@agent-relay/factory 0.1.58 → 0.1.62

package/dist/orchestrator/factory.js

@@ -8,7 +8,7 @@ import { GithubMergeGate, closeProbePr } from '../github/index.js';
 import { VerificationPipeline } from '../environments/verification-pipeline.js';
 import { factoryWorktreeIssueSlug, factoryWorktreePath } from '../git/agent-worktree.js';
 import { InMemoryStateStore } from '../state/in-memory-state-store.js';
-import { containsExplicitIssueReference, containsIssueKey } from '../issue-key-match.js';
+import { containsExplicitIssueReference, containsIssueKey, factoryBranchBelongsToIssue } from '../issue-key-match.js';
 import { normalizeLogger, normalizeLogValue, setSafeErrorStack, stringifyLogValue } from '../logging.js';
 import { isInFactoryScope } from '../safety/factory-scope.js';
 import { dispatchRelayflowForChangeEvent } from '../dispatch/relayflow-registry.js';
@@ -28,6 +28,7 @@ import { findAgentProcessByName, readProcessIdentity } from './process-identity.
 import { readFactoryInFlightRegistry, terminatePids } from './reaper.js';
 import { createFactoryCloudEventV1, factoryCloudReleaseReasonV1, } from '../observability/events.js';
 import { boundedRunCostTotal, CostLedger } from '../cost/ledger.js';
+import { createTicketDispatchDelivery } from '../delivery/ticket-dispatch.js';
 class ClarificationWakeLeaseLostError extends Error {
 }
 class ClarificationQuestionDeliveryLeaseLostError extends Error {
@@ -86,6 +87,29 @@ const BABYSITTER_SUBSCRIPTION_EVENT_TYPES = [
     'check_run.completed',
 ];
 const BABYSITTER_SUBSCRIPTION_TERMINAL_EVENT_TYPES = ['pull_request.closed'];
+// The PR-open snapshot read is the single gate that decides whether a PR ever
+// gets a babysitter, so a transient mount fetch failure must not be allowed to
+// settle that question. Retry in-line, then dead-letter for the reconcile sweep.
+const BABYSITTER_PR_SNAPSHOT_READ_ATTEMPTS = 3;
+const BABYSITTER_PR_SNAPSHOT_READ_BACKOFF_MS = 250;
+// Escalate from warn to error once in-line retries plus this many sweep retries
+// have all failed: the PR is durably unreadable, not momentarily unlucky.
+const BABYSITTER_PR_SNAPSHOT_DEAD_LETTER_ESCALATE_AFTER = 3;
+// Bound the dead-letter book so a sustained mount outage cannot grow it without
+// limit. Oldest entries are evicted first; the reconcile sweep still adopts
+// their PRs through the ownerless-record path.
+const BABYSITTER_PR_SNAPSHOT_DEAD_LETTER_LIMIT = 256;
+// Retries carry backoff sleeps, so a sweep drains a slice rather than the whole
+// book; failed entries rotate to the end so successive sweeps cover all of it.
+const BABYSITTER_PR_SNAPSHOT_DRAIN_PER_SWEEP = 16;
+// A durably faulted mount would otherwise log an error per path per sweep.
+const BABYSITTER_PR_SNAPSHOT_ESCALATED_LOG_EVERY = 20;
+// Adoption probes an issue's open PR through the (already gh-backed-off) probe
+// resolver, so it runs on its own slower cadence than the completion sweep.
+const BABYSITTER_ORPHAN_SWEEP_INTERVAL_MS = 60_000;
+// Warn once per PR identity that arrives unowned, then fall back to debug. The
+// counter carries the true volume; the log only has to make it discoverable.
+const BABYSITTER_UNOWNED_PR_WARN_LIMIT = 64;
 const BABYSITTER_RESOURCE_DELIVERY_RETRY_MS = 5_000;
 const BABYSITTER_RESOURCE_SUBSCRIPTION_RENEW_MS = (BABYSITTER_SUBSCRIPTION_TTL_SECONDS * 1_000) / 2;
 // A babysitter wake fails with a "registration lag" error (agent_not_found /
@@ -111,6 +135,10 @@ const STOP_TEARDOWN_TIMEOUT_MS = 2_500;
 const DISPATCH_LIFECYCLE_LEASE_MS = 5 * 60_000;
 const DISPATCH_LIFECYCLE_RENEW_MS = 60_000;
 const DISPATCH_LIFECYCLE_RETRY_MS = 1_000;
+const DISPATCH_WRITEBACK_MAX_ATTEMPTS = 3;
+const DISPATCH_WRITEBACK_RETRY_MS = 250;
+const HELD_PAST_DEADLINE_RELEASE_REASON = 'held-past-deadline';
+const HELD_DEADLINE_OVERDUE_RETRY_MS = 1_000;
 const STARTUP_AGENT_EXIT_DRAIN_TIMEOUT_MS = 30_000;
 const RECONCILED_AGENT_EXIT_CONCURRENCY = 4;
 const SLACK_EVENT_WATERMARK_CACHE_MS = 60_000;
@@ -124,6 +152,11 @@ const DISPATCH_FAILURE_HANDOFF_UNRESOLVED_TTL_MS = 5 * 60_000;
 const DEFAULT_LIVE_HEARTBEAT_INTERVAL_MS = 15_000;
 const REMOTE_OPERATION_PROGRESS_INTERVAL_MS = 15_000;
 const REMOTE_OPERATION_SLOW_WARN_MS = 30_000;
+const DISCOVERY_SWEEP_LEASE_MS = 5 * 60_000;
+const DISCOVERY_SWEEP_RENEW_MS = 30_000;
+const READINESS_RECONCILE_FAILURE_THRESHOLD = 3;
+const DISCOVERY_CHANGE_EVENT_LIMIT = 1_000;
+const DISCOVERY_OVERLOAD_BACKOFF_MAX_MS = 5 * 60_000;
 const GITHUB_FACTORY_LABEL = 'factory';
 const GITHUB_LIFECYCLE_LABELS = new Set(['factory:in-progress', 'factory:human-review']);
 const GITHUB_MIRROR_TITLE_PREFIX = '[factory]';
@@ -191,6 +224,7 @@ export class FactoryLoop {
     #mount;
     #states;
     #fleet;
+    #ticketDispatchDelivery;
     #triage;
     #linear;
     #github;
@@ -268,6 +302,7 @@ export class FactoryLoop {
     #clarificationWakeRetryTimers = new Map();
     #clarificationWakeOwner = `${process.pid}:${randomUUID()}`;
     #dispatchLifecycleOwner = `${process.pid}:${randomUUID()}`;
+    #discoverySweepOwner = `${process.pid}:${randomUUID()}`;
     #dispatchLifecycleEpochs = new Map();
     #dispatchTerminalWaiters = new Map();
     #dispatchLifecycleRetryTimers = new Map();
@@ -275,8 +310,12 @@ export class FactoryLoop {
     #abandonedDispatchReasons = new Map();
     #dispatchLifecycleCapacityWaitLogged = new Set();
     #dispatchLifecycleOwnershipWaitLogged = new Set();
+    #dispatchClaimStatuses = new Map();
     #localReleaseCheckpoints = new Map();
     #dispatchLifecycleRenewTimer;
+    #heldAgentDeadlineTimer;
+    #heldAgentDeadlineDueAtMs;
+    #heldAgentDeadlineSweepInFlight;
     #clarificationSweepTimer;
     #clarificationSweepDueAtMs;
     #clarificationSweepInFlight;
@@ -305,6 +344,15 @@ export class FactoryLoop {
     #liveHeartbeatRefresh;
     #liveHeartbeatLastWriteMs = 0;
     #stoppingHeartbeatRefreshActive = false;
+    #readinessReconcileTimer;
+    #readinessReconcileInFlight;
+    #readinessReconcileIntervalMs = 60_000;
+    #readinessReconcileConsecutiveFailures = 0;
+    #readinessReconcileLastDurationMs;
+    #readinessReconcileLastStartedAtMs;
+    #readinessReconcileLastCompletedAtMs;
+    #readinessReconcileLastFailureAtMs;
+    #readinessReconcileLastError;
     #liveEventQueue = [];
     #liveEventDrainScheduled = false;
     #liveEventDrainActive = false;
@@ -335,6 +383,18 @@ export class FactoryLoop {
     // webhook-fed mount path so readiness can re-read PR meta without a gh call.
     #babysitterPr = new Map();
     #babysitterIssueRefs = new Map();
+    // PR meta paths whose snapshot read exhausted its in-line retries. Without
+    // this book a single failed read permanently orphans the PR: no babysitter is
+    // spawned, so no owner exists, so every later event for it is discarded. The
+    // reconcile sweep drains this and clears entries that recover.
+    #babysitterPrSnapshotDeadLetters = new Map();
+    // PR identities already warned about as unowned, so the routing log reports
+    // the condition at default level without repeating per event.
+    #babysitterUnownedPrWarned = new Set();
+    #babysitterOrphanSweepActive = false;
+    #babysitterOrphanSweepLastRunMs = 0;
+    #babysitterOrphanReportedFailures = 0;
+    #babysitterOrphanReportedUnowned = 0;
     // Relayfile matches subscription IDs server-side. This direct index means a
     // delivery claim never requires the legacy local repo/PR scan to find an
     // owning babysitter.
@@ -367,6 +427,15 @@ export class FactoryLoop {
     // undefined = readiness not yet probed; resolved lazily so the standalone
     // runOnce() path (which skips #start) still ingests when the mount is present.
     #githubIngestionEnabled;
+    #runOnceInFlight;
+    #runOnceInFlightDryRun;
+    #discoverySession;
+    #discoverySweepEpoch;
+    #discoverySweepStartedAtMs;
+    #discoverySweepRenewTimer;
+    #discoverySweepRenewalInFlight;
+    #discoverySweepLeaseLost = false;
+    #discoveryOverloadError;
     #resolvedIssueSource;
     #integrationInstructions;
     #integrationInstructionsRefresh;
@@ -384,6 +453,9 @@ export class FactoryLoop {
         this.#states = ports.stateResolution ?? stateResolutionFromIds(config.stateIds, config.linear.states);
         installFactoryDraftPredicate(this.#mount, config);
         this.#fleet = ports.fleet;
+        this.#ticketDispatchDelivery = ports.ticketDispatchDelivery ?? createTicketDispatchDelivery({
+            mountRoot: config.localMountRoot,
+        });
         this.#triage = ports.triage ?? new TieredTriage(new HeuristicTriage());
         this.#linear = ports.linear ?? MountLinearWriteback(ports.mount, {
             safety: config.safety,
@@ -481,7 +553,7 @@ export class FactoryLoop {
                     }
                 },
                 listPaths: async (prefix) => {
-                    return this.#mount.listTree(prefix);
+                    return this.#listRelayfileTree(prefix, 'integration descriptor discovery');
                 },
             };
             const descriptors = await deriveDescriptorsFromMount(reader);
@@ -674,6 +746,7 @@ export class FactoryLoop {
                 await this.#rearmSlackReplyWatchers();
                 await this.#drainReadyClarificationWake();
                 await this.#rearmGithubIssueCommentWatchers();
+                this.#scheduleReadinessReconcile();
                 this.#scheduleCompletionSweep(0);
                 return;
             }
@@ -726,6 +799,11 @@ export class FactoryLoop {
         if (this.#dispatchLifecycleRenewTimer)
             clearInterval(this.#dispatchLifecycleRenewTimer);
         this.#dispatchLifecycleRenewTimer = undefined;
+        if (this.#heldAgentDeadlineTimer)
+            clearTimeout(this.#heldAgentDeadlineTimer);
+        this.#heldAgentDeadlineTimer = undefined;
+        this.#heldAgentDeadlineDueAtMs = undefined;
+        await this.#heldAgentDeadlineSweepInFlight;
         for (const timer of this.#dispatchLifecycleRetryTimers.values())
             clearTimeout(timer);
         this.#dispatchLifecycleRetryTimers.clear();
@@ -734,9 +812,13 @@ export class FactoryLoop {
         if (this.#completionSweepTimer)
             clearTimeout(this.#completionSweepTimer);
         this.#completionSweepTimer = undefined;
+        if (this.#readinessReconcileTimer)
+            clearTimeout(this.#readinessReconcileTimer);
+        this.#readinessReconcileTimer = undefined;
         if (this.#previewSweepTimer)
             clearTimeout(this.#previewSweepTimer);
         this.#previewSweepTimer = undefined;
+        await this.#readinessReconcileInFlight;
         await this.#previewSweepInFlight;
         this.#stoppingHeartbeatRefreshActive = await this.#stopLiveHeartbeat('stopping');
         try {
@@ -781,6 +863,9 @@ export class FactoryLoop {
             this.#babysitterSubscriptionOwners.clear();
             this.#babysitterReady.clear();
             this.#babysitterCriticalAgents.clear();
+            this.#babysitterPrSnapshotDeadLetters.clear();
+            this.#babysitterUnownedPrWarned.clear();
+            this.#babysitterOrphanSweepLastRunMs = 0;
             const subscription = this.#subscription;
             this.#subscription = undefined;
             await this.#boundedStopTeardown('factory subscription unsubscribe', () => subscription?.unsubscribe());
@@ -875,6 +960,7 @@ export class FactoryLoop {
     async #startLiveSubscription(issueSource, overrides = {}) {
         const options = this.#liveOptions(overrides);
         this.#liveTransport = options.transport;
+        this.#readinessReconcileIntervalMs = options.reconcileIntervalMs;
         this.#liveConnectStartedAtMs = this.#clock.now();
         this.#liveReplaySkewMarginMs = options.replaySkewMarginMs;
         const highWatermark = await this.#currentEventHighWatermark();
@@ -1005,6 +1091,7 @@ export class FactoryLoop {
             pollIntervalMs: overrides.pollIntervalMs ?? this.#config.liveSubscription.pollIntervalMs,
             eventLimit: overrides.eventLimit ?? this.#config.liveSubscription.eventLimit,
             replaySkewMarginMs: overrides.replaySkewMarginMs ?? this.#config.liveSubscription.replaySkewMarginMs,
+            reconcileIntervalMs: overrides.reconcileIntervalMs ?? this.#config.liveSubscription.reconcileIntervalMs,
         };
     }
     async #currentEventCursor(limit) {
@@ -1031,6 +1118,64 @@ export class FactoryLoop {
             };
         }
     }
+    #scheduleReadinessReconcile(delayMs = this.#readinessReconcileIntervalMs) {
+        if (!this.#started ||
+            this.#stopping ||
+            this.#readinessReconcileTimer ||
+            this.#readinessReconcileInFlight)
+            return;
+        this.#readinessReconcileTimer = setTimeout(() => {
+            this.#readinessReconcileTimer = undefined;
+            if (!this.#started || this.#stopping)
+                return;
+            const sweep = this.#reconcileReadyIssues();
+            this.#readinessReconcileInFlight = sweep;
+            void sweep.finally(() => {
+                if (this.#readinessReconcileInFlight === sweep) {
+                    this.#readinessReconcileInFlight = undefined;
+                }
+                if (this.#started && !this.#stopping)
+                    this.#scheduleReadinessReconcile();
+            });
+        }, delayMs);
+        this.#readinessReconcileTimer.unref?.();
+    }
+    async #reconcileReadyIssues() {
+        const startedAtMs = this.#clock.now();
+        this.#readinessReconcileLastStartedAtMs = startedAtMs;
+        this.#increment('readinessReconcileSweeps');
+        this.#logger.info?.('[factory] periodic readiness reconciliation started', {
+            intervalMs: this.#readinessReconcileIntervalMs,
+        });
+        try {
+            const report = await this.runOnce();
+            this.#readinessReconcileConsecutiveFailures = 0;
+            this.#readinessReconcileLastDurationMs = this.#elapsedSince(startedAtMs);
+            this.#readinessReconcileLastCompletedAtMs = this.#clock.now();
+            this.#readinessReconcileLastError = undefined;
+            this.#logger.info?.('[factory] periodic readiness reconciliation completed', {
+                durationMs: this.#readinessReconcileLastDurationMs,
+                candidates: report.pulled.length,
+                dispatched: report.dispatched.length,
+                skipped: report.skipped.length,
+            });
+        }
+        catch (error) {
+            const errorMessage = describeError(error).errorMessage;
+            this.#readinessReconcileConsecutiveFailures += 1;
+            this.#readinessReconcileLastDurationMs = this.#elapsedSince(startedAtMs);
+            this.#readinessReconcileLastFailureAtMs = this.#clock.now();
+            this.#readinessReconcileLastError = errorMessage;
+            this.#increment('readinessReconcileErrors');
+            this.#logger.warn?.('[factory] periodic readiness reconciliation failed; retry remains scheduled', {
+                error: errorMessage,
+                durationMs: this.#readinessReconcileLastDurationMs,
+                consecutiveFailures: this.#readinessReconcileConsecutiveFailures,
+                degraded: this.#readinessReconcileConsecutiveFailures >= READINESS_RECONCILE_FAILURE_THRESHOLD,
+            });
+        }
+        await this.#refreshLiveHeartbeat();
+    }
     #scheduleLivePoll(delayMs, options) {
         if (this.#livePollTimer || !this.#started)
             return;
@@ -1340,6 +1485,10 @@ export class FactoryLoop {
         // not this polling sweep. Disabling it here is what makes the babysitter path
         // webhook-driven rather than polled.
         if (this.#config.babysitter.enabled) {
+            // Webhook-driven is not the same as one-shot: a PR-open event that was
+            // missed or whose snapshot read failed leaves its PR with no shepherd
+            // forever. This is the reconciliation that recovers those.
+            await this.#sweepOrphanedBabysitterPrs(reason);
             return;
         }
         if (this.#completionSweepActive) {
@@ -1401,6 +1550,207 @@ export class FactoryLoop {
             this.#completionSweepActive = false;
         }
     }
+    // Reconciliation for the babysitter's one-shot PR-open path. Two failure
+    // modes converge on the same end state — an open Factory PR that no
+    // babysitter owns, whose reviews, CI results and conflicts are then silently
+    // discarded by #routeBabysitterEvent:
+    //   1. the PR-open snapshot read failed and exhausted its retries, or
+    //   2. the PR-open event never arrived at all (restart, drain loss, gap).
+    // Neither is self-healing from events alone, so this sweep re-reads the
+    // dead-lettered paths and adopts still-ownerless in-flight records.
+    async #sweepOrphanedBabysitterPrs(reason = 'forced') {
+        if (!this.#config.babysitter.enabled || this.#stopping || this.#babysitterOrphanSweepActive) {
+            return;
+        }
+        const now = this.#clock.now();
+        // Adoption probes every ownerless in-flight record, so it runs on the slow
+        // cadence. A dead-lettered read is a PR we already know is unshepherded —
+        // it retries at every sweep opportunity rather than waiting out that cadence.
+        const adoptionDue = reason === 'forced' ||
+            now - this.#babysitterOrphanSweepLastRunMs >= BABYSITTER_ORPHAN_SWEEP_INTERVAL_MS;
+        if (!adoptionDue && this.#babysitterPrSnapshotDeadLetters.size === 0) {
+            return;
+        }
+        this.#babysitterOrphanSweepActive = true;
+        try {
+            this.#increment('babysitterOrphanSweepRuns');
+            await this.#retryDeadLetteredPrSnapshots();
+            if (adoptionDue) {
+                this.#babysitterOrphanSweepLastRunMs = now;
+                await this.#adoptOrphanedBabysitterPrs();
+            }
+            this.#reportBabysitterOrphanHealth();
+        }
+        finally {
+            this.#babysitterOrphanSweepActive = false;
+        }
+    }
+    async #retryDeadLetteredPrSnapshots() {
+        // Each retry costs up to BABYSITTER_PR_SNAPSHOT_READ_ATTEMPTS reads with
+        // backoff sleeps between them, so drain a bounded slice per sweep rather
+        // than stalling the sweep behind a full book during a mount outage. A
+        // failed retry re-inserts its entry at the end, so successive sweeps
+        // rotate through the whole book.
