgent(agent.tracked)])),
     invocationIds: new Set(lifecycle.invocationIds),
     result: lifecycle.result ? structuredClone(lifecycle.result) : undefined,
+    ...(lifecycle.dispatchClaim ? { dispatchClaim: { ...lifecycle.dispatchClaim } } : {}),
 });
 const dispatchResultFromLifecycle = (lifecycle) => lifecycle.result ? structuredClone(lifecycle.result) : {
     issue: { ...lifecycle.issue },