@agent-relay/factory 0.1.60 → 0.1.63

package/dist/orchestrator/factory.js

@@ -5,6 +5,7 @@ import { FactoryConfigSchema } from '../config/schema.js';
 import { linearByStatePath, linearByIdPath, linearByUuidPath } from '../constants/linear.js';
 import { stateResolutionFromIds } from '../linear/state-resolver.js';
 import { GithubMergeGate, closeProbePr } from '../github/index.js';
+import { factoryGithubIssueCommentDraftName, isFactoryGithubIssueCommentDraftName, isFactoryGithubOperationDraftName, } from '../github/writeback-paths.js';
 import { VerificationPipeline } from '../environments/verification-pipeline.js';
 import { factoryWorktreeIssueSlug, factoryWorktreePath } from '../git/agent-worktree.js';
 import { InMemoryStateStore } from '../state/in-memory-state-store.js';
@@ -12,13 +13,14 @@ import { containsExplicitIssueReference, containsIssueKey, factoryBranchBelongsT
 import { normalizeLogger, normalizeLogValue, setSafeErrorStack, stringifyLogValue } from '../logging.js';
 import { isInFactoryScope } from '../safety/factory-scope.js';
 import { dispatchRelayflowForChangeEvent } from '../dispatch/relayflow-registry.js';
+import { dispatchAgentIdentityKey } from '../dispatch/work-unit-identity.js';
 import { deriveDescriptorsFromMount, prescriptiveInstructions, } from '@agent-relay/integration-prompts';
 import { parseGithubHumanInputRequest, renderAgentTask, } from '../dispatch/templates.js';
 import { resolveTestGuidance } from '../dispatch/test-guidance.js';
-import { HeuristicTriage, TieredTriage, babysitterSpec, isShapeLabel, scopeFromLabels } from '../triage/index.js';
+import { HeuristicTriage, TieredTriage, babysitterSpec, isShapeLabel, scopeFromLabels, swarmChannel, swarmMemberSlugs, swarmTaskFor } from '../triage/index.js';
 import { agentNameForRole, sanitizeAgentSlug } from '../triage/agent-names.js';
 import { isResourceSubscriptionsUnavailable } from '../subscriptions/index.js';
-import { GhCliGithubWriteback, MountGithubRead, MountLinearWriteback, MountSlackWriteback, slackChannelAliases, slackChannelSegment } from '../writeback/index.js';
+import { AppGithubWriteback, FACTORY_GITHUB_STATUS_LABELS, GhCliGithubWriteback, MountGithubRead, MountLinearWriteback, MountSlackWriteback, slackChannelAliases, slackChannelSegment } from '../writeback/index.js';
 import { parseSlackThreadReply, slackThreadReplyGlob } from '../subscriptions/slack-filter.js';
 import { asRecord, parseJsonContent, stableHash, wrappedPayload } from '../writeback/shared.js';
 import { issueKey, } from './batch-tracker.js';
@@ -29,6 +31,7 @@ import { readFactoryInFlightRegistry, terminatePids } from './reaper.js';
 import { createFactoryCloudEventV1, factoryCloudReleaseReasonV1, } from '../observability/events.js';
 import { boundedRunCostTotal, CostLedger } from '../cost/ledger.js';
 import { createTicketDispatchDelivery } from '../delivery/ticket-dispatch.js';
+import { FleetControlPlaneCircuit, FleetControlPlaneCircuitOpenError, guardFleetControlPlane, } from '../fleet/control-plane-circuit.js';
 class ClarificationWakeLeaseLostError extends Error {
 }
 class ClarificationQuestionDeliveryLeaseLostError extends Error {
@@ -137,6 +140,8 @@ const DISPATCH_LIFECYCLE_RENEW_MS = 60_000;
 const DISPATCH_LIFECYCLE_RETRY_MS = 1_000;
 const DISPATCH_WRITEBACK_MAX_ATTEMPTS = 3;
 const DISPATCH_WRITEBACK_RETRY_MS = 250;
+const HELD_PAST_DEADLINE_RELEASE_REASON = 'held-past-deadline';
+const HELD_DEADLINE_OVERDUE_RETRY_MS = 1_000;
 const STARTUP_AGENT_EXIT_DRAIN_TIMEOUT