+        const batch = [...this.#babysitterPrSnapshotDeadLetters.keys()].slice(0, BABYSITTER_PR_SNAPSHOT_DRAIN_PER_SWEEP);
+        if (this.#babysitterPrSnapshotDeadLetters.size > batch.length) {
+            this.#logger.warn?.('[factory] babysitter dead-letter drain is rate limited', {
+                deadLettered: this.#babysitterPrSnapshotDeadLetters.size,
+                retryingThisSweep: batch.length,
+            });
+        }
+        for (const path of batch) {
+            if (this.#stopping)
+                return;
+            this.#increment('babysitterPrSnapshotDeadLettersRetried');
+            // #handlePrChange clears the entry itself on a successful read and
+            // re-records the failure (bumping `failures`, escalating the log) if the
+            // mount is still faulted, so the whole retry contract lives in one place.
+            await this.#handlePrChange(path);
+        }
+    }
+    async #adoptOrphanedBabysitterPrs() {
+        const batch = await this.#batch();
+        for (const record of batch.inFlight) {
+            if (this.#stopping)
+                return;
+            if (record.dryRun || this.#hasBabysitterForIssue(record.issue))
+                continue;
+            if (!await this.#assertIssueDispatchLifecycleOwner(record.issue))
+                continue;
+            this.#increment('babysitterOrphanCandidatesScanned');
+            try {
+                for (const path of await this.#orphanedPrMetaPaths(record)) {
+                    if (this.#stopping || this.#hasBabysitterForIssue(record.issue))
+                        break;
+                    // Replay the PR meta through the normal PR-open handler rather than
+                    // spawning directly. Adoption must be subject to exactly the same
+                    // ownership, weak-match and path/payload-identity guards as a live
+                    // PR-open event — a reconcile sweep is a second delivery of a missed
+                    // event, never a way around the checks that event would have faced.
+                    await this.#handlePrChange(path);
+                }
+            }
+            catch (error) {
+                this.#increment('babysitterOrphanAdoptionErrors');
+                this.#logger.warn?.('[factory] babysitter orphan adoption failed', {
+                    issue: record.issue.key,
+                    error: describeError(error).errorMessage,
+                });
+                continue;
+            }
+            if (!this.#hasBabysitterForIssue(record.issue))
+                continue;
+            this.#increment('babysitterOrphanedPrsAdopted');
+            this.#logger.warn?.('[factory] adopted an orphaned PR that no babysitter owned', {
+                issue: record.issue.key,
+                ...this.#babysitterPrForIssue(record.issue),
+            });
+        }
+    }
+    // Candidate PR meta paths for an ownerless record, newest PR first. Resolution
+    // reuses the durable dispatch receipts and then the probe resolver (which
+    // carries its own gh backoff, so a record whose implementer has not opened a
+    // PR yet costs no more than a cached miss).
+    async #orphanedPrMetaPaths(record) {
+        const wanted = [];
+        if (this.#usesDurableDispatchLifecycle()) {
+            const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+            const receipts = lifecycle?.pullRequests ?? (lifecycle?.pullRequest ? [lifecycle.pullRequest] : []);
+            for (const receipt of receipts)
+                wanted.push({ repo: receipt.repo, prNumber: receipt.number });
+        }
+        if (wanted.length === 0) {
+            const issue = await this.#readIssue(record.issue.path);
+            const pr = issue ? await this.#openPrForIssue(issue) : undefined;
+            if (pr)
+                wanted.push({ repo: pr.repo, prNumber: pr.prNumber });
+        }
+        const paths = [];
+        for (const { repo, prNumber } of wanted) {
+            for (const root of githubPullRoots(repo)) {
+                let candidates;
+                try {
+                    candidates = await this.#mount.listTree(root);
+                }
+                catch {
+                    continue;
+                }
+                const match = candidates.find((path) => {
+                    const parts = githubPullPathParts(path);
+                    return parts?.number === prNumber &&
+                        `${parts.owner}/${parts.repo}`.toLowerCase() === repo.toLowerCase();
+                });
+                if (match && !paths.includes(match)) {
+                    paths.push(match);
+                    break;
+                }
+            }
+        }
+        if (paths.length === 0 && wanted.length > 0) {
+            // The PR exists but its meta has not materialized in the mount yet. Leave
+            // it for the next sweep rather than spawning off an unvalidated receipt.
+            this.#increment('babysitterOrphanPrMetaUnavailable');
+        }
+        return paths;
+    }
+    #hasBabysitterForIssue(issue) {
+        return this.#babysitterPrForIssue(issue) !== undefined;
+    }
+    #babysitterPrForIssue(issue) {
+        const wanted = issueKey(issue);
+        for (const [key, ref] of this.#babysitterPr) {
+            // Ownership keys are composite (issue + PR), so resolve the issue the same
+            // way #babysitterOwnerFor does: the recorded ref, else the key itself for
+            // the legacy issue-keyed form. Never fall back to the issue being tested,
+            // which would make every entry match.
+            const owningIssue = this.#babysitterIssueRefs.get(key);
+            if ((owningIssue ? issueKey(owningIssue) : key) !== wanted)
+                continue;
+            // An empty agentName is the pre-spawn reservation #ensureBabysitter takes
+            // before its first await; that is ownership in progress, not an orphan.
+            return { repo: ref.repo, prNumber: ref.prNumber };
+        }
+        return undefined;
+    }
+    // The two counters that mark a PR losing its shepherd are otherwise only
+    // visible by diffing `status().counters`. Report the deltas so the condition
+    // reaches an operator reading logs at default level.
+    #reportBabysitterOrphanHealth() {
+        const readFailures = this.#counters.babysitterPrSnapshotReadFailures ?? 0;
+        const unownedEvents = this.#counters.babysitterEventsIgnoredUnownedPr ?? 0;
+        const newReadFailures = readFailures - this.#babysitterOrphanReportedFailures;
+        const newUnownedEvents = unownedEvents - this.#babysitterOrphanReportedUnowned;
+        const deadLettered = this.#babysitterPrSnapshotDeadLetters.size;
+        this.#counters.babysitterPrSnapshotDeadLetterDepth = deadLettered;
+        if (newReadFailures <= 0 && newUnownedEvents <= 0 && deadLettered === 0) {
+            return;
+        }
+        this.#babysitterOrphanReportedFailures = readFailures;
+        this.#babysitterOrphanReportedUnowned = unownedEvents;
+        // The oldest stuck entry is what an operator needs to act on: it names the
+        // PR and how long it has been unshepherded.
+        let oldest;
+        for (const [path, entry] of this.#babysitterPrSnapshotDeadLetters) {
+            if (!oldest || entry.firstFailedAtMs < oldest.entry.firstFailedAtMs)
+                oldest = { path, entry };
+        }
+        this.#logger.warn?.('[factory] babysitter PR routing is dropping work', {
+            prSnapshotReadFailures: readFailures,
+            newPrSnapshotReadFailures: Math.max(0, newReadFailures),
+            unownedPrEventsIgnored: unownedEvents,
+            newUnownedPrEventsIgnored: Math.max(0, newUnownedEvents),
+            deadLetteredPrSnapshots: deadLettered,
+            flatEventsUnreadable: this.#counters.babysitterFlatEventsUnreadable ?? 0,
+            orphanedPrsAdopted: this.#counters.babysitterOrphanedPrsAdopted ?? 0,
+            ...(oldest
+                ? {
+                    oldestDeadLetterPath: oldest.path,
+                    oldestDeadLetterError: oldest.entry.lastErrorMessage,
+                    oldestDeadLetterAgeMs: Math.max(0, this.#clock.now() - oldest.entry.firstFailedAtMs),
+                }
+                : {}),
+        });
+    }
     async #completionPrForIssue(issue) {
         if (this.#customProbePrResolver) {
             return this.#probePrResolver(issue);
@@ -1426,7 +1776,7 @@ export class FactoryLoop {
         if (cached && cached.expiresAtMs > now) {
             return cached.pr;
         }
-        const mountPr = await resolveIssuePrFromMount(this.#mount, this.#config, issue, opts);
+        const mountPr = await resolveIssuePrFromMount(this.#mount, this.#config, issue, opts, (prefix) => this.#listRelayfileTree(prefix, 'PR probe resolution'));
         if (mountPr) {
             return mountPr;
         }
@@ -1449,6 +1799,158 @@ export class FactoryLoop {
         return undefined;
     }
     async runOnce(opts = {}) {
+        const dryRun = opts.dryRun ?? this.#config.dryRun;
+        // Loop rather than a single check-then-wait: while this call was waiting
+        // out a mismatched sweep, another mismatched caller may have raced it to
+        // start the *next* sweep first — in which case that one might match us
+        // and we should coalesce onto it rather than starting a third.
+        for (;;) {
+            if (this.#runOnceInFlight && this.#runOnceInFlightDryRun === dryRun) {
+                this.#increment('discoverySweepsCoalesced');
+                this.#logger.info?.('[factory] coalesced overlapping discovery request into the in-flight sweep');
+                return await this.#runOnceInFlight;
+            }
+            // A mismatched dryRun cannot coalesce onto the in-flight sweep (it
+            // would hand a live caller a dry-run report, or vice versa), but it
+            // still must not race it — wait for it to settle before either
+            // re-checking for a newly-started matching sweep or claiming the lease.
+            if (!this.#runOnceInFlight)
+                break;
+            await this.#runOnceInFlight.catch(() => undefined);
+        }
+        const sweep = this.#runOnceWithDiscoveryFence({ dryRun });
+        this.#runOnceInFlight = sweep;
+        this.#runOnceInFlightDryRun = dryRun;
+        try {
+            return await sweep;
+        }
+        finally {
+            if (this.#runOnceInFlight === sweep) {
+                this.#runOnceInFlight = undefined;
+                this.#runOnceInFlightDryRun = undefined;
+            }
+        }
+    }
+    async #runOnceWithDiscoveryFence(opts) {
+        const sweepStartedAtMs = this.#clock.now();
+        let claim = await this.#state.claimDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, this.#clock.now(), DISCOVERY_SWEEP_LEASE_MS);
+        if (!claim.acquired && claim.reason === 'backoff') {
+            const delayMs = Math.max(0, claim.state.backoffUntilMs - this.#clock.now());
+            this.#increment('discoveryBackoffWaits');
+            this.#logger.warn?.('[factory] discovery sweep waiting for Relayfile overload backoff', {
+                delayMs,
+                backoffUntilMs: claim.state.backoffUntilMs,
+                consecutiveOverloads: claim.state.consecutiveOverloads,
+            });
+            await this.#clock.sleep(delayMs);
+            claim = await this.#state.claimDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, this.#clock.now(), DISCOVERY_SWEEP_LEASE_MS);
+        }
+        if (!claim.acquired || !claim.lease) {
+            this.#increment('discoverySweepsSkippedInFlight');
+            this.#logger.info?.('[factory] skipped discovery because another process owns the sweep lease', {
+                owner: claim.state.lease?.owner,
+                epoch: claim.state.lease?.epoch,
+                leaseUntilMs: claim.state.lease?.leaseUntilMs,
+            });
+            return {
+                pulled: [],
+                triaged: [],
+                dispatched: [],
+                skipped: [],
+                dryRun: opts.dryRun ?? this.#config.dryRun,
+                discoveryDeferred: 'sweep-in-flight',
+            };
+        }
+        if (claim.reclaimedLease) {
+            this.#increment('discoverySweepOrphanTakeovers');
+            this.#logger.warn?.('[factory] reclaimed discovery sweep lease from a stopped process', {
+                owner: claim.lease.owner,
+                epoch: claim.lease.epoch,
+                previousOwner: claim.reclaimedLease.owner,
+                previousEpoch: claim.reclaimedLease.epoch,
+                previousLeaseUntilMs: claim.reclaimedLease.leaseUntilMs,
+            });
+        }
+        this.#logger.info?.('[factory] discovery sweep lease claimed', {
+            owner: claim.lease.owner,
+            epoch: claim.lease.epoch,
+            leaseUntilMs: claim.lease.leaseUntilMs,
+        });
+        this.#discoverySweepEpoch = claim.lease.epoch;
+        this.#discoverySweepStartedAtMs = sweepStartedAtMs;
+        this.#discoverySweepLeaseLost = false;
+        this.#discoveryOverloadError = undefined;
+        this.#startDiscoverySweepRenewal(claim.lease.epoch);
+        let leaseReleased = false;
+        try {
+            this.#discoverySession = await this.#prepareDiscoverySession(claim);
+            const report = await this.#performRunOnce(opts);
+            if (this.#discoveryOverloadError)
+                throw this.#discoveryOverloadError;
+            const checkpoint = await this.#finalizeDiscoveryCheckpoint();
+            // Do not clear the durable lease while a renewal can still be waiting on
+            // the same state-file lock. A late renewal that observes the completed
+            // (lease-less) checkpoint is a false lease-loss signal and can poison an
+            // otherwise successful reconcile cycle.
+            await this.#stopDiscoverySweepRenewal();
+            if (this.#discoverySweepLeaseLost) {
+                throw new Error('discovery sweep lease was lost before checkpoint commit');
+            }
+            const completed = await this.#state.completeDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, claim.lease.epoch, checkpoint);
+            leaseReleased = completed;
+            if (!completed)
+                throw new Error('discovery sweep lease was lost before completion');
+            this.#logger.info?.('[factory] discovery sweep checkpoint committed', {
+                owner: claim.lease.owner,
+                epoch: claim.lease.epoch,
+                durationMs: this.#elapsedSince(sweepStartedAtMs),
+                checkpointUpdatedAtMs: checkpoint?.updatedAtMs,
+            });
+            return report;
+        }
+        catch (error) {
+            await this.#stopDiscoverySweepRenewal();
+            const overload = relayfileOverload(error);
+            if (overload) {
+                const consecutiveOverloads = claim.state.consecutiveOverloads + 1;
+                const delayMs = discoveryOverloadBackoffMs(overload.retryAfterSeconds, consecutiveOverloads);
+                const backoffUntilMs = this.#clock.now() + delayMs;
+                leaseReleased = await this.#state.deferDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, claim.lease.epoch, backoffUntilMs, consecutiveOverloads);
+                this.#increment('discoveryOverloadBackoffs');
+                this.#logger.warn?.('[factory] Relayfile discovery overloaded; backing off before another sweep', {
+                    status: overload.status,
+                    reason: overload.reason,
+                    retryAfterSeconds: overload.retryAfterSeconds,
+                    delayMs,
+                    backoffUntilMs,
+                    consecutiveOverloads,
+                });
+                // backoffUntilMs is already durable via deferDiscoverySweep, and the
+                // next runOnce() honors it at the pre-claim wait above — sleeping
+                // here too would additionally block this failing call (and every
+                // caller coalesced onto it) for up to the full backoff window while
+                // still holding the coalescing slot.
+            }
+            throw error;
+        }
+        finally {
+            await this.#stopDiscoverySweepRenewal();
+            this.#discoverySession = undefined;
+            this.#discoverySweepEpoch = undefined;
+            this.#discoverySweepStartedAtMs = undefined;
+            this.#discoveryOverloadError = undefined;
+            // This sweep is over either way (committed, deferred, or lease lost) —
+            // a stale `true` here would otherwise make every #listRelayfileTree
+            // call outside a fresh claim (Slack lookups, PR confirmation, the
+            // merge-advance scan) throw "lease was lost" until the next sweep
+            // happens to run and reset it at the top of this method.
+            this.#discoverySweepLeaseLost = false;
+            if (!leaseReleased) {
+                await this.#state.releaseDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, claim.lease.epoch);
+            }
+        }
+    }
+    async #performRunOnce(opts = {}) {
         const dryRun = opts.dryRun ?? this.#config.dryRun;
         const startedAtMs = this.#clock.now();
         const relayfileWaitWarningsAtStart = this.#counters.relayfileOperationWaitWarnings ?? 0;
@@ -1479,6 +1981,14 @@ export class FactoryLoop {
             const triaged = [];
             const dispatched = [];
             const skipped = [];
+            const recordSkip = (entry) => {
+                skipped.push(entry);
+                this.#logger.info?.('[factory] readiness reconciliation skipped dispatch', {
+                    issue: entry.issue.key,
+                    path: entry.issue.path,
+                    reason: entry.reason,
+                });
+            };
             let lastReadyReadProgressAtMs = this.#clock.now();
             let readyIssueReads = 0;
             const issueEntries = [];
@@ -1523,7 +2033,6 @@ export class FactoryLoop {
                 const mayRecoverGithubOrphan = !wasReady &&
                     !dryRun &&
                     issueSource === 'github' &&
-                    Boolean(orphanRecovery) &&
                     Boolean(requiredLabel) &&
                     Boolean(labels?.has(requiredLabel)) &&
                     Boolean(labels?.has('factory:in-progress')) &&
@@ -1531,26 +2040,31 @@ export class FactoryLoop {
                 if (!mayRecoverGithubOrphan) {
                     const dispatchBlock = await this.#dispatchBlockReason(issue);
                     if (dispatchBlock) {
-                        skipped.push({ issue: issueRef(issue), reason: dispatchBlock });
+                        recordSkip({ issue: issueRef(issue), reason: dispatchBlock });
                         continue;
                     }
                 }
+                const orphanResult = mayRecoverGithubOrphan
+                    ? await this.#reconcileOrphanedGithubInProgress(issue, orphanRecovery, dryRun)
+                    : { recovered: false };
+                const recoveredOrphan = orphanResult.recovered;
                 const batch = await this.#batch();
                 if (batch.isInFlight(issue) || batch.isQueued(issue)) {
-                    skipped.push({ issue: issueRef(issue), reason: 'already tracked' });
+                    recordSkip({ issue: issueRef(issue), reason: orphanResult.reason ?? 'already tracked' });
                     continue;
                 }
-                const recoveredOrphan = mayRecoverGithubOrphan &&
-                    await this.#reconcileOrphanedGithubInProgress(issue, orphanRecovery, dryRun);
                 if (!wasReady && !recoveredOrphan) {
                     if (mayRecoverGithubOrphan) {
                         const dispatchBlock = await this.#dispatchBlockReason(issue);
                         if (dispatchBlock) {
-                            skipped.push({ issue: issueRef(issue), reason: dispatchBlock });
+                            recordSkip({ issue: issueRef(issue), reason: dispatchBlock });
                             continue;
                         }
                     }
-                    skipped.push({ issue: issueRef(issue), reason: 'live state is not ready-for-agent' });
+                    recordSkip({
+                        issue: issueRef(issue),
+                        reason: orphanResult.reason ?? 'live state is not ready-for-agent',
+                    });
                     continue;
                 }
                 const recoveredIdentity = recoveredOrphan ? githubIssueRefIdentity(issueRef(issue)) : undefined;
@@ -1558,16 +2072,16 @@ export class FactoryLoop {
                     if (recoveredOrphan) {
                         const dispatchBlock = await this.#dispatchBlockReason(issue);
                         if (dispatchBlock) {
-                            skipped.push({ issue: issueRef(issue), reason: dispatchBlock });
+                            recordSkip({ issue: issueRef(issue), reason: dispatchBlock });
                             continue;
                         }
                     }
                     if (!isInFactoryScope(issue, this.#config.safety)) {
-                        skipped.push({ issue: issueRef(issue), reason: 'not factory-e2e scope' });
+                        recordSkip({ issue: issueRef(issue), reason: 'not factory-e2e scope' });
                         continue;
                     }
                     if (!isDispatchableIssue(issue)) {
-                        skipped.push({ issue: issueRef(issue), reason: 'not reconciled real Linear issue' });
+                        recordSkip({ issue: issueRef(issue), reason: 'not reconciled real Linear issue' });
                         continue;
                     }
                     const decision = await this.triageIssue(issue);
@@ -1579,7 +2093,7 @@ export class FactoryLoop {
                     catch (error) {
                         if (!(error instanceof LiveDispatchStateChangedError))
                             throw error;
-                        skipped.push({ issue: decision.issue, reason: 'live state changed during dispatch' });
+                        recordSkip({ issue: decision.issue, reason: 'live state changed during dispatch' });
                         this.#logger.info?.('[factory] skipped issue whose live state changed during dispatch', {
                             issue: decision.issue.key,
                         });
@@ -1591,7 +2105,7 @@ export class FactoryLoop {
                             : result.hold?.kind === 'dependency'
                                 ? `parked on dependencies: ${result.hold.blockers?.join(', ') ?? 'unresolved dependency'}`
                                 : 'queued or escalated';
-                        skipped.push({ issue: decision.issue, reason });
+                        recordSkip({ issue: decision.issue, reason });
                     }
                     else {
                         dispatched.push(result);
@@ -1630,6 +2144,257 @@ export class FactoryLoop {
             }
         }
     }
+    #startDiscoverySweepRenewal(epoch) {
+        this.#discoverySweepRenewTimer = setInterval(() => {
+            if (this.#discoverySweepRenewalInFlight || this.#discoverySweepLeaseLost)
+                return;
+            const renewal = this.#renewDiscoverySweepLease(epoch);
+            this.#discoverySweepRenewalInFlight = renewal;
+            void renewal.finally(() => {
+                if (this.#discoverySweepRenewalInFlight === renewal) {
+                    this.#discoverySweepRenewalInFlight = undefined;
+                }
+            });
+        }, DISCOVERY_SWEEP_RENEW_MS);
+        this.#discoverySweepRenewTimer.unref?.();
+    }
+    async #renewDiscoverySweepLease(epoch) {
+        const requestedAtMs = this.#clock.now();
+        try {
+            let renewal;
+            if (this.#state.renewDiscoverySweepWithDetails) {
+                renewal = await this.#state.renewDiscoverySweepWithDetails(this.#workspaceId, this.#discoverySweepOwner, epoch, requestedAtMs, DISCOVERY_SWEEP_LEASE_MS);
+            }
+            else {
+                const renewed = await this.#state.renewDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, epoch, requestedAtMs, DISCOVERY_SWEEP_LEASE_MS);
+                renewal = renewed
+                    ? {
+                        renewed: true,
+                        lease: {
+                            owner: this.#discoverySweepOwner,
+                            epoch,
+                            leaseUntilMs: requestedAtMs + DISCOVERY_SWEEP_LEASE_MS,
+                        },
+                    }
+                    : { renewed: false, reason: 'unknown' };
+            }
+            if (!renewal.renewed && this.#discoverySweepEpoch === epoch) {
+                this.#discoverySweepLeaseLost = true;
+                this.#increment('discoverySweepLeaseLosses');
+                this.#logger.warn?.('[factory] discovery sweep lease renewal was rejected; fencing further tree requests', {
+                    reason: renewal.reason,
+                    requestedOwner: this.#discoverySweepOwner,
+                    requestedEpoch: epoch,
+                    requestedAtMs,
+                    elapsedMs: this.#elapsedSince(this.#discoverySweepStartedAtMs ?? requestedAtMs),
+                    observedOwner: renewal.observedLease?.owner,
+                    observedEpoch: renewal.observedLease?.epoch,
+                    observedLeaseUntilMs: renewal.observedLease?.leaseUntilMs,
+                });
+            }
+        }
+        catch (error) {
+            this.#logger.warn?.('[factory] discovery sweep lease renewal failed; retaining the current lease window', {
+                owner: this.#discoverySweepOwner,
+                epoch,
+                requestedAtMs,
+                error: describeError(error).errorMessage,
+            });
+        }
+    }
+    async #stopDiscoverySweepRenewal() {
+        if (this.#discoverySweepRenewTimer)
+            clearInterval(this.#discoverySweepRenewTimer);
+        this.#discoverySweepRenewTimer = undefined;
+        await this.#discoverySweepRenewalInFlight;
+    }
+    async #prepareDiscoverySession(claim) {
+        const checkpoint = structuredClone(claim.state.checkpoint ?? {
+            trees: {},
+            updatedAtMs: 0,
+        });
+        const watermark = await this.#discoveryHighWatermark();
+        if (!watermark.available) {
+            this.#increment('discoveryIncrementalUnavailable');
+            return {
+                checkpoint,
+                mode: 'full',
+                highWatermarkAvailable: false,
+                listedPrefixes: new Set(),
+            };
+        }
+        if (claim.state.checkpoint) {
+            if (watermark.highWatermark === checkpoint.highWatermark) {
+                this.#increment('discoveryIncrementalUnchangedSweeps');
+                this.#logger.info?.('[factory] discovery checkpoint unchanged; reusing cached issue trees', {
+                    highWatermark: watermark.highWatermark,
+                    cachedPrefixes: Object.keys(checkpoint.trees).length,
+                });
+                return {
+                    checkpoint,
+                    mode: 'incremental',
+                    highWatermarkAvailable: true,
+                    observedHighWatermark: watermark.highWatermark,
+                    listedPrefixes: new Set(),
+                };
+            }
+            const changes = await this.#discoveryEventsSince(checkpoint.highWatermark, watermark.highWatermark);
+            if (changes) {
+                this.#applyDiscoveryEvents(checkpoint, changes);
+                this.#increment('discoveryIncrementalChangedSweeps');
+                this.#logger.info?.('[factory] updated discovery checkpoint from Relayfile changes', {
+                    previousHighWatermark: checkpoint.highWatermark,
+                    highWatermark: watermark.highWatermark,
+                    changes: changes.length,
+                    cachedPrefixes: Object.keys(checkpoint.trees).length,
+                });
+                return {
+                    checkpoint,
+                    mode: 'incremental',
+                    highWatermarkAvailable: true,
+                    observedHighWatermark: watermark.highWatermark,
+                    listedPrefixes: new Set(),
+                };
+            }
+            this.#increment('discoveryIncrementalGapFallbacks');
+            this.#logger.warn?.('[factory] discovery change window did not cover the prior checkpoint; refreshing tree prefixes once', {
+                previousHighWatermark: checkpoint.highWatermark,
+                highWatermark: watermark.highWatermark,
+            });
+        }
+        // A missing change window means no retained prefix can be trusted. Start
+        // the fallback snapshot empty so prefixes not touched by the current
+        // configuration cannot resurface later with stale membership.
+        checkpoint.trees = {};
+        return {
+            checkpoint,
+            mode: 'full',
+            highWatermarkAvailable: true,
+            observedHighWatermark: watermark.highWatermark,
+            listedPrefixes: new Set(),
+        };
+    }
+    async #finalizeDiscoveryCheckpoint() {
+        const session = this.#discoverySession;
+        if (!session?.highWatermarkAvailable)
+            return undefined;
+        const watermark = await this.#discoveryHighWatermark();
+        if (!watermark.available)
+            return undefined;
+        if (watermark.highWatermark !== session.observedHighWatermark) {
+            const changes = await this.#discoveryEventsSince(session.observedHighWatermark, watermark.highWatermark);
+            if (!changes) {
+                this.#increment('discoveryCheckpointCommitGaps');
+                this.#logger.warn?.('[factory] discovery checkpoint not saved because its change window overflowed during the sweep');
+                return undefined;
+            }
+            this.#applyDiscoveryEvents(session.checkpoint, changes);
+        }
+        session.checkpoint.highWatermark = watermark.highWatermark;
+        session.checkpoint.updatedAtMs = this.#clock.now();
+        for (const [prefix, paths] of Object.entries(session.checkpoint.trees)) {
+            session.checkpoint.trees[prefix] = [...new Set(paths)].sort();
+        }
+        return structuredClone(session.checkpoint);
+    }
+    async #discoveryHighWatermark() {
+        if (!this.#mount.getEventHighWatermark)
+            return { available: false };
+        try {
+            const highWatermark = await this.#mount.getEventHighWatermark();
+            // `undefined` also means that an older Relayfile client cannot expose a
+            // watermark. Treat it as unavailable so a compatibility fallback never
+            // turns into an indefinitely stale cache.
+            return highWatermark === undefined
+                ? { available: false }
+                : { available: true, highWatermark };
+        }
+        catch (error) {
+            if (relayfileOverload(error))
+                throw error;
+            this.#increment('discoveryHighWatermarkFailures');
+            this.#logger.warn?.('[factory] discovery high-watermark unavailable; using a full sweep without caching', {
+                error: describeError(error).errorMessage,
+            });
+            return { available: false };
+        }
+    }
+    async #discoveryEventsSince(previousHighWatermark, currentHighWatermark) {
+        if (previousHighWatermark === currentHighWatermark)
+            return [];
+        if (!currentHighWatermark)
+            return undefined;
+        let events;
+        try {
+            const page = await this.#mount.getEvents({
+                last: DISCOVERY_CHANGE_EVENT_LIMIT,
+                limit: DISCOVERY_CHANGE_EVENT_LIMIT,
+            });
+            events = [...page.events].sort(compareDiscoveryEvents);
+        }
+        catch (error) {
+            if (relayfileOverload(error))
+                throw error;
+            this.#logger.warn?.('[factory] discovery change feed unavailable; refreshing tree prefixes once', {
+                error: describeError(error).errorMessage,
+            });
+            return undefined;
+        }
+        const currentIndex = events.findIndex((event) => discoveryEventId(event) === currentHighWatermark);
+        if (currentIndex < 0)
+            return undefined;
+        if (previousHighWatermark === undefined) {
+            return events.length < DISCOVERY_CHANGE_EVENT_LIMIT
+                ? events.slice(0, currentIndex + 1)
+                : undefined;
+        }
+        const previousIndex = events.findIndex((event) => discoveryEventId(event) === previousHighWatermark);
+        if (previousIndex >= 0 && previousIndex <= currentIndex) {
+            return events.slice(previousIndex + 1, currentIndex + 1);
+        }
+        const previousSequence = eventSequenceNumber(previousHighWatermark);
+        const currentSequence = eventSequenceNumber(currentHighWatermark);
+        const sequenced = events.map((event) => ({ event, sequence: eventSequenceNumber(discoveryEventId(event) ?? '') }));
+        if (previousSequence !== undefined &&
+            currentSequence !== undefined &&
+            sequenced.every((entry) => entry.sequence !== undefined) &&
+            sequenced.some((entry) => entry.sequence <= previousSequence)) {
+            return sequenced
+                .filter((entry) => entry.sequence > previousSequence && entry.sequence <= currentSequence)
+                .map((entry) => entry.event);
+        }
+        return undefined;
+    }
+    #applyDiscoveryEvents(checkpoint, events) {
+        for (const event of events) {
+            const path = changeEventPath(event);
+            if (!path)
+                continue;
+            const deletion = discoveryEventIsDeletion(event);
+            const indexRepoRoots = githubIssueIndexRepoRoots(path);
+            for (const [prefix, cachedPaths] of Object.entries(checkpoint.trees)) {
+                if (indexRepoRoots.some((root) => prefix === root || prefix.startsWith(`${root}/`))) {
+                    delete checkpoint.trees[prefix];
+                    continue;
+                }
+                // A plain startsWith would let `/…/issues-archive/…` match the
+                // cached prefix `/…/issues`, folding an unrelated path into it.
+                if (path !== prefix && !path.startsWith(prefix.endsWith('/') ? prefix : `${prefix}/`))
+                    continue;
+                const paths = new Set(cachedPaths);
+                if (deletion) {
+                    for (const candidate of paths) {
+                        if (candidate === path || candidate.startsWith(`${path}/`))
+                            paths.delete(candidate);
+                    }
+                }
+                else {
+                    paths.add(path);
+                }
+                checkpoint.trees[prefix] = [...paths];
+            }
+        }
+    }
     async #githubOrphanRecoveryContext() {
         try {
             const [registry, roster, lifecycles, waitingClarifications] = await Promise.all([
@@ -1641,18 +2406,42 @@ export class FactoryLoop {
             const onlineAgents = new Set(roster.agents.map((agent) => agent.name));
             const activeIssueIdentities = new Set();
             const legacyUnownedAgentsByIssue = new Map();
-            for (const [, lifecycle] of lifecycles) {
-                if (isTerminalDispatchLifecycle(lifecycle))
-                    continue;
-                const identity = githubIssueRefIdentity(lifecycle.issue);
-                if (identity)
-                    activeIssueIdentities.add(identity);
-            }
+            const orphanedLifecycleClaimsByIssue = new Map();
             for (const [, waiting] of waitingClarifications) {
                 const identity = githubIssueRefIdentity(waiting.issue);
                 if (identity)
                     activeIssueIdentities.add(identity);
             }
+            for (const [key, lifecycle] of lifecycles) {
+                const identity = githubIssueRefIdentity(lifecycle.issue);
+                if (!identity)
+                    continue;
+                if (isTerminalDispatchLifecycle(lifecycle)) {
+                    if (!activeIssueIdentities.has(identity)) {
+                        orphanedLifecycleClaimsByIssue.set(identity, { key, lifecycle });
+                    }
+                    continue;
+                }
+                const activeAgents = lifecycle.agents.filter((agent) => agent.releasedAtMs === undefined);
+                const hasLiveAgent = activeAgents.some((agent) => onlineAgents.has(agent.name));
+                const exitRecoveryActive = activeAgents.some((agent) => this.#agentExitsInFlight.has(agent.name));
+                const dispatchCallActive = this.#dispatchInFlight.has(issueKey(lifecycle.issue));
+                // The provider's `factory:in-progress` transition happens immediately
+                // before the durable lifecycle advances from dispatching to running.
+                // A crash can therefore leave any nonterminal phase behind while the
+                // external claim survives. The caller still verifies provider status,
+                // open-PR absence, a second roster, and the lifecycle lease before it
+                // releases this orphan-shaped row.
+                if (!activeIssueIdentities.has(identity) &&
+                    !hasLiveAgent &&
+                    !exitRecoveryActive &&
+                    !dispatchCallActive) {
+                    orphanedLifecycleClaimsByIssue.set(identity, { key, lifecycle });
+                }
+                else {
+                    activeIssueIdentities.add(identity);
+                }
+            }
             for (const agent of registry?.agents ?? []) {
                 if (!onlineAgents.has(agent.name) || !agent.issue)
                     continue;
@@ -1677,6 +2466,7 @@ export class FactoryLoop {
                 activeIssueIdentities,
                 onlineAgentNames: onlineAgents,
                 legacyUnownedAgentsByIssue,
+                orphanedLifecycleClaimsByIssue,
             };
         }
         catch (error) {
@@ -1688,15 +2478,19 @@ export class FactoryLoop {
         }
     }
     async #reconcileOrphanedGithubInProgress(issue, context, dryRun) {
-        if (dryRun || !context || !isGithubIssue(issue))
-            return false;
+        if (dryRun)
+            return { recovered: false, reason: 'dry run does not release an in-progress claim' };
+        if (!context)
+            return { recovered: false, reason: 'orphan-recovery safety context is unavailable' };
+        if (!isGithubIssue(issue))
+            return { recovered: false, reason: 'issue is not GitHub-native' };
         const labels = new Set(issue.labels.map((label) => label.trim().toLowerCase()));
         const required = this.#config.safety.requireLabel.trim().toLowerCase();
         if (!required ||
             !labels.has(required) ||
             !labels.has('factory:in-progress') ||
             labels.has('factory:human-review'))
-            return false;
+            return { recovered: false, reason: 'issue is not an orphan-recovery candidate' };
         const identity = githubIssueRefIdentity(issueRef(issue));
         const legacyUnownedAgents = identity
             ? (context.legacyUnownedAgentsByIssue.get(identity) ?? [])
@@ -1707,12 +2501,12 @@ export class FactoryLoop {
             context.activeIssueIdentities.has(identity) ||
             [...context.onlineAgentNames].some((name) => githubAgentNameMatchesIssue(name, issue) && !legacyUnownedAgentNames.has(name))) {
             this.#increment('githubOrphanRecoveriesBlockedActive');
-            return false;
+            return { recovered: false, reason: 'active dispatch claim or live agent still owns the issue' };
         }
         const getProviderStatus = this.#githubWriteback.getIssueStatus;
         if (!getProviderStatus) {
             this.#increment('githubOrphanRecoveryStatusLookupUnavailable');
-            return false;
+            return { recovered: false, reason: 'provider-authoritative issue status lookup is unavailable' };
         }
         let providerStatus;
         try {
@@ -1724,11 +2518,16 @@ export class FactoryLoop {
                 issue: issue.key,
                 error: describeError(error).errorMessage,
             });
-            return false;
+            return { recovered: false, reason: 'provider-authoritative issue status could not be verified' };
         }
         if (!providerStatus || providerStatus === 'human-review') {
             this.#increment('githubOrphanRecoveriesBlockedProviderStatus');
-            return false;
+            return {
+                recovered: false,
+                reason: providerStatus === 'human-review'
+                    ? 'provider-authoritative issue status is human-review'
+                    : 'provider-authoritative issue status is unavailable',
+            };
         }
         let openPr;
         try {
@@ -1740,7 +2539,7 @@ export class FactoryLoop {
                 issue: issue.key,
                 error: describeError(error).errorMessage,
             });
-            return false;
+            return { recovered: false, reason: 'matching open-PR absence could not be verified' };
         }
         if (openPr) {
             let adopted = false;
@@ -1764,7 +2563,12 @@ export class FactoryLoop {
                 repo: openPr.repo,
                 prNumber: openPr.prNumber,
             });
-            return false;
+            return {
+                recovered: false,
+                reason: adopted
+                    ? 'matching open PR was adopted'
+                    : 'matching open PR still owns the issue',
+            };
         }
         // A pre-durable local Factory may have left live, registry-proven workers
         // without a lifecycle record. They are safe to adopt only once their open
@@ -1772,7 +2576,11 @@ export class FactoryLoop {
         // and workers instead of redispatching duplicate agents.
         if (legacyUnownedAgents.length > 0) {
             this.#increment('githubOrphanRecoveriesBlockedActive');
-            return false;
+            return { recovered: false, reason: 'legacy registry-proven agents still own the issue' };
+        }
+        const lifecycleClaim = context.orphanedLifecycleClaimsByIssue.get(identity);
+        if (lifecycleClaim && !await this.#releaseOrphanedGithubLifecycle(issue, identity, lifecycleClaim)) {
+            return { recovered: false, reason: 'orphaned durable lifecycle claim could not be safely released' };
         }
         try {
             if (providerStatus === 'in-progress') {
@@ -1781,14 +2589,25 @@ export class FactoryLoop {
             // A crashed dispatch may leave its durable attempt marked in-flight even
             // after every agent and lifecycle disappeared. Only clear that stale bit
             // after all provider, agent, lifecycle, and open-PR safety checks pass.
-            await this.#clearDispatchInFlight(issue);
+            const attempt = await this.#state.getDispatchAttempts(this.#workspaceId, issueStateKey(issue));
+            if (attempt?.terminal) {
+                await this.#state.recordDispatchAttempt(this.#workspaceId, issueStateKey(issue), {
+                    attempts: 0,
+                    inFlight: false,
+                    terminal: false,
+                    backoffUntilMs: 0,
+                });
+            }
+            else {
+                await this.#clearDispatchInFlight(issue);
+            }
             this.#reconciledGithubInProgress.add(identity);
             this.#increment('githubOrphanedInProgressRecovered');
             this.#logger.warn?.('[factory] recovered orphaned GitHub in-progress issue for redispatch', {
                 issue: issue.key,
                 path: issue.path,
             });
-            return true;
+            return { recovered: true };
         }
         catch (error) {
             this.#increment('githubOrphanRecoveryWritebackFailures');
@@ -1796,6 +2615,116 @@ export class FactoryLoop {
                 issue: issue.key,
                 error: describeError(error).errorMessage,
             });
+            return { recovered: false, reason: 'orphaned provider lifecycle status could not be cleared' };
+        }
+    }
+    async #releaseOrphanedGithubLifecycle(issue, identity, candidate) {
+        let key = candidate.key;
+        let lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
+        if (!lifecycle)
+            return true;
+        if (lifecycle.runId !== candidate.lifecycle.runId ||
+            githubIssueRefIdentity(lifecycle.issue) !== identity) {
+            this.#logger.info?.('[factory] preserved orphan-shaped GitHub claim because its durable lifecycle changed', {
+                issue: issue.key,
+                lifecycleKey: key,
+            });
+            return false;
+        }
+        const activeAgents = lifecycle.agents.filter((agent) => agent.releasedAtMs === undefined);
+        const roster = await this.#fleet.roster();
+        const online = new Set(roster.agents.map((agent) => agent.name));
+        if (activeAgents.some((agent) => online.has(agent.name)) ||
+            roster.agents.some((agent) => githubAgentNameMatchesIssue(agent.name, issue))) {
+            this.#increment('githubOrphanRecoveriesBlockedActive');
+            return false;
+        }
+        let epoch;
+        if (!isTerminalDispatchLifecycle(lifecycle)) {
+            epoch = this.#dispatchLifecycleEpochs.get(key);
+            if (epoch !== undefined) {
+                const renewed = await this.#state.renewDispatchLifecycle(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch, this.#clock.now(), DISPATCH_LIFECYCLE_LEASE_MS);
+                if (!renewed) {
+                    this.#dispatchLifecycleEpochs.delete(key);
+                    return false;
+                }
+            }
+            else {
+                const claim = await this.#state.claimDispatchLifecycle(this.#workspaceId, key, lifecycle, this.#dispatchLifecycleOwner, this.#clock.now(), DISPATCH_LIFECYCLE_LEASE_MS);
+                if (!claim.acquired || !claim.lease) {
+                    this.#logger.info?.('[factory] preserved orphan-shaped GitHub claim because another publisher still owns its lease', {
+                        issue: issue.key,
+                        owner: claim.lifecycle.lease?.owner,
+                        leaseUntilMs: claim.lifecycle.lease?.leaseUntilMs,
+                    });
+                    return false;
+                }
+                key = claim.key ?? key;
+                lifecycle = claim.lifecycle;
+                epoch = claim.lease.epoch;
+                this.#dispatchLifecycleEpochs.set(key, epoch);
+            }
+        }
+        try {
+            for (const agent of lifecycle.agents.filter((entry) => entry.releasedAtMs === undefined)) {
+                try {
+                    await this.#fleet.release(agent.name, 'orphaned-claim');
+                }
+                catch (error) {
+                    // The roster was checked twice before fencing this lifecycle, so a
+                    // missing/dead worker is the expected crash-recovery shape. Do not
+                    // let a control-plane "agent not found" response make the durable
+                    // claim immortal; a failed fresh spawn remains visible to the normal
+                    // dispatch retry machinery.
+                    this.#increment('githubOrphanedLifecycleAgentReleaseFailures');
+                    this.#logger.warn?.('[factory] dead claim agent release failed; clearing fenced lifecycle anyway', {
+                        issue: issue.key,
+                        agent: agent.name,
+                        error: describeError(error).errorMessage,
+                    });
+                }
+                this.#fleet.markAgentTerminal?.(agent.name, 'orphaned-claim');
+            }
+            if (epoch !== undefined && !await this.#state.renewDispatchLifecycle(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch, this.#clock.now(), DISPATCH_LIFECYCLE_LEASE_MS)) {
+                this.#dispatchLifecycleEpochs.delete(key);
+                return false;
+            }
+            const retryTimer = this.#dispatchLifecycleRetryTimers.get(key);
+            if (retryTimer)
+                clearTimeout(retryTimer);
+            this.#dispatchLifecycleRetryTimers.delete(key);
+            const batch = await this.#batch();
+            batch.abandon(lifecycle.issue);
+            await this.#state.clearDispatchLifecycle(this.#workspaceId, key);
+            await this.#state.clearBabysitterSession(this.#workspaceId, issueKey(lifecycle.issue));
+            this.#dispatchLifecycleEpochs.delete(key);
+            this.#abandonedDispatchReasons.delete(key);
+            this.#resolveDispatchTerminalWaiters(lifecycle.issue);
+            await this.#writeInFlightRegistry().catch((error) => {
+                this.#logger.warn?.('[factory] failed to rewrite registry after orphaned claim release', {
+                    issue: issue.key,
+                    error: describeError(error).errorMessage,
+                });
+            });
+            this.#increment('githubOrphanedLifecycleClaimsReleased');
+            this.#logger.warn?.('[factory] released orphaned GitHub dispatch claim with no live agents', {
+                issue: issue.key,
+                lifecycleKey: key,
+                runId: lifecycle.runId,
+                agents: activeAgents.map((agent) => agent.name),
+            });
+            return true;
+        }
+        catch (error) {
+            if (epoch !== undefined) {
+                await this.#state.releaseDispatchLifecycleLease(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch).catch(() => undefined);
+                this.#dispatchLifecycleEpochs.delete(key);
+            }
+            this.#logger.warn?.('[factory] failed to release orphaned GitHub dispatch claim; preserving it', {
+                issue: issue.key,
+                lifecycleKey: key,
+                error: describeError(error).errorMessage,
+            });
             return false;
         }
     }
@@ -1954,13 +2883,60 @@ export class FactoryLoop {
         this.#increment('githubOrphanedPullRequestsAdopted');
         return true;
     }
-    async #listRelayfileTree(prefix, phase) {
-        return this.#withRelayfileOperation('listTree', { phase, prefix }, () => this.#mount.listTree(prefix), {
+    // `cache` is opt-in and must stay limited to call sites that walk a full
+    // repository/issue root to enumerate everything under it — the sweep this
+    // whole feature exists to make incremental. A cached listing can lag the
+    // live tree by up to one sweep, which is fine for enumeration but wrong
+    // for a point lookup that needs the current state: a PR-confirmation poll
+    // that expects a specific PR to appear, or an escalation/comment-replay
+    // scan that must not miss a marker or reply that landed after the cache
+    // was populated. Those callers must omit `cache` and pay for a fresh list.
+    async #listRelayfileTree(prefix, phase, opts = {}) {
+        if (this.#discoverySweepLeaseLost) {
+            throw new Error('discovery sweep lease was lost; refusing another tree request');
+        }
+        const cached = opts.cache ? this.#cachedDiscoveryTree(prefix) : undefined;
+        if (cached) {
+            this.#increment('discoveryTreeCacheHits');
+            this.#logger.debug?.('[factory] reused cached Relayfile tree', { phase, prefix, count: cached.length });
+            return cached;
+        }
+        if (opts.cache)
+            this.#increment('discoveryTreeCacheMisses');
+        const paths = await this.#withRelayfileOperation('listTree', { phase, prefix }, () => this.#mount.listTree(prefix), {
             count: (paths) => paths.length,
             logFailure: true,
             logStart: true,
             logComplete: true,
         });
+        if (opts.cache)
+            await this.#rememberDiscoveryTree(prefix, paths);
+        return paths;
+    }
+    #cachedDiscoveryTree(prefix) {
+        const session = this.#discoverySession;
+        if (!session)
+            return undefined;
+        if (session.mode === 'full' && !session.listedPrefixes.has(prefix))
+            return undefined;
+        const paths = session.checkpoint.trees[prefix];
+        return paths ? [...paths] : undefined;
+    }
+    async #rememberDiscoveryTree(prefix, paths) {
+        const session = this.#discoverySession;
+        if (!session)
+            return;
+        const uniquePaths = new Set();
+        for (let index = 0; index < paths.length; index += 1) {
+            uniquePaths.add(paths[index]);
+            if ((index + 1) % LIVE_EVENT_DRAIN_BATCH_SIZE === 0) {
+                await this.#refreshLiveHeartbeatIfDue();
+                if (index + 1 < paths.length)
+                    await liveEventYield();
+            }
+        }
+        session.checkpoint.trees[prefix] = [...uniquePaths].sort();
+        session.listedPrefixes.add(prefix);
     }
     async #ensureRelayfileSubRoot(prefix, phase, opts) {
         return this.#withRelayfileOperation('ensureSubRoot', { phase, prefix }, () => this.#mount.ensureSubRoot(prefix, opts), {
@@ -2013,6 +2989,9 @@ export class FactoryLoop {
             return result;
         }
         catch (error) {
+            if (relayfileOverload(error) && this.#discoverySweepEpoch !== undefined) {
+                this.#discoveryOverloadError ??= error;
+            }
             if (opts.logFailure || waitWarnings > 0) {
                 this.#increment('relayfileOperationFailures');
                 this.#logger.warn?.('[factory] relayfile operation failed', {
@@ -2235,7 +3214,10 @@ export class FactoryLoop {
         // ones. Without it, every worker starts in the configured shared checkout
         // and concurrent issues can switch each other back to the base branch.
         const isolateLocalWorktree = this.#fleet.placementLocality === 'local' && Boolean(this.#worktrees);
-        const lifecycleRunId = !dryRun && (durableDispatch || isolateLocalWorktree) ? randomUUID() : undefined;
+        // Every live dispatch gets an issue-owned branch, including legacy local
+        // fleets without a durable lifecycle or worktree manager. The publication
+        // boundary uses this exact ref to reject a stale shared checkout.
+        const lifecycleRunId = !dryRun ? randomUUID() : undefined;
         if (lifecycleRunId) {
             dispatchDecision = decisionWithLifecycleBranches(dispatchDecision, lifecycleRunId, {
                 isolateLocalWorktree,
@@ -2370,6 +3352,13 @@ export class FactoryLoop {
                 }
                 agents.push({ name: spawned.name, role: spec.role });
             }
+            if (!dryRun) {
+                record.dispatchClaim = {
+                    state: 'pending',
+                    updatedAtMs: this.#clock.now(),
+                };
+                this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+            }
             await this.#writeInFlightRegistry();
             const comment = dispatchComment(dispatchDecision, agents);
             let implementingStateId;
@@ -2378,19 +3367,7 @@ export class FactoryLoop {
                 if (!issue || !this.#isIssueReady(issue)) {
                     throw new LiveDispatchStateChangedError(dispatchDecision.issue.key);
                 }
-                try {
-                    await this.#postIssueComment(issue, comment);
-                }
-                catch (error) {
-                    this.#logger.warn?.('[factory] comment writeback skipped', error);
-                }
-                if (isGithubIssue(issue)) {
-                    await this.#githubWriteback.setStatus(issue, 'in-progress');
-                }
-                else {
-                    implementingStateId = this.#states.idFor(issue.team, 'agentImplementing');
-                    await this.#linear.setState(issue, implementingStateId);
-                }
+                implementingStateId = await this.#applyDispatchClaim(record, issue, comment);
                 this.#emit('writeback-verified', { issue: dispatchDecision.issue, path: issue.path });
             }
             const result = {
@@ -2404,11 +3381,15 @@ export class FactoryLoop {
                 dryRun,
             };
             record.result = result;
-            await this.#saveDispatchLifecycle(record, 'running');
+            if (!await this.#saveDispatchLifecycle(record, 'running'))
+                return result;
             this.#increment('dispatched');
             this.#emit('dispatched', { issue: dispatchDecision.issue, result });
+            if (!dryRun && this.#config.hooks?.onTicketDispatch) {
+                await this.#notifyTicketDispatch(dispatchDecision, liveIssue, record, result);
+            }
             if (!dryRun) {
-                await this.#ensureSlackDispatchThread(record, result);
+                await this.#ensureSlackDispatchThread(record, result, liveIssue);
             }
             return result;
         }
@@ -2501,8 +3482,28 @@ export class FactoryLoop {
     }
     status() {
         const batch = this.#batchView;
+        const nowMs = this.#clock.now();
+        const inFlightDispatches = batch?.inFlight
+            .filter((record) => !record.dryRun)
+            .map((record) => ({
+            issue: { ...record.issue },
+            agents: [...record.agents].map(([name, tracked]) => ({
+                name,
+                role: tracked.spec.role,
+                ...(tracked.sessionRef ? { sessionRef: tracked.sessionRef } : {}),
+                ...(tracked.spec.invocationId ? { invocationId: tracked.spec.invocationId } : {}),
+                ...(tracked.result?.node ? { node: tracked.result.node } : {}),
+            })),
+            claim: {
+                ...(record.dispatchClaim ?? this.#dispatchClaimStatuses.get(issueKey(record.issue)) ?? {
+                    state: 'pending',
+                    updatedAtMs: nowMs,
+                }),
+            },
+        })) ?? [];
         return {
             inFlight: batch?.inFlight.map((record) => record.issue) ?? [],
+            ...(inFlightDispatches.length > 0 ? { inFlightDispatches } : {}),
             queued: batch?.queued.map((queued) => queued.issue) ?? [],
             parked: batch?.parked.map((parked) => ({
                 issue: parked.issue,
@@ -2514,6 +3515,8 @@ export class FactoryLoop {
             slackDegraded: this.#slackDegraded,
             slackDegradedReason: this.#slackDegradedReason,
             eventListener: this.#eventListenerStatus(),
+            readinessReconcile: this.#readinessReconcileStatus(),
+            heldAgents: batch?.inFlight.flatMap((record) => heldAgentsForRecord(record, nowMs, this.#config.dispatch.agentHoldTimeoutMs, this.#config.terminalState)) ?? [],
         };
     }
     #eventListenerStatus() {
@@ -2534,6 +3537,34 @@ export class FactoryLoop {
         }
         return { state: 'starting' };
     }
+    #readinessReconcileStatus() {
+        const consecutiveFailures = this.#readinessReconcileConsecutiveFailures;
+        const state = this.#startMode !== 'live'
+            ? 'not-running'
+            : consecutiveFailures >= READINESS_RECONCILE_FAILURE_THRESHOLD
+                ? 'degraded'
+                : consecutiveFailures > 0
+                    ? 'retrying'
+                    : 'healthy';
+        return {
+            state,
+            consecutiveFailures,
+            failureThreshold: READINESS_RECONCILE_FAILURE_THRESHOLD,
+            ...(this.#readinessReconcileLastDurationMs !== undefined
+                ? { lastDurationMs: this.#readinessReconcileLastDurationMs }
+                : {}),
+            ...(this.#readinessReconcileLastStartedAtMs !== undefined
+                ? { lastStartedAtMs: this.#readinessReconcileLastStartedAtMs }
+                : {}),
+            ...(this.#readinessReconcileLastCompletedAtMs !== undefined
+                ? { lastCompletedAtMs: this.#readinessReconcileLastCompletedAtMs }
+                : {}),
+            ...(this.#readinessReconcileLastFailureAtMs !== undefined
+                ? { lastFailureAtMs: this.#readinessReconcileLastFailureAtMs }
+                : {}),
+            ...(this.#readinessReconcileLastError ? { lastError: this.#readinessReconcileLastError } : {}),
+        };
+    }
     on(event, listener) {
         let listeners = this.#listeners.get(event);
         if (!listeners) {
@@ -2653,10 +3684,11 @@ export class FactoryLoop {
                 if (claim.lifecycle.phase === 'waiting-for-human')
                     continue;
                 const durableRecord = inFlightRecordFromLifecycle(claim.lifecycle);
+                let liveIssue;
                 if (!durableRecord.dryRun &&
                     claim.lifecycle.phase !== 'writeback-applied' &&
                     claim.lifecycle.phase !== 'releasing') {
-                    const liveIssue = await this.#readIssue(durableRecord.issue.path);
+                    liveIssue = await this.#readIssue(durableRecord.issue.path);
                     // A babysat Linear issue already at Done may have merged while this
                     // process was down. Let authoritative PR restoration drive the
                     // normal `complete` path so merged work is not mislabeled abandoned.
@@ -2683,6 +3715,18 @@ export class FactoryLoop {
                 const restored = claim.lifecycle.phase === 'queued' || claim.lifecycle.phase === 'releasing'
                     ? durableRecord
                     : batch.restore(durableRecord);
+                if (claim.lifecycle.phase === 'running' &&
+                    this.#ticketDispatchNotificationIsPending(claim.lifecycle)) {
+                    if (!liveIssue) {
+                        this.#dispatchLifecycleEpochs.delete(claim.key ?? key);
+                        this.#scheduleDispatchLifecycleRetry(restored);
+                        throw new Error(`Unable to recover ticket-dispatch notification ${restored.issue.key}: issue is not currently readable`);
+                    }
+                    if (!restored.result) {
+                        throw new Error(`Unable to recover ticket-dispatch notification ${restored.issue.key}: dispatch result is missing`);
+                    }
+                    await this.#notifyTicketDispatch(restored.decision, liveIssue, restored, restored.result);
+                }
                 if (claim.lifecycle.phase !== 'running')
                     this.#scheduleDispatchLifecycleRetry(restored);
                 // Parking agents are cleanup-only. Hydrating them makes relay
@@ -2781,6 +3825,7 @@ export class FactoryLoop {
                     });
                 }
             }
+            this.#rescheduleHeldAgentDeadlineSweep();
         }
         catch (error) {
             this.#logger.warn?.('[factory] failed to re-adopt durable in-flight agents', { error });
@@ -2885,13 +3930,100 @@ export class FactoryLoop {
             this.#reconciledAgentExitWaiters.shift()?.();
         }
     }
-    #scheduleDispatchLifecycleRenewal() {
-        if (this.#dispatchLifecycleRenewTimer || this.#dispatchLifecycleEpochs.size === 0)
+    #scheduleDispatchLifecycleRenewal() {
+        if (this.#dispatchLifecycleRenewTimer || this.#dispatchLifecycleEpochs.size === 0)
+            return;
+        this.#dispatchLifecycleRenewTimer = setInterval(() => {
+            void this.#renewDispatchLifecycles();
+        }, DISPATCH_LIFECYCLE_RENEW_MS);
+        this.#dispatchLifecycleRenewTimer.unref?.();
+    }
+    #scheduleHeldAgentDeadline(record) {
+        if (this.#stopping || record.dryRun || record.heldSinceAtMs === undefined || record.agents.size === 0)
+            return;
+        const dueAtMs = record.heldSinceAtMs + this.#config.dispatch.agentHoldTimeoutMs;
+        if (this.#heldAgentDeadlineTimer &&
+            this.#heldAgentDeadlineDueAtMs !== undefined &&
+            this.#heldAgentDeadlineDueAtMs <= dueAtMs)
+            return;
+        if (this.#heldAgentDeadlineTimer)
+            clearTimeout(this.#heldAgentDeadlineTimer);
+        this.#heldAgentDeadlineDueAtMs = dueAtMs;
+        const remainingMs = dueAtMs - this.#clock.now();
+        // An overdue lifecycle can temporarily be fenced by another owner. Avoid
+        // a zero-delay reschedule loop while its lease is being reclaimed.
+        const delayMs = remainingMs <= 0
+            ? HELD_DEADLINE_OVERDUE_RETRY_MS
+            : Math.min(remainingMs, 2_147_483_647);
+        this.#heldAgentDeadlineTimer = setTimeout(() => {
+            this.#heldAgentDeadlineTimer = undefined;
+            this.#heldAgentDeadlineDueAtMs = undefined;
+            const sweep = this.#sweepHeldAgentDeadlines()
+                .catch((error) => {
+                this.#logger.warn?.('[factory] held-agent deadline sweep failed; retrying', {
+                    error: describeError(error).errorMessage,
+                });
+            })
+                .finally(() => {
+                if (this.#heldAgentDeadlineSweepInFlight === sweep)
+                    this.#heldAgentDeadlineSweepInFlight = undefined;
+                this.#rescheduleHeldAgentDeadlineSweep();
+            });
+            this.#heldAgentDeadlineSweepInFlight = sweep;
+        }, delayMs);
+        this.#heldAgentDeadlineTimer.unref?.();
+    }
+    #rescheduleHeldAgentDeadlineSweep() {
+        if (this.#stopping)
             return;
-        this.#dispatchLifecycleRenewTimer = setInterval(() => {
-            void this.#renewDispatchLifecycles();
-        }, DISPATCH_LIFECYCLE_RENEW_MS);
-        this.#dispatchLifecycleRenewTimer.unref?.();
+        for (const record of this.#batchView?.inFlight ?? [])
+            this.#scheduleHeldAgentDeadline(record);
+    }
+    async #sweepHeldAgentDeadlines() {
+        const nowMs = this.#clock.now();
+        const timeoutMs = this.#config.dispatch.agentHoldTimeoutMs;
+        for (const record of [...(await this.#batch()).inFlight]) {
+            const heldSinceAtMs = record.heldSinceAtMs;
+            if (record.dryRun ||
+                heldSinceAtMs === undefined ||
+                record.agents.size === 0 ||
+                nowMs - heldSinceAtMs < timeoutMs)
+                continue;
+            const key = issueKey(record.issue);
+            if (this.#abandonedDispatchReasons.has(key))
+                continue;
+            if (this.#usesDurableDispatchLifecycle()) {
+                const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
+                if (!lifecycle || isTerminalDispatchLifecycle(lifecycle))
+                    continue;
+                // Terminal writeback already won the race. Finish its normal release
+                // reason instead of relabeling an acknowledged completion as a timeout.
+                if (lifecycle.phase === 'releasing') {
+                    await this.#finishDurableRelease(record, lifecycle.releaseReason);
+                    continue;
+                }
+                if (!await this.#assertDispatchLifecycleOwner(record))
+                    continue;
+            }
+            const heldForMs = Math.max(0, this.#clock.now() - heldSinceAtMs);
+            const details = {
+                issue: record.issue.key,
+                heldForMs,
+                holdTimeoutMs: timeoutMs,
+                waitingForTerminalState: this.#config.terminalState,
+                reason: HELD_PAST_DEADLINE_RELEASE_REASON,
+                agents: [...record.agents.keys()].sort(),
+            };
+            this.#logger.warn?.('[factory] releasing agents held past deadline', details);
+            await this.#abandonStuckDispatch(record, HELD_PAST_DEADLINE_RELEASE_REASON);
+            const lifecycle = this.#usesDurableDispatchLifecycle()
+                ? await this.#state.getDispatchLifecycle(this.#workspaceId, key)
+                : undefined;
+            if (!lifecycle || isTerminalDispatchLifecycle(lifecycle)) {
+                this.#increment('heldPastDeadlineReleases');
+                this.#logger.warn?.('[factory] released agents held past deadline', details);
+            }
+        }
     }
     async #renewDispatchLifecycles() {
         for (const [key, epoch] of [...this.#dispatchLifecycleEpochs]) {
@@ -3258,6 +4390,7 @@ export class FactoryLoop {
         });
     }
     async #saveDispatchLifecycle(record, phase, pullRequest, releaseReason, releasedAgentNames = new Set(), telemetry = {}) {
+        record.lifecyclePhase = phase;
         if (record.dryRun || !this.#usesDurableDispatchLifecycle())
             return true;
         if (isTerminalDispatchPhase(phase))
@@ -3277,6 +4410,9 @@ export class FactoryLoop {
                 ? this.#finalizeRunCost(record, lifecycleRunId)
                 : previous?.cost;
             const lifecycle = lifecycleFromInFlightRecord(record, lifecycleRunId, phase, this.#clock.now(), primaryPullRequest, pullRequests, releaseReason ?? previous?.releaseReason, cost);
+            if (previous?.ticketDispatchNotification) {
+                lifecycle.ticketDispatchNotification = structuredClone(previous.ticketDispatchNotification);
+            }
             for (const agent of lifecycle.agents) {
                 const previousAgent = previous?.agents.find((candidate) => candidate.name === agent.name);
                 if (previousAgent?.releasedAtMs !== undefined)
@@ -3458,6 +4594,7 @@ export class FactoryLoop {
         const batch = await this.#batch();
         const durableRecord = inFlightRecordFromLifecycle(lifecycle);
         const record = lifecycle.phase === 'releasing' ? durableRecord : batch.restore(durableRecord);
+        this.#scheduleHeldAgentDeadline(record);
         if (!await this.#assertDispatchLifecycleOwner(record))
             return;
         if (acquiredNow && this.#config.babysitter.enabled)
@@ -3473,6 +4610,15 @@ export class FactoryLoop {
                 await this.#abandonDurableResume(record, 'source issue became terminal before lifecycle cleanup');
                 return;
             }
+            if (this.#ticketDispatchNotificationIsPending(lifecycle)) {
+                if (!liveIssue) {
+                    throw new Error(`Unable to recover ticket-dispatch notification ${record.issue.key}: issue is not currently readable`);
+                }
+                if (!record.result) {
+                    throw new Error(`Unable to recover ticket-dispatch notification ${record.issue.key}: dispatch result is missing`);
+                }
+                await this.#notifyTicketDispatch(record.decision, liveIssue, record, record.result);
+            }
         }
         if (acquiredNow && lifecycle.phase === 'running') {
             const activeAgents = lifecycle.agents.filter((agent) => agent.releasedAtMs === undefined);
@@ -3649,18 +4795,22 @@ export class FactoryLoop {
             const spawned = await this.#spawnAgent(record, spec, record.dryRun);
             agents.push({ name: spawned.name, role: spec.role });
         }
+        const comment = dispatchComment(record.decision, agents);
+        let implementingStateId;
+        if (!record.dryRun) {
+            record.dispatchClaim = {
+                state: 'pending',
+                updatedAtMs: this.#clock.now(),
+            };
+            this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+        }
         await this.#writeInFlightRegistry();
         if (!record.dryRun) {
             const issue = liveIssue ?? await this.#readIssue(record.issue.path);
             if (!issue)
                 throw new Error(`Unable to recover durable dispatch ${record.issue.key}: issue is no longer readable`);
             await this.#ensureGithubAgentQuestionWatch(record, issue);
-            if (isGithubIssue(issue)) {
-                await this.#githubWriteback.setStatus(issue, 'in-progress');
-            }
-            else {
-                await this.#linear.setState(issue, this.#states.idFor(issue.team, 'agentImplementing'));
-            }
+            implementingStateId = await this.#applyDispatchClaim(record, issue, comment);
         }
         const recoveredPreviews = uniquePreviewReferences([
             ...dispatchSpecs(record.decision).map((spec) => spec.preview),
@@ -3669,7 +4819,8 @@ export class FactoryLoop {
         record.result ??= {
             issue: record.issue,
             agents,
-            comments: [dispatchComment(record.decision, agents)],
+            comments: [comment],
+            stateId: implementingStateId,
             ...(recoveredPreviews.length > 0 ? { previews: recoveredPreviews } : {}),
             dryRun: record.dryRun,
         };
@@ -3678,7 +4829,8 @@ export class FactoryLoop {
         }
         if (!await this.#saveDispatchLifecycle(record, 'running'))
             return;
-        if (!record.dryRun) {
+        if (liveIssue) {
+            await this.#notifyTicketDispatch(record.decision, liveIssue, record, record.result);
             await this.#ensureSlackDispatchThread(record, record.result);
             for (const tracked of record.agents.values()) {
                 const owned = tracked.spec.ownedPullRequest;
@@ -3967,6 +5119,97 @@ export class FactoryLoop {
         }
         await this.#linear.postComment(issue, body);
     }
+    async #applyDispatchClaim(record, issue, comment) {
+        let implementingStateId;
+        if (isGithubIssue(issue)) {
+            await this.#retryDispatchWriteback(record, issue, 'GitHub label factory:in-progress', async () => {
+                await this.#githubWriteback.setStatus(issue, 'in-progress');
+            });
+            const commentApplied = this.#githubWriteback.hasCommentMarker
+                ? async () => this.#githubWriteback.hasCommentMarker(issue, comment)
+                : undefined;
+            await this.#retryDispatchWriteback(record, issue, 'GitHub dispatch comment', async () => this.#githubWriteback.postComment(issue, comment), commentApplied);
+        }
+        else {
+            implementingStateId = this.#states.idFor(issue.team, 'agentImplementing');
+            await this.#retryDispatchWriteback(record, issue, `Linear state ${implementingStateId}`, async () => {
+                await this.#linear.setState(issue, implementingStateId);
+            });
+            await this.#retryDispatchWriteback(record, issue, 'Linear dispatch comment', async () => {
+                await this.#linear.postComment(issue, comment);
+            });
+        }
+        record.dispatchClaim = {
+            state: 'verified',
+            updatedAtMs: this.#clock.now(),
+        };
+        this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+        await this.#writeDispatchClaimRegistry(record.issue);
+        return implementingStateId;
+    }
+    async #retryDispatchWriteback(record, issue, write, apply, isApplied) {
+        let lastError;
+        for (let attempt = 1; attempt <= DISPATCH_WRITEBACK_MAX_ATTEMPTS; attempt += 1) {
+            try {
+                if (isApplied && await isApplied())
+                    return;
+                await apply();
+                if (isApplied && !await isApplied()) {
+                    throw new Error(`${write} returned without a provider read-back acknowledgement`);
+                }
+                return;
+            }
+            catch (error) {
+                lastError = error;
+                const deadLettered = attempt === DISPATCH_WRITEBACK_MAX_ATTEMPTS;
+                this.#increment('dispatchWritebackFailures');
+                record.dispatchClaim = {
+                    state: 'degraded',
+                    write,
+                    attempts: attempt,
+                    maxAttempts: DISPATCH_WRITEBACK_MAX_ATTEMPTS,
+                    error: describeError(error).errorMessage,
+                    ...(deadLettered ? { deadLettered: true } : {}),
+                    updatedAtMs: this.#clock.now(),
+                };
+                this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+                await this.#writeDispatchClaimRegistry(record.issue);
+                if (deadLettered) {
+                    this.#increment('dispatchWritebackDeadLetters');
+                    this.#logger.error?.('[factory] dispatch writeback dead-lettered after retries exhausted', {
+                        issue: issue.key,
+                        write,
+                        attempts: attempt,
+                        error: describeError(error).errorMessage,
+                    });
+                    throw error;
+                }
+                this.#increment('dispatchWritebackRetries');
+                this.#logger.error?.('[factory] dispatch writeback failed; retrying', {
+                    issue: issue.key,
+                    write,
+                    attempt,
+                    maxAttempts: DISPATCH_WRITEBACK_MAX_ATTEMPTS,
+                    retryMs: DISPATCH_WRITEBACK_RETRY_MS,
+                    error: describeError(error).errorMessage,
+                });
+                await this.#clock.sleep(DISPATCH_WRITEBACK_RETRY_MS);
+            }
+        }
+        throw lastError;
+    }
+    async #writeDispatchClaimRegistry(issue) {
+        try {
+            await this.#writeInFlightRegistry();
+        }
+        catch (error) {
+            this.#increment('dispatchClaimRegistryWriteFailures');
+            this.#logger.error?.('[factory] failed to persist dispatch claim visibility', {
+                issue: issue.key,
+                error: describeError(error).errorMessage,
+            });
+        }
+    }
     // Probes the GitHub issue sub-root at most once and caches the verdict so
     // repeated iterations skip listTree calls when the mount is absent.
     async #ensureGithubIngestionReady() {
@@ -4024,7 +5267,7 @@ export class FactoryLoop {
         const candidates = [];
         let scanned = 0;
         let lastProgressAtMs = startedAtMs;
-        for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'GitHub mirror candidate loading')) {
+        for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'GitHub mirror candidate loading', { cache: true })) {
             await this.#refreshLiveHeartbeatIfDue();
             if (!isLinearIssueMirrorCandidatePath(path)) {
                 continue;
@@ -4047,18 +5290,35 @@ export class FactoryLoop {
         try {
             const issuePaths = new Map();
             for (const { owner, repo } of configuredGithubRepoParts(this.#config)) {
-                const indexedPaths = await this.#githubIssuePathsFromIndex(owner, repo);
                 const roots = githubIssueRepoRoots(owner, repo);
+                const cachedBatches = roots.map((root) => this.#cachedDiscoveryTree(root));
+                const allRootsCached = cachedBatches.every((paths) => paths !== undefined);
+                const indexedPaths = allRootsCached
+                    ? undefined
+                    : await this.#githubIssuePathsFromIndex(owner, repo);
                 // Keep the fallback roots as separate batches. Flattening a very large
                 // provider result is synchronous work and can starve the durable loop
                 // heartbeat before the bounded scan below gets a chance to yield.
-                const pathBatches = indexedPaths
-                    ? [indexedPaths]
-                    : await Promise.all(roots.map(async (root) => await this.#listRelayfileTree(root, 'GitHub issue ingestion')));
-                if (indexedPaths) {
+                let pathBatches;
+                if (allRootsCached) {
+                    pathBatches = cachedBatches;
+                    this.#increment('githubIssueDiscoveryCacheReposUsed');
+                }
+                else if (indexedPaths) {
+                    // Do not feed this into the discovery cache: the index only covers
+                    // open, labeled issues, so it is a filtered subset of the real
+                    // tree (and an empty result for whichever root form the index
+                    // doesn't use) — not something a later fresh listTree call may
+                    // treat as "the tree", including on the escalation-marker and
+                    // comment-replay call sites that share this cache.
+                    pathBatches = [indexedPaths];
                     this.#increment('githubIssueIndexReposUsed');
                 }
                 else {
+                    pathBatches = [];
+                    for (const root of roots) {
+                        pathBatches.push(await this.#listRelayfileTree(root, 'GitHub issue ingestion', { cache: true }));
+                    }
                     this.#increment('githubIssueIndexFallbacks');
                 }
                 for (const paths of pathBatches) {
@@ -4103,6 +5363,8 @@ export class FactoryLoop {
             return [...issuePaths.values()].sort();
         }
         catch (error) {
+            if (relayfileOverload(error))
+                throw error;
             this.#githubIssuePathIndexReady = false;
             this.#increment('githubIssueListFailures');
             this.#logger.warn?.('[factory] failed to list GitHub issue source tree', error);
@@ -4116,7 +5378,9 @@ export class FactoryLoop {
             const { content } = await this.#readRelayfileFile(indexPath, 'GitHub issue index discovery');
             parsed = parseJsonContent(content);
         }
-        catch {
+        catch (error) {
+            if (relayfileOverload(error))
+                throw error;
             return undefined;
         }
         if (!Array.isArray(parsed))
@@ -4203,6 +5467,8 @@ export class FactoryLoop {
             this.#increment('githubIssueMirrorsCreated');
         }
         catch (error) {
+            if (relayfileOverload(error))
+                throw error;
             this.#logger.error?.('[factory] failed to ingest GitHub issue', error);
         }
     }
@@ -4520,7 +5786,7 @@ export class FactoryLoop {
                 // The pass-scoped flag also lets every later blocked issue reuse the
                 // resulting dependency index instead of rescanning the full tree.
                 this.#dependencyLinearTreeLoaded = true;
-                for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'dependency blocker discovery')) {
+                for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'dependency blocker discovery', { cache: true })) {
                     if (isIssueFilePath(path))
                         await this.#readIssue(path);
                 }
@@ -4575,7 +5841,7 @@ export class FactoryLoop {
         const pullRequest = await resolveIssuePrFromMount(this.#mount, this.#config, issue, {
             allowLegacyGithubBranch: true,
             repo,
-        });
+        }, (prefix) => this.#listRelayfileTree(prefix, 'dependency PR probe resolution'));
         if (normalizePrState(pullRequest?.state) !== 'MERGED')
             return false;
         this.#terminalDependencyIdentities.add(identity);
@@ -4752,6 +6018,7 @@ export class FactoryLoop {
             updatedAtMs,
             registryPath,
             eventListener: this.#eventListenerStatus(),
+            readinessReconcile: this.#readinessReconcileStatus(),
         };
         await mkdir(dirname(path), { recursive: true });
         await writeFile(path, `${JSON.stringify(heartbeat, null, 2)}\n`, 'utf8');
@@ -4898,14 +6165,14 @@ export class FactoryLoop {
         }
         const pathsByKey = new Map();
         const canonicalPathsByKey = new Map();
-        for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'Linear ready issue canonical discovery')) {
+        for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'Linear ready issue canonical discovery', { cache: true })) {
             if (isIssueFilePath(path)) {
                 const key = keyFromPath(path);
                 canonicalPathsByKey.set(key, path);
                 pathsByKey.set(key, path);
             }
         }
-        for (const path of await this.#listRelayfileTree(linearByStatePath('ready-for-agent'), 'Linear ready issue alias discovery')) {
+        for (const path of await this.#listRelayfileTree(linearByStatePath('ready-for-agent'), 'Linear ready issue alias discovery', { cache: true })) {
             if (isIssueAliasFilePath(path)) {
                 const canonicalPath = canonicalPathsByKey.get(keyFromPath(path));
                 if (canonicalPath) {
@@ -4946,6 +6213,8 @@ export class FactoryLoop {
             return resolvedIssue;
         }
         catch (error) {
+            if (relayfileOverload(error))
+                throw error;
             if (isMissingIssueFileError(error) && isIssuePathUnderRoot(path)) {
                 this.#increment('phantomSkipped');
                 this.#logger.debug?.('[factory] skipped missing issue file discovered from issue tree', { path });
@@ -5174,7 +6443,7 @@ export class FactoryLoop {
         const updatedAtMs = this.#clock.now();
         const agents = [];
         const seenAgents = new Set();
-        const appendAgent = async (issue, agentName, tracked) => {
+        const appendAgent = async (issue, agentName, tracked, hold) => {
             const key = registryHandoffKey(issue, agentName);
             if (seenAgents.has(key)) {
                 return;
@@ -5189,6 +6458,7 @@ export class FactoryLoop {
                 }
             }
             const fleetTracked = this.#fleet.trackedAgents?.().get(agentName);
+            const dispatchClaim = this.#dispatchClaimStatuses.get(issueKey(issue));
             agents.push({
                 name: agentName,
                 role: tracked.spec.role,
@@ -5198,14 +6468,24 @@ export class FactoryLoop {
                 processes,
                 ...(fleetTracked?.invocationId ? { invocationId: fleetTracked.invocationId } : {}),
                 ...(fleetTracked?.node ? { node: fleetTracked.node } : {}),
+                ...(dispatchClaim ? { dispatchClaim: { ...dispatchClaim } } : {}),
+                ...(hold?.heldSinceAtMs !== undefined ? {
+                    heldSinceAtMs: hold.heldSinceAtMs,
+                    holdDeadlineAtMs: hold.heldSinceAtMs + this.#config.dispatch.agentHoldTimeoutMs,
+                    waitingForTerminalState: this.#config.terminalState,
+                    ...(hold.lifecyclePhase ? { lifecyclePhase: hold.lifecyclePhase } : {}),
+                } : {}),
             });
         };
         if (!empty) {
             for (const record of (await this.#batch()).inFlight) {
                 if (record.dryRun)
                     continue;
+                if (record.dispatchClaim) {
+                    this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+                }
                 for (const [agentName, tracked] of record.agents) {
-                    await appendAgent(record.issue, agentName, tracked);
+                    await appendAgent(record.issue, agentName, tracked, record);
                 }
             }
         }
@@ -5227,6 +6507,7 @@ export class FactoryLoop {
         const invocationId = batch.invocationIdFor(record.issue, spec);
         const existing = record.agents.get(spec.name);
         if (existing?.result) {
+            this.#scheduleHeldAgentDeadline(record);
             return { name: existing.result?.name ?? spec.name };
         }
         if (!batch.shouldSpawn(record, invocationId)) {
@@ -5253,6 +6534,7 @@ export class FactoryLoop {
         const rosterAgent = roster.agents.find((agent) => agent.name === spec.name);
         if (rosterAgent) {
             const trackedPlacement = this.#fleet.trackedAgents?.().get(spec.name);
+            record.heldSinceAtMs ??= this.#clock.now();
             batch.recordSpawn(record, spec, invocationId, {
                 name: spec.name,
                 sessionRef: existing?.sessionRef ?? spec.sessionRef,
@@ -5262,6 +6544,7 @@ export class FactoryLoop {
             if (!await this.#saveDispatchLifecycle(record, 'dispatching')) {
                 throw new Error(`Dispatch lifecycle ownership lost after adopting ${spec.name}`);
             }
+            this.#scheduleHeldAgentDeadline(record);
             const adopted = record.agents.get(spec.name);
             if (adopted)
                 await this.#reportAgent(record, adopted, 'agent.adopted');
@@ -5294,10 +6577,12 @@ export class FactoryLoop {
                     : 'agent_spawn_failed',
             });
         }
+        record.heldSinceAtMs ??= this.#clock.now();
         batch.recordSpawn(record, spec, invocationId, result);
         if (!await this.#saveDispatchLifecycle(record, 'dispatching')) {
             throw new Error(`Dispatch lifecycle ownership lost after spawning ${spec.name}`);
         }
+        this.#scheduleHeldAgentDeadline(record);
         const spawned = record.agents.get(result.name);
         if (spawned)
             await this.#reportAgent(record, spawned, 'agent.spawned');
@@ -5739,10 +7024,25 @@ export class FactoryLoop {
     }
     async #publishImplementerPullRequest(record, implementer, opts = {}) {
         const key = `${issueKey(record.issue)}:${implementer.spec.repo}`;
+        const expectedHeadRef = implementer.spec.branch;
+        if (!expectedHeadRef) {
+            throw new Error(`Refusing to publish ${record.issue.key}: implementer has no Factory-derived branch`);
+        }
+        const matchesCurrentConvention = factoryBranchBelongsToIssue(expectedHeadRef, record.issue.key);
+        const matchesAuthorizedLegacyBranch = implementer.spec.existingPullRequestBranch === true &&
+            /^\d+$/u.test(record.issue.key) &&
+            expectedHeadRef.toLowerCase().startsWith(`${record.issue.key.toLowerCase()}-`);
+        if (!matchesCurrentConvention && !matchesAuthorizedLegacyBranch) {
+            throw new Error(`Refusing to publish ${record.issue.key}: branch ${expectedHeadRef} belongs to a different issue`);
+        }
         const durable = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
         const cached = this.#publishedPullRequests.get(key);
-        if (cached)
+        if (cached) {
+            if (cached.headRef !== expectedHeadRef) {
+                throw new Error(`Refusing cached PR for ${record.issue.key}: expected head branch ${expectedHeadRef}, found ${cached.headRef}`);
+            }
             return cached;
+        }
         const { identity, publisher } = this.#githubPullRequestPublisher();
         const remoteBranch = implementer.result?.locality === 'remote' && implementer.spec.branch
             ? implementer.spec.branch
@@ -5762,11 +7062,13 @@ export class FactoryLoop {
             : undefined;
         const repo = normalizeGithubRepo(implementer.spec.repo, this.#config.repos.org ?? sourceOwner);
         const durableReceipt = publishedPullRequests(durable).find((receipt) => receipt.repo.toLowerCase() === repo.toLowerCase());
-        const expectedHeadRef = implementer.spec.branch ?? remoteBranch;
-        if (durableReceipt &&
-            (!opts.reconcileExisting || !expectedHeadRef || durableReceipt.headRef === expectedHeadRef))
+        if (durableReceipt) {
+            if (durableReceipt.headRef !== expectedHeadRef) {
+                throw new Error(`Refusing durable PR receipt for ${record.issue.key}: expected head branch ${expectedHeadRef}, found ${durableReceipt.headRef}`);
+            }
             return durableReceipt;
-        if (opts.reconcileExisting && expectedHeadRef) {
+        }
+        if (opts.reconcileExisting) {
             const existing = await this.#openPullRequestByHead(repo, expectedHeadRef);
             if (existing) {
                 this.#publishedPullRequests.set(key, existing);
@@ -5784,6 +7086,7 @@ export class FactoryLoop {
         const result = await publisher.publishPullRequest({
             repo,
             ...(remoteBranch ? { headRef: remoteBranch } : { clonePath: implementer.spec.clonePath }),
+            expectedHeadRef,
             baseRef,
             title: `${issue.key}: ${issue.title}`,
             body: githubPullRequestBody(issue, implementer.spec.preview),
@@ -5793,7 +7096,7 @@ export class FactoryLoop {
             ? result
             : { ...result, author: identity };
         if (published.repo.toLowerCase() !== repo.toLowerCase() ||
-            published.headRef !== (remoteBranch ?? published.headRef) ||
+            published.headRef !== expectedHeadRef ||
             !Number.isInteger(published.number) ||
             published.number <= 0 ||
             !published.url) {
@@ -5894,9 +7197,11 @@ export class FactoryLoop {
         for (const root of roots) {
             let paths;
             try {
-                paths = await this.#mount.listTree(root);
+                paths = await this.#listRelayfileTree(root, 'exact-head PR confirmation');
             }
-            catch {
+            catch (error) {
+                if (relayfileOverload(error))
+                    throw error;
                 continue;
             }
             for (const path of paths) {
@@ -6162,9 +7467,11 @@ export class FactoryLoop {
         for (let attempt = 0; attempt < PUBLISHED_PR_CONFIRM_ATTEMPTS; attempt += 1) {
             const paths = (await Promise.all(roots.map(async (root) => {
                 try {
-                    return await this.#mount.listTree(root);
+                    return await this.#listRelayfileTree(root, 'published PR confirmation');
                 }
-                catch {
+                catch (error) {
+                    if (relayfileOverload(error))
+                        throw error;
                     return [];
                 }
             }))).flat();
@@ -6234,7 +7541,10 @@ export class FactoryLoop {
         try {
             const thread = await this.#slackDispatchThreadFor(record);
             if (thread && this.#slack) {
-                await this.#slack.reply(thread.threadId, `:warning: ${record.issue.key}: the implementer exited without opening a PR (after a retry). It needs a human look.`);
+                const issue = await this.#readIssue(record.issue.path);
+                if (!issue)
+                    return;
+                await this.#slack.reply(thread.threadId, `:warning: ${slackIssueSubject(issue, slackNotificationRepos(record.decision))}\nThe implementer exited without opening a PR after a retry; this needs a human look.`);
             }
         }
         catch (error) {
@@ -6295,6 +7605,8 @@ export class FactoryLoop {
     // record leaves the batch.
     async #abandonStuckDispatch(record, reason) {
         const key = issueKey(record.issue);
+        const heldPastDeadline = reason === HELD_PAST_DEADLINE_RELEASE_REASON;
+        const agentReleaseReason = heldPastDeadline ? HELD_PAST_DEADLINE_RELEASE_REASON : 'issue-abandoned';
         this.#abandonedDispatchReasons.set(key, reason);
         if (!await this.#saveDispatchLifecycle(record, 'abandoning', undefined, reason, new Set(), { cancellationReason: 'dispatch_failed' })) {
             this.#increment('abandonedDispatchReleaseRetries');
@@ -6320,9 +7632,9 @@ export class FactoryLoop {
         }
         const agents = [...record.agents];
         for (const [agentName, tracked] of agents) {
-            if (tracked.spec.role === 'implementer')
+            if (!heldPastDeadline && tracked.spec.role === 'implementer')
                 continue;
-            this.#fleet.markAgentTerminal?.(agentName, `implementer-terminal:${reason}`);
+            this.#fleet.markAgentTerminal?.(agentName, heldPastDeadline ? HELD_PAST_DEADLINE_RELEASE_REASON : `implementer-terminal:${reason}`);
         }
         const worktreeHandoffs = this.#dispatchFailureHandoffs(record, []);
         let cleanupComplete = true;
@@ -6335,13 +7647,13 @@ export class FactoryLoop {
             const worktreeAgentNames = new Set(worktreeHandoffs.map((handoff) => handoff.name));
             const nonWorktreeAgents = agents.filter(([name]) => !worktreeAgentNames.has(name));
             if (nonWorktreeAgents.length > 0) {
-                const failed = await this.#releaseAndTerminateAgents(nonWorktreeAgents, 'issue-abandoned', 'completion');
+                const failed = await this.#releaseAndTerminateAgents(nonWorktreeAgents, agentReleaseReason, 'completion');
                 cleanupComplete = failed.length === 0;
             }
-            cleanupComplete = await this.#teardownFailedDispatchWorktrees(worktreeHandoffs) && cleanupComplete;
+            cleanupComplete = await this.#teardownFailedDispatchWorktrees(worktreeHandoffs, agentReleaseReason) && cleanupComplete;
         }
         else if (agents.length > 0) {
-            const failed = await this.#releaseAndTerminateAgents(agents, 'issue-abandoned', 'completion');
+            const failed = await this.#releaseAndTerminateAgents(agents, agentReleaseReason, 'completion');
             cleanupComplete = failed.length === 0;
         }
         if (!cleanupComplete) {
@@ -6930,7 +8242,11 @@ export class FactoryLoop {
             return await this.#postAgentQuestionToGithub(record, question, 'no Slack dispatch thread exists');
         }
         try {
-            await this.#slack.reply(threadId, agentQuestionSlackText(record.issue, question, this.#config.slack.stakeholderUserIds));
+            const issue = await this.#readIssue(record.issue.path);
+            if (!issue) {
+                throw new Error(`Unable to describe Slack question notification for unreadable issue ${record.issue.key}`);
+            }
+            await this.#slack.reply(threadId, agentQuestionSlackText(issue, question, this.#config.slack.stakeholderUserIds, slackNotificationRepos(record.decision)));
             this.#increment('agentQuestionsPostedToSlack');
             this.#recordSlackWritebackSuccess('agent-question');
             return true;
@@ -7032,10 +8348,13 @@ export class FactoryLoop {
             return await this.#deliverClarificationQuestionToGithub(key, claimed, `Slack writeback is degraded${this.#slackDegradedReason ? `: ${this.#slackDegradedReason}` : ''}`);
         }
         try {
-            await this.#slack.reply(claimed.threadId, agentQuestionSlackText(claimed.issue, {
+            if (!claimedIssue) {
+                throw new Error(`Unable to describe Slack question notification for unreadable issue ${claimed.issue.key}`);
+            }
+            await this.#slack.reply(claimed.threadId, agentQuestionSlackText(claimedIssue, {
                 agentName: claimed.askerName,
                 question: claimed.question,
-            }, this.#config.slack.stakeholderUserIds));
+            }, this.#config.slack.stakeholderUserIds, slackNotificationRepos(claimed.decision)));
             const completed = await this.#state.completeClarificationQuestionDelivery(this.#workspaceId, key, this.#clarificationWakeOwner, this.#clock.now());
             if (!completed) {
                 this.#increment('clarificationQuestionDeliveryOwnershipLost');
@@ -7233,7 +8552,11 @@ export class FactoryLoop {
             return;
         }
         try {
-            await this.#slack.reply(threadId, agentQuestionSlackText(record.issue, question, this.#config.slack.stakeholderUserIds));
+            const issue = await this.#readIssue(record.issue.path);
+            if (!issue) {
+                throw new Error(`Unable to describe Slack question mirror for unreadable issue ${record.issue.key}`);
+            }
+            await this.#slack.reply(threadId, agentQuestionSlackText(issue, question, this.#config.slack.stakeholderUserIds, slackNotificationRepos(record.decision)));
             this.#increment('agentQuestionsMirroredToSlack');
             this.#recordSlackWritebackSuccess('agent-question-mirror');
         }
@@ -7415,7 +8738,7 @@ export class FactoryLoop {
             `${GITHUB_ISSUE_ROOT}/${owner}__${repo}/issues`,
         ]) {
             try {
-                for (const path of await this.#mount.listTree(prefix)) {
+                for (const path of await this.#listRelayfileTree(prefix, 'GitHub escalation marker listing')) {
                     const parts = githubIssueCommentPathParts(path);
                     if (parts &&
                         parts.owner.toLowerCase() === source.owner.toLowerCase() &&
@@ -7709,7 +9032,7 @@ export class FactoryLoop {
             ];
         for (const prefix of prefixes) {
             try {
-                for (const path of await this.#mount.listTree(prefix)) {
+                for (const path of await this.#listRelayfileTree(prefix, 'GitHub issue comment replay listing')) {
                     const parts = githubIssueCommentPathParts(path);
                     if (parts &&
                         parts.owner.toLowerCase() === source.owner.toLowerCase() &&
@@ -7720,6 +9043,8 @@ export class FactoryLoop {
                 }
             }
             catch (error) {
+                if (relayfileOverload(error))
+                    throw error;
                 this.#logger.warn?.('[factory] unable to list GitHub issue comments for replay', { prefix, error });
             }
         }
@@ -8326,7 +9651,7 @@ export class FactoryLoop {
                 prMetaShowsMerged(snapshot) &&
                 prSnapshotIssueMatchScore(snapshot, session.issue.key) >= 30) {
                 await this.#state.clearBabysitterSession(this.#workspaceId, persistedKey);
-                await this.#advanceMergedPrToDone(snapshot, record);
+                await this.#advanceMergedPrToDone(snapshot, session.repo, record);
                 this.#increment('babysitterOwnershipRestoreMerged');
                 this.#logger.info?.('[factory] completed restored lifecycle whose pull request was already merged', {
                     issue: session.issue.key,
@@ -8879,7 +10204,24 @@ export class FactoryLoop {
             const owner = await this.#babysitterOwnerFor(`${event.owner}/${event.repo}`, target.prNumber);
             if (!owner) {
                 this.#increment('babysitterEventsIgnoredUnownedPr');
-                this.#logger.debug?.('[factory] ignored unowned PR event for babysitter routing', { ...event, prNumber: target.prNumber });
+                // "Unowned" means no babysitter was ever registered for this PR — the
+                // downstream symptom of a missed or failed PR-open. Warn once per PR so
+                // it is visible at default level, then fall back to debug for the
+                // repeats; #sweepOrphanedBabysitterPrs is what actually recovers it.
+                const identity = githubPrIdentity(`${event.owner}/${event.repo}`, target.prNumber);
+                const detail = { ...event, prNumber: target.prNumber };
+                // The size cap gates the warn itself, not just the bookkeeping: an
+                // unbounded set of identities must not become an unbounded warn stream.
+                const firstForPr = Boolean(identity) &&
+                    !this.#babysitterUnownedPrWarned.has(identity) &&
+                    this.#babysitterUnownedPrWarned.size < BABYSITTER_UNOWNED_PR_WARN_LIMIT;
+                if (firstForPr) {
+                    this.#babysitterUnownedPrWarned.add(identity);
+                    this.#logger.warn?.('[factory] ignored unowned PR event for babysitter routing', detail);
+                }
+                else {
+                    this.#logger.debug?.('[factory] ignored unowned PR event for babysitter routing', detail);
+                }
                 continue;
             }
             if (this.#mount.resourceSubscriptions &&
@@ -9333,19 +10675,92 @@ export class FactoryLoop {
     // through the durable Relay lifecycle action; the orchestrator never runs `gh`. PR meta events here
     // only (a) spawn the babysitter on open and (b) carry the latest open/draft/
     // merged state used to guard the final transition.
+    async #readPrSnapshotContent(path) {
+        let lastError;
+        for (let attempt = 1; attempt <= BABYSITTER_PR_SNAPSHOT_READ_ATTEMPTS; attempt += 1) {
+            try {
+                const { content } = await this.#mount.readFile(path);
+                if (attempt > 1)
+                    this.#increment('babysitterPrSnapshotReadRetrySucceeded');
+                return content;
+            }
+            catch (error) {
+                lastError = error;
+                if (attempt < BABYSITTER_PR_SNAPSHOT_READ_ATTEMPTS && !this.#stopping) {
+                    this.#increment('babysitterPrSnapshotReadRetries');
+                    await this.#clock.sleep(BABYSITTER_PR_SNAPSHOT_READ_BACKOFF_MS * attempt);
+                    continue;
+                }
+                break;
+            }
+        }
+        throw lastError;
+    }
+    #recordBabysitterPrSnapshotFailure(path, error) {
+        const { errorMessage } = describeError(error);
+        const existing = this.#babysitterPrSnapshotDeadLetters.get(path);
+        const failures = (existing?.failures ?? 0) + 1;
+        // Re-insert last so the eviction below stays insertion-ordered by recency.
+        this.#babysitterPrSnapshotDeadLetters.delete(path);
+        this.#babysitterPrSnapshotDeadLetters.set(path, {
+            failures,
+            lastErrorMessage: errorMessage,
+            firstFailedAtMs: existing?.firstFailedAtMs ?? this.#clock.now(),
+        });
+        while (this.#babysitterPrSnapshotDeadLetters.size > BABYSITTER_PR_SNAPSHOT_DEAD_LETTER_LIMIT) {
+            const oldest = this.#babysitterPrSnapshotDeadLetters.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.#babysitterPrSnapshotDeadLetters.delete(oldest);
+            this.#increment('babysitterPrSnapshotDeadLettersEvicted');
+        }
+        this.#increment('babysitterPrSnapshotReadFailures');
+        const detail = {
+            path,
+            error: errorMessage,
+            failures,
+            attemptsPerTry: BABYSITTER_PR_SNAPSHOT_READ_ATTEMPTS,
+            deadLettered: this.#babysitterPrSnapshotDeadLetters.size,
+        };
+        // A PR whose meta cannot be read is a PR with no shepherd, which is not
+        // debug-level information. Escalate once the sweep retries also fail.
+        if (failures >= BABYSITTER_PR_SNAPSHOT_DEAD_LETTER_ESCALATE_AFTER) {
+            this.#increment('babysitterPrSnapshotReadFailuresEscalated');
+            // The sweep keeps retrying for as long as the mount stays faulted, so the
+            // escalation logs on the transition and then only periodically. The
+            // counters carry the true volume.
+            const sinceEscalation = failures - BABYSITTER_PR_SNAPSHOT_DEAD_LETTER_ESCALATE_AFTER;
+            if (sinceEscalation % BABYSITTER_PR_SNAPSHOT_ESCALATED_LOG_EVERY === 0) {
+                this.#logger.error?.('[factory] babysitter PR snapshot still unreadable after repeated retries', detail);
+            }
+            return;
+        }
+        this.#logger.warn?.('[factory] babysitter could not read PR snapshot', detail);
+    }
     async #handlePrChange(path) {
         const parts = githubPullPathParts(path);
         if (!parts) {
             return;
         }
-        let snapshot;
+        // This read is the only gate between a PR opening and it getting a
+        // babysitter, so it retries rather than treating one `fetch failed` as a
+        // verdict. On exhaustion the path is dead-lettered for the reconcile sweep
+        // (#sweepOrphanedBabysitterPrs) instead of being dropped.
+        let content;
         try {
-            snapshot = parsePullSnapshot((await this.#mount.readFile(path)).content, parts.number);
+            content = await this.#readPrSnapshotContent(path);
         }
         catch (error) {
-            this.#logger.debug?.('[factory] babysitter could not read PR snapshot', { path, error: describeError(error).errorMessage });
+            this.#recordBabysitterPrSnapshotFailure(path, error);
             return;
         }
+        if (this.#babysitterPrSnapshotDeadLetters.delete(path)) {
+            this.#increment('babysitterPrSnapshotDeadLettersRecovered');
+            this.#logger.info?.('[factory] babysitter recovered a dead-lettered PR snapshot read', { path });
+        }
+        // parsePullSnapshot never throws; an undefined result is a structurally
+        // mismatched payload, which a retry cannot fix.
+        const snapshot = parsePullSnapshot(content, parts.number);
         if (!snapshot) {
             return;
         }
@@ -9357,7 +10772,7 @@ export class FactoryLoop {
         if (owned) {
             if (prMetaShowsMerged(snapshot)) {
                 if (owned.record)
-                    await this.#advanceMergedPrToDone(snapshot, owned.record);
+                    await this.#advanceMergedPrToDone(snapshot, repo, owned.record);
                 else
                     await this.#cancelBabysitterWake(owned.key);
                 return;
@@ -9413,7 +10828,7 @@ export class FactoryLoop {
             return;
         }
         if (prMetaShowsMerged(snapshot)) {
-            await this.#advanceMergedPrToDone(snapshot, record);
+            await this.#advanceMergedPrToDone(snapshot, repo, record);
             return;
         }
         if (!this.#config.babysitter.enabled) {
@@ -9471,9 +10886,15 @@ export class FactoryLoop {
         }
         return best?.record;
     }
-    async #advanceMergedPrToDone(snapshot, record) {
+    async #advanceMergedPrToDone(snapshot, repo, record) {
+        const mergedPullRequest = { repo, number: snapshot.number, url: snapshot.url };
         if (record) {
-            await this.#completeIssue(record, { targetState: 'done', runMergeGate: false, completionReason: 'pr-merged' });
+            await this.#completeIssue(record, {
+                targetState: 'done',
+                runMergeGate: false,
+                completionReason: 'pr-merged',
+                mergedPullRequest,
+            });
             return;
         }
         const issue = await this.#findMergeAdvanceIssueForPr(snapshot);
@@ -9511,11 +10932,13 @@ export class FactoryLoop {
                     const channel = await this.#slackChannelDir();
                     if (channel) {
                         const systemOfRecord = githubIssue ? 'GitHub issue closed' : 'Linear state set to Done';
+                        const subject = slackIssueSubject(issue, [repo]);
+                        const pullRequest = slackPullRequestLink(mergedPullRequest);
                         const root = await this.#slack.postThread({
                             channel,
-                            text: `${issue.key}: PR merged; ${systemOfRecord}.`,
+                            text: `${subject}\nPR merged · ${pullRequest} · ${systemOfRecord}`,
                         });
-                        await this.#slack.reply(root.threadId, `${issue.key}: ${systemOfRecord}.`);
+                        await this.#slack.reply(root.threadId, `${subject}\n${systemOfRecord} · ${pullRequest}`);
                         this.#recordSlackWritebackSuccess('merge-done-thread');
                     }
                 }
@@ -9543,7 +10966,7 @@ export class FactoryLoop {
         // tracked PR identity left. Keep the scan simple and prefer branch identity
         // over title/body references to avoid "related to AR-N" body false positives.
         const githubSource = await this.#issueSource() === 'github';
-        const paths = githubSource ? await this.#githubIssuePaths() : await this.#mount.listTree(ISSUE_ROOT);
+        const paths = githubSource ? await this.#githubIssuePaths() : await this.#listRelayfileTree(ISSUE_ROOT, 'merge advance issue scan');
         for (const path of paths) {
             if (githubSource ? !isGithubIssueFilePath(path) : !isIssueFilePath(path)) {
                 continue;
@@ -10009,10 +11432,12 @@ export class FactoryLoop {
         const found = [];
         for (const root of roots) {
             try {
-                const tree = await this.#mount.listTree(root);
+                const tree = await this.#listRelayfileTree(root, 'PR meta path discovery');
                 found.push(...tree.filter((path) => path.endsWith('.json') && numberSegment.test(path)));
             }
-            catch {
+            catch (error) {
+                if (relayfileOverload(error))
+                    throw error;
                 // try the next root
             }
         }
@@ -10119,20 +11544,26 @@ export class FactoryLoop {
             }
             if (!await this.#saveDispatchLifecycle(record, 'writeback-applied'))
                 return;
-            if (this.#slack && this.#config.slack && !await this.#shouldSkipSlackWriteback('completion-thread')) {
+            if (issue && this.#slack && this.#config.slack && !await this.#shouldSkipSlackWriteback('completion-thread')) {
                 try {
                     const channel = await this.#slackChannelDir();
                     if (channel) {
                         const merged = opts.completionReason === 'pr-merged';
                         const systemOfRecord = githubIssue ? 'GitHub status' : 'Linear state';
-                        const completionText = merged
-                            ? `${record.issue.key}: PR merged; ${systemOfRecord} set to ${statusLabel}.`
-                            : `${record.issue.key}: factory agents completed${humanReview ? '; awaiting human review' : ''}.\nStatus: ${statusLabel}\nMerge policy: ${this.#config.mergePolicy}`;
-                        const stateText = merged
-                            ? `${record.issue.key}: ${systemOfRecord} set to ${statusLabel}.`
-                            : humanReview
-                                ? `${record.issue.key}: awaiting human review; ${systemOfRecord} set to ${statusLabel}.`
-                                : `${record.issue.key}: ${systemOfRecord} set to ${statusLabel}.`;
+                        const pullRequests = await this.#slackPullRequestRefs(record, opts.mergedPullRequest ? [opts.mergedPullRequest] : []);
+                        const pullRequestLinks = pullRequests.map(slackPullRequestLink).join(' · ');
+                        const subject = slackIssueSubject(issue, slackNotificationRepos(record.decision));
+                        const stateResult = githubIssue && merged && !humanReview
+                            ? 'GitHub issue closed'
+                            : `${systemOfRecord} set to ${statusLabel}`;
+                        const completionText = [
+                            subject,
+                            merged
+                                ? `PR merged${pullRequestLinks ? ` · ${pullRequestLinks}` : ''} · ${stateResult}`
+                                : `Completed${humanReview ? ' · awaiting human review' : ''}${pullRequestLinks ? ` · ${pullRequestLinks}` : ''}`,
+                            ...(!merged ? [`Status: ${statusLabel} · Merge policy: ${this.#config.mergePolicy}`] : []),
+                        ].join('\n');
+                        const stateText = `${subject}\n${stateResult}${pullRequestLinks ? ` · ${pullRequestLinks}` : ''}`;
                         const root = await this.#slack.postThread({
                             channel,
                             text: completionText,
@@ -10205,6 +11636,124 @@ export class FactoryLoop {
             }
         }
     }
+    async #notifyTicketDispatch(decision, issue, record, result) {
+        const hook = this.#config.hooks?.onTicketDispatch;
+        if (!hook || result.dryRun)
+            return;
+        const agent = result.agents.find((candidate) => candidate.role === 'implementer')
+            ?? result.agents.find((candidate) => candidate.role === 'workflow')
+            ?? result.agents[0];
+        if (!agent)
+            return;
+        if (!await this.#claimTicketDispatchNotification(record))
+            return;
+        const tracked = record.agents.get(agent.name);
+        const payload = {
+            eventType: 'ticket.dispatched',
+            summary: `Ticket dispatched: ${issue.title} → ${agent.name}.`,
+            issue: {
+                id: issue.uuid,
+                title: issue.title,
+                url: dispatchIssueUrl(issue),
+            },
+            agent: {
+                name: agent.name,
+                sessionRef: tracked?.sessionRef ?? null,
+            },
+            sessionOwner: dispatchSessionOwner(decision) ?? null,
+            timestamp: new Date(this.#clock.now()).toISOString(),
+        };
+        const text = ticketDispatchNotificationText(payload);
+        for (const target of hook.notify) {
+            if (target.surface === 'linear' && !target.commentOnIssue)
+                continue;
+            try {
+                switch (target.surface) {
+                    case 'relay':
+                        await this.#fleet.sendMessage({
+                            to: `#${target.channel.replace(/^#/u, '')}`,
+                            text,
+                        });
+                        break;
+                    case 'slack':
+                        if (!target.channel && !target.dm) {
+                            throw new Error('Slack ticket-dispatch notification needs channel and/or dm');
+                        }
+                        await this.#ticketDispatchDelivery.slack({
+                            channel: target.channel,
+                            dm: target.dm,
+                            text,
+                        });
+                        break;
+                    case 'telegram':
+                        await this.#ticketDispatchDelivery.telegram({ chatId: target.chatId, text });
+                        break;
+                    case 'linear':
+                        if (isGithubIssue(issue)) {
+                            throw new Error('Linear ticket-dispatch comments require a Linear issue');
+                        }
+                        await this.#linear.postComment(issue, text);
+                        break;
+                }
+                this.#increment('ticketDispatchHookNotifications');
+            }
+            catch (error) {
+                this.#increment('ticketDispatchHookFailures');
+                this.#logger.warn?.('[factory] onTicketDispatch notification failed', {
+                    issue: issue.key,
+                    surface: target.surface,
+                    error: describeError(error).errorMessage,
+                });
+            }
+        }
+    }
+    async #claimTicketDispatchNotification(record) {
+        if (record.dryRun || !this.#usesDurableDispatchLifecycle())
+            return true;
+        const key = issueKey(record.issue);
+        return this.#serializeDispatchLifecyclePersistence(key, async () => {
+            const epoch = this.#dispatchLifecycleEpochs.get(key);
+            if (epoch === undefined) {
+                this.#scheduleDispatchLifecycleRetry(record);
+                return false;
+            }
+            const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
+            if (!lifecycle) {
+                this.#scheduleDispatchLifecycleRetry(record);
+                return false;
+            }
+            const workUnitId = lifecycle.runId;
+            if (lifecycle.ticketDispatchNotification?.workUnitId === workUnitId)
+                return false;
+            // Reserve the work unit before external side effects. Hook delivery is
+            // best-effort per target, so takeover must prefer at-most-once fan-out
+            // over replaying a notification whose provider acknowledgement was lost.
+            // Follow-up for provider-idempotent retries: https://github.com/AgentWorkforce/factory/issues/239
+            const claimedAtMs = this.#clock.now();
+            const claimedLifecycle = {
+                ...lifecycle,
+                ticketDispatchNotification: { workUnitId, claimedAtMs },
+                updatedAtMs: claimedAtMs,
+            };
+            const saved = await this.#state.saveDispatchLifecycle(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch, claimedAtMs, claimedLifecycle);
+            if (!saved) {
+                this.#dispatchLifecycleEpochs.delete(key);
+                this.#increment('dispatchLifecycleFencesRejected');
+                await this.#reportLifecycle(claimedLifecycle, 'factory.anomaly', {
+                    level: 'error',
+                    errorCode: 'fence_rejected',
+                });
+                this.#scheduleDispatchLifecycleRetry(record);
+                return false;
+            }
+            return true;
+        });
+    }
+    #ticketDispatchNotificationIsPending(lifecycle) {
+        return Boolean(this.#config.hooks?.onTicketDispatch) &&
+            !lifecycle.dryRun &&
+            lifecycle.ticketDispatchNotification?.workUnitId !== lifecycle.runId;
+    }
     #error(error, issue) {
         this.#increment('errors');
         const details = describeError(error);
@@ -10490,7 +12039,30 @@ export class FactoryLoop {
         this.#logger.warn?.('[factory] cleared invalid persisted Slack thread id', { issue: key });
         return undefined;
     }
-    async #ensureSlackDispatchThread(record, result) {
+    async #slackPullRequestRefs(record, additional = []) {
+        const lifecycle = await this.#state
+            .getDispatchLifecycle(this.#workspaceId, issueKey(record.issue))
+            .catch(() => undefined);
+        const lifecycleRefs = publishedPullRequests(lifecycle).map((receipt) => ({
+            repo: receipt.repo,
+            number: receipt.number,
+            url: receipt.url,
+        }));
+        const trackedRefs = [...record.agents.values()]
+            .map((tracked) => tracked.spec.ownedPullRequest)
+            .filter((ref) => Boolean(ref))
+            .map((ref) => ({ repo: ref.repo, number: ref.number }));
+        const babysitterRefs = [...this.#babysitterPr.entries()]
+            .filter(([key]) => issueKey(this.#babysitterIssueRefs.get(key) ?? record.issue) === issueKey(record.issue))
+            .map(([, ref]) => ({ repo: ref.repo, number: ref.prNumber }));
+        return uniqueSlackPullRequestRefs([
+            ...additional,
+            ...lifecycleRefs,
+            ...babysitterRefs,
+            ...trackedRefs,
+        ]);
+    }
+    async #ensureSlackDispatchThread(record, result, sourceIssue) {
         if (!this.#slack || !this.#config.slack || result.dryRun) {
             return;
         }
@@ -10526,7 +12098,7 @@ export class FactoryLoop {
             }
             return;
         }
-        const start = this.#postAndWatchSlackDispatchThread(record, result);
+        const start = this.#postAndWatchSlackDispatchThread(record, result, sourceIssue);
         this.#slackWatcherStarts.set(key, start);
         try {
             await start;
@@ -10539,19 +12111,24 @@ export class FactoryLoop {
             this.#slackWatcherStarts.delete(key);
         }
     }
-    async #postAndWatchSlackDispatchThread(record, result) {
+    async #postAndWatchSlackDispatchThread(record, result, sourceIssue) {
         if (!this.#slack || !this.#config.slack) {
             return;
         }
-        const previews = uniquePreviewReferences(result.previews ?? []);
+        const issue = sourceIssue ?? await this.#readIssue(record.issue.path);
+        if (!issue) {
+            throw new Error(`Unable to describe Slack dispatch notification for unreadable issue ${record.issue.key}`);
+        }
+        const previews = uniquePreviewReferences(result.previews ?? this.#previewReferences.get(issueKey(record.issue)) ?? []);
+        const repos = slackNotificationRepos(record.decision);
         const root = await this.#slack.postThread({
             channel: await this.#slackChannelDir() ?? this.#config.slack.channel,
             text: [
-                `${record.issue.key}: factory agents dispatched.`,
-                `State: ${result.stateId ?? 'dispatching'} · Agents: ${result.agents.map((agent) => agent.name).join(', ') || 'none'}`,
+                slackIssueSubject(issue, repos),
+                `Dispatched · ${result.agents.map((agent) => agent.name).join(', ') || 'no agents'} · Repos: ${slackRepoList(repos)}`,
                 ...(previews.length > 0
                     ? [previews.map((preview) => `Live preview (${preview.repo}, tailnet access required): ${preview.url}`).join(' · ')]
-                    : []),
+                    : [`State: ${result.stateId ?? 'dispatching'}`]),
             ].join('\n'),
         });
         await this.#state.setSlackThread(this.#workspaceId, issueKey(record.issue), root.threadId);
@@ -10914,13 +12491,13 @@ export class FactoryLoop {
             .filter((part) => Boolean(part))
             .join(' ');
         const replyInstruction = source?.url
-            ? `Reply on the GitHub issue so Factory can resume: ${source.url}`
+            ? 'Reply on the linked GitHub issue so Factory can resume.'
             : 'Reply on the source GitHub issue so Factory can resume.';
         const root = await this.#slack.postThread({
             channel: await this.#slackChannelDir() ?? this.#config.slack.channel,
             text: [
-                `${audience ? `${audience} ` : ''}${decision.issue.key}: factory triage escalation for ${issue.title}`,
-                `Reason: ${reason}`,
+                `${audience ? `${audience} ` : ''}${slackIssueSubject(issue, slackNotificationRepos(decision))}`,
+                `Triage blocked · Reason: ${reason}`,
                 `Question: ${triageEscalationQuestion(decision, issue)} ${replyInstruction}`,
             ].join('\n'),
         });
@@ -10999,9 +12576,11 @@ export class FactoryLoop {
     async #findSlackUserIdByIdentity(identity) {
         const list = async (prefix) => {
             try {
-                return await this.#mount.listTree(prefix);
+                return await this.#listRelayfileTree(prefix, 'Slack identity lookup');
             }
-            catch {
+            catch (error) {
+                if (relayfileOverload(error))
+                    throw error;
                 return [];
             }
         };
@@ -11042,12 +12621,15 @@ export class FactoryLoop {
             return;
         }
         const issue = await this.#readIssue(decision.issue.path);
+        if (!issue) {
+            throw new Error(`Unable to describe Slack triage escalation for unreadable issue ${decision.issue.key}`);
+        }
         const stakeholderMentions = slackMentions(this.#config.slack.stakeholderUserIds);
         const root = await this.#slack.postThread({
             channel: await this.#slackChannelDir() ?? this.#config.slack.channel,
             text: [
-                `${stakeholderMentions ? `${stakeholderMentions} ` : ''}${decision.issue.key}: factory triage escalation for ${issue?.title ?? decision.issue.key}`,
-                `Reason: ${reason}`,
+                `${stakeholderMentions ? `${stakeholderMentions} ` : ''}${slackIssueSubject(issue, slackNotificationRepos(decision))}`,
+                `Triage blocked · Reason: ${reason}`,
                 `Question: ${triageEscalationQuestion(decision, issue)}`,
             ].join('\n'),
         });
@@ -11390,7 +12972,11 @@ export class FactoryLoop {
                 waitingAgeMs,
             });
             try {
-                await this.#slack.reply(waiting.threadId, clarificationStaleSlackText(escalated, this.#config.slack.stakeholderUserIds));
+                const issue = await this.#readIssue(escalated.issue.path);
+                if (!issue) {
+                    throw new Error(`Unable to describe stale Slack clarification for unreadable issue ${escalated.issue.key}`);
+                }
+                await this.#slack.reply(waiting.threadId, clarificationStaleSlackText(escalated, issue, this.#config.slack.stakeholderUserIds));
                 const completed = await this.#state.completeClarificationEscalation(this.#workspaceId, key, this.#clarificationWakeOwner, this.#clock.now());
                 if (!completed) {
                     this.#increment('clarificationEscalationOwnershipLost');
@@ -11654,6 +13240,9 @@ export class FactoryLoop {
                 this.#increment('clarificationWakesQueuedForCapacity');
                 return;
             }
+            // A human-answer wake starts a new agent-hold generation. Time spent
+            // parked with the previous team released must not consume its deadline.
+            record.heldSinceAtMs = undefined;
             if (!await this.#saveDispatchLifecycle(record, 'dispatching')) {
                 batch.complete(waiting.issue);
                 await this.#state.releaseClarificationWake(this.#workspaceId, key, this.#clarificationWakeOwner);
@@ -11683,8 +13272,10 @@ export class FactoryLoop {
                         }
                         : await this.#resumeOrColdStartClarificationAgent(parked.name, tracked, waiting);
                     const invocationId = batch.invocationIdFor(record.issue, tracked.spec);
+                    record.heldSinceAtMs ??= this.#clock.now();
                     batch.recordSpawn(record, tracked.spec, invocationId, result);
                     await this.#saveDispatchLifecycle(record, 'dispatching');
+                    this.#scheduleHeldAgentDeadline(record);
                     const live = record.agents.get(result.name);
                     if (live) {
                         resumed.push([result.name, live]);
@@ -11978,7 +13569,7 @@ export class FactoryLoop {
         }
         let paths;
         try {
-            paths = await this.#mount.listTree('/slack/channels');
+            paths = await this.#listRelayfileTree('/slack/channels', 'Slack channel resolution');
         }
         catch (error) {
             this.#logger.warn?.('[factory] unable to resolve Slack channel from mount; using configured channel value', {
@@ -12487,6 +14078,101 @@ function dispatchSpecs(decision) {
     }
     return [...decision.implementers, decision.reviewer];
 }
+function dispatchSessionOwner(decision) {
+    for (const spec of dispatchSpecs(decision)) {
+        const sessionOwner = spec.principal?.trim() || spec.owner?.trim();
+        if (sessionOwner)
+            return sessionOwner;
+    }
+    return undefined;
+}
+function dispatchIssueUrl(issue) {
+    const payload = wrappedPayload(issue.raw);
+    const source = asRecord(payload.source);
+    return stringValue(payload.url)
+        ?? stringValue(payload.html_url)
+        ?? stringValue(source?.url)
+        ?? issue.path;
+}
+const SLACK_ISSUE_TITLE_MAX_LENGTH = 120;
+function slackEscapeText(value) {
+    return value
+        .replace(/&/gu, '&amp;')
+        .replace(/</gu, '&lt;')
+        .replace(/>/gu, '&gt;');
+}
+function slackLinkUrl(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' && url.protocol !== 'http:')
+            return undefined;
+        return url.toString()
+            .replace(/\|/gu, '%7C')
+            .replace(/</gu, '%3C')
+            .replace(/>/gu, '%3E');
+    }
+    catch {
+        return undefined;
+    }
+}
+function truncateSlackIssueTitle(title) {
+    const normalized = title.replace(/\s+/gu, ' ').trim() || 'Untitled issue';
+    const characters = Array.from(normalized);
+    if (characters.length <= SLACK_ISSUE_TITLE_MAX_LENGTH)
+        return normalized;
+    return `${characters.slice(0, SLACK_ISSUE_TITLE_MAX_LENGTH - 1).join('').trimEnd()}…`;
+}
+function slackRepoName(repo) {
+    const normalized = repo.trim().replace(/^\/+|\/+$/gu, '');
+    return normalized.slice(normalized.lastIndexOf('/') + 1) || normalized || 'unknown repo';
+}
+function slackNotificationRepos(decision) {
+    const repos = [
+        ...decision.routes.map((route) => route.repo),
+        ...decision.implementers.map((implementer) => implementer.repo),
+    ];
+    return [...new Map(repos
+            .filter((repo) => Boolean(repo.trim()))
+            .map((repo) => [repo.trim().toLowerCase(), repo.trim()])).values()];
+}
+function slackRepoList(repos) {
+    const names = [...new Set(repos.map(slackRepoName))];
+    return slackEscapeText(names.join(', ') || 'unknown repo');
+}
+function slackIssueSubject(issue, repos = []) {
+    const githubSource = githubIssueSourceRef(issue);
+    const githubPath = githubIssuePathParts(issue.path);
+    const githubIdentity = githubSource ?? githubPath;
+    const payload = wrappedPayload(issue.raw);
+    const source = asRecord(payload.source);
+    const fallbackIssueUrl = githubIdentity
+        ? `https://github.com/${githubIdentity.owner}/${githubIdentity.repo}/issues/${githubIdentity.number}`
+        : `https://linear.app/issue/${encodeURIComponent(issue.key)}`;
+    const issueUrl = slackLinkUrl(githubSource?.url
+        ?? stringValue(payload.url)
+        ?? stringValue(payload.html_url)
+        ?? stringValue(source?.url)
+        ?? fallbackIssueUrl) ?? fallbackIssueUrl;
+    const repoNames = [...new Set(repos.map(slackRepoName))];
+    const label = githubIdentity
+        ? `${githubIdentity.repo}#${githubIdentity.number}`
+        : `${repoNames.join(', ') || 'unknown repo'} · ${issue.key}`;
+    return `<${issueUrl}|${slackEscapeText(label)}> — ${slackEscapeText(truncateSlackIssueTitle(issue.title))}`;
+}
+function slackPullRequestLink(pullRequest) {
+    const fallbackUrl = `https://github.com/${pullRequest.repo}/pull/${pullRequest.number}`;
+    const url = slackLinkUrl(pullRequest.url ?? fallbackUrl) ?? fallbackUrl;
+    const label = `${slackRepoName(pullRequest.repo)}#${pullRequest.number}`;
+    return `<${url}|${slackEscapeText(label)}>`;
+}
+function uniqueSlackPullRequestRefs(refs) {
+    return [...new Map(refs
+            .filter((ref) => Boolean(ref.repo.trim()) && Number.isSafeInteger(ref.number) && ref.number > 0)
+            .map((ref) => [`${ref.repo.trim().toLowerCase()}#${ref.number}`, { ...ref, repo: ref.repo.trim() }])).values()];
+}
+function ticketDispatchNotificationText(payload) {
+    return `${payload.summary}\n${JSON.stringify(payload)}`;
+}
 function previewServiceForRepo(config, repo) {
     const services = config.preview?.services;
     if (!services)
@@ -12819,7 +14505,8 @@ function decisionWithLifecycleBranches(decision, runId, opts = {}) {
             ...(opts.isolateLocalWorktree && baseClonePath && branch ? { baseClonePath, clonePath } : {}),
             // The same persisted lifecycle reuses this id after takeover, while a
             // genuine reopen gets a new id and cannot replay an old placement ack.
-            invocationId: `factory:${decision.issue.key}:${runId}:${spec.role}:${sanitizeAgentSlug(spec.name)}`,
+            invocationId: spec.invocationId ??
+                `factory:${decision.issue.key}:${runId}:${spec.role}:${sanitizeAgentSlug(spec.name)}`,
         };
         return branch ? { ...lifecycleSpec, branch } : lifecycleSpec;
     };
@@ -13226,17 +14913,19 @@ const linearIssueMirrorsGithubIssue = (issue, ghIssue) => {
         .split(/\r?\n/u)
         .some((line) => line.trim() === `${GITHUB_MIRROR_SOURCE_PREFIX}${ghIssue.url}`);
 };
-const resolveIssuePrFromMount = async (mount, config, issue, opts = {}) => {
+const resolveIssuePrFromMount = async (mount, config, issue, opts = {}, listTree = (prefix) => mount.listTree(prefix)) => {
     const candidates = [];
     const listErrors = [];
     for (const repo of opts.repo ? [opts.repo] : reposFromConfig(config)) {
         const paths = new Set();
         for (const root of githubPullRoots(repo)) {
             try {
-                for (const path of await mount.listTree(root))
+                for (const path of await listTree(root))
                     paths.add(path);
             }
             catch (error) {
+                if (relayfileOverload(error))
+                    throw error;
                 listErrors.push(error);
             }
         }
@@ -13503,8 +15192,7 @@ const issuePrMatchScore = (pr, issue, marker, opts = {}) => {
 };
 const hasTitlePrefix = (title, marker) => title === marker || title.startsWith(`${marker} `);
 const factoryBranchMatchesIssue = (headRef, issueKey) => /^\d+$/u.test(issueKey)
-    ? headRef.toLowerCase() === `factory/${issueKey.toLowerCase()}` ||
-        headRef.toLowerCase().startsWith(`factory/${issueKey.toLowerCase()}-`)
+    ? factoryBranchBelongsToIssue(headRef, issueKey)
     : containsIssueKey(headRef, issueKey);
 // Legacy Factory runs created GitHub-native branches as `<issue-number>-*`
 // before the current `factory/<issue>-*` convention. Keep this matcher out of
@@ -14068,6 +15756,75 @@ const eventOccurredAtMs = (event) => {
     const parsed = timestamp ? Date.parse(timestamp) : Number.NaN;
     return Number.isFinite(parsed) ? parsed : undefined;
 };
+const discoveryEventId = (event) => {
+    const flat = asRecord(event) ?? {};
+    const id = flat.id ?? flat.eventId ?? flat.event_id ?? flat.seq;
+    return typeof id === 'string' || typeof id === 'number' ? String(id) : undefined;
+};
+const compareDiscoveryEvents = (left, right) => {
+    const leftOccurredAt = eventOccurredAtMs(left);
+    const rightOccurredAt = eventOccurredAtMs(right);
+    if (leftOccurredAt !== undefined && rightOccurredAt !== undefined && leftOccurredAt !== rightOccurredAt) {
+        return leftOccurredAt - rightOccurredAt;
+    }
+    const leftId = discoveryEventId(left) ?? '';
+    const rightId = discoveryEventId(right) ?? '';
+    const leftSequence = eventSequenceNumber(leftId);
+    const rightSequence = eventSequenceNumber(rightId);
+    if (leftSequence !== undefined && rightSequence !== undefined && leftSequence !== rightSequence) {
+        return leftSequence - rightSequence;
+    }
+    return leftId.localeCompare(rightId);
+};
+const discoveryEventIsDeletion = (event) => {
+    const flat = asRecord(event) ?? {};
+    const summary = asRecord(flat.summary) ?? {};
+    const type = stringValue(flat.type)?.toLowerCase();
+    // filesystemEventToChangeEvent normalizes filesystem watcher events to
+    // type: 'relayfile.changed' and stashes the real operation here, so a
+    // deletion arrives as filesystemEventType: 'file.deleted' / 'dir.deleted'
+    // with an outer type that does not itself say "deleted".
+    const filesystemEventType = stringValue(flat.filesystemEventType)?.toLowerCase();
+    const action = stringValue(flat.action)?.toLowerCase();
+    const status = stringValue(summary.status)?.toLowerCase();
+    const digest = stringValue(flat.digest)?.toLowerCase();
+    return type === 'file.deleted' || type === 'dir.deleted' ||
+        filesystemEventType === 'file.deleted' || filesystemEventType === 'dir.deleted' ||
+        action === 'delete' || status === 'deleted' || digest?.startsWith('deleted:') === true;
+};
+const githubIssueIndexRepoRoots = (path) => {
+    const slash = /^\/github\/repos\/([^/]+)\/([^/]+)\/issues\/_index\.json$/u.exec(path);
+    const flat = /^\/github\/repos\/([^/]+)__([^/]+)\/issues\/_index\.json$/u.exec(path);
+    const parts = slash ?? flat;
+    if (!parts)
+        return [];
+    const [, owner, repo] = parts;
+    return [
+        `/github/repos/${owner}/${repo}/issues`,
+        `/github/repos/${owner}__${repo}/issues`,
+    ];
+};
+const relayfileOverload = (error) => {
+    const flat = asRecord(error) ?? {};
+    const response = asRecord(flat.response) ?? {};
+    const data = asRecord(flat.data) ?? asRecord(response.data) ?? {};
+    const details = asRecord(flat.details) ?? asRecord(data.details) ?? {};
+    const statusValue = flat.status ?? flat.statusCode ?? response.status ?? response.statusCode;
+    const status = typeof statusValue === 'number' ? statusValue : Number(statusValue);
+    if (status !== 429)
+        return undefined;
+    const retryValue = flat.retryAfterSeconds ?? details.retryAfterSeconds ?? data.retryAfterSeconds;
+    const parsedRetry = typeof retryValue === 'number' ? retryValue : Number(retryValue);
+    const retryAfterSeconds = Number.isFinite(parsedRetry) && parsedRetry >= 0 ? parsedRetry : undefined;
+    const reason = stringValue(flat.reason) ?? stringValue(details.reason) ?? stringValue(data.reason) ??
+        stringValue(flat.code) ?? stringValue(data.code) ?? 'rate_limited';
+    return { status, reason, ...(retryAfterSeconds === undefined ? {} : { retryAfterSeconds }) };
+};
+const discoveryOverloadBackoffMs = (retryAfterSeconds, consecutiveOverloads) => {
+    const retryAfterMs = Math.max(0, Math.ceil((retryAfterSeconds ?? 0) * 1_000));
+    const exponentialMs = Math.min(DISCOVERY_OVERLOAD_BACKOFF_MAX_MS, 5_000 * (2 ** Math.min(10, Math.max(0, consecutiveOverloads - 1))));
+    return Math.max(retryAfterMs, exponentialMs);
+};
 const eventSequenceNumber = (eventId) => {
     const whole = Number(eventId);
     if (Number.isFinite(whole))
@@ -14183,7 +15940,8 @@ const eventIdentity = (event) => {
 // subscription/poll handler) crash-loops. Returns undefined for such events so
 // callers skip them and keep processing the well-formed ones.
 export const changeEventPath = (event) => {
-    const path = event?.resource?.path;
+    const candidate = event;
+    const path = candidate?.resource?.path ?? candidate?.path;
     return typeof path === 'string' && path ? path : undefined;
 };
 const describeError = (error) => {
@@ -14350,6 +16108,28 @@ const durableBabysitterTrackedAgent = (session, capability = 'spawn:claude') =>
 });
 const isTerminalDispatchLifecycle = (lifecycle) => lifecycle.phase === 'complete' || lifecycle.phase === 'abandoned';
 const isTerminalDispatchPhase = (phase) => phase === 'complete' || phase === 'abandoned';
+const heldAgentsForRecord = (record, nowMs, holdTimeoutMs, terminalState) => {
+    if (record.dryRun || record.heldSinceAtMs === undefined)
+        return [];
+    const heldSinceAtMs = record.heldSinceAtMs;
+    const holdDeadlineAtMs = heldSinceAtMs + holdTimeoutMs;
+    const heldForMs = Math.max(0, nowMs - heldSinceAtMs);
+    return [...record.agents]
+        .filter(([, tracked]) => Boolean(tracked.result))
+        .map(([name, tracked]) => ({
+        name,
+        role: tracked.spec.role,
+        issue: { ...record.issue },
+        ...(record.lifecyclePhase ? { lifecyclePhase: record.lifecyclePhase } : {}),
+        waitingForTerminalState: terminalState,
+        heldSince: new Date(heldSinceAtMs).toISOString(),
+        heldSinceAtMs,
+        heldForMs,
+        holdDeadline: new Date(holdDeadlineAtMs).toISOString(),
+        holdDeadlineAtMs,
+        pastDeadline: nowMs >= holdDeadlineAtMs,
+    }));
+};
 const costUsageGroupId = (runId, tracked) => JSON.stringify([runId, tracked.spec.invocationId ?? tracked.spec.name]);
 const costEntryId = (groupId, model) => JSON.stringify([groupId, model]);
 const publishedPullRequests = (lifecycle) => {
@@ -14390,10 +16170,12 @@ const lifecycleFromInFlightRecord = (record, runId, phase, updatedAtMs, pullRequ
     agents: [...record.agents].map(([name, tracked]) => ({ name, tracked: cloneTrackedAgent(tracked) })),
     invocationIds: [...record.invocationIds],
     result: record.result ? structuredClone(record.result) : undefined,
+    ...(record.dispatchClaim ? { dispatchClaim: { ...record.dispatchClaim } } : {}),
     ...(pullRequests.length > 0 ? { pullRequests: pullRequests.map((receipt) => ({ ...receipt })) } : {}),
     ...(pullRequest ? { pullRequest: { ...pullRequest } } : {}),
     ...(releaseReason ? { releaseReason } : {}),
     ...(cost ? { cost: structuredClone(cost) } : {}),
+    ...(record.heldSinceAtMs !== undefined ? { heldSinceAtMs: record.heldSinceAtMs } : {}),
     updatedAtMs,
 });
 const inFlightRecordFromLifecycle = (lifecycle) => ({
@@ -14403,6 +16185,11 @@ const inFlightRecordFromLifecycle = (lifecycle) => ({
     agents: new Map(lifecycle.agents.map((agent) => [agent.name, cloneTrackedAgent(agent.tracked)])),
     invocationIds: new Set(lifecycle.invocationIds),
     result: lifecycle.result ? structuredClone(lifecycle.result) : undefined,
+    ...(lifecycle.dispatchClaim ? { dispatchClaim: { ...lifecycle.dispatchClaim } } : {}),
+    heldSinceAtMs: lifecycle.heldSinceAtMs ?? (lifecycle.agents.some((agent) => agent.releasedAtMs === undefined)
+        ? lifecycle.updatedAtMs
+        : undefined),
+    lifecyclePhase: lifecycle.phase,
 });
 const dispatchResultFromLifecycle = (lifecycle) => lifecycle.result ? structuredClone(lifecycle.result) : {
     issue: { ...lifecycle.issue },
@@ -14597,14 +16384,14 @@ const slackUserIdMatchingIdentity = (payload, identity) => {
         ? userId
         : undefined;
 };
-const agentQuestionSlackText = (issue, question, stakeholderUserIds = []) => [
-    slackMentions(stakeholderUserIds),
-    `${issue.key}: ${question.agentName} needs input.`,
+const agentQuestionSlackText = (issue, question, stakeholderUserIds = [], repos = []) => [
+    `${slackMentions(stakeholderUserIds) ?? ''} ${slackIssueSubject(issue, repos)}`.trim(),
+    `${question.agentName} needs input.`,
     `Question: ${question.question}`,
 ].filter((line) => Boolean(line)).join('\n');
-const clarificationStaleSlackText = (waiting, stakeholderUserIds = []) => [
-    slackMentions(stakeholderUserIds),
-    `${waiting.issue.key} has been parked for seven days without a reply.`,
+const clarificationStaleSlackText = (waiting, issue, stakeholderUserIds = []) => [
+    `${slackMentions(stakeholderUserIds) ?? ''} ${slackIssueSubject(issue, slackNotificationRepos(waiting.decision))}`.trim(),
+    'This issue has been parked for seven days without a reply.',
     `Question from ${waiting.askerName}: ${waiting.question} Reply in this thread to wake the saved agent team, or move the issue out of Agent Implementing to cancel the wake.`,
 ].filter((line) => Boolean(line)).join('\n');
 const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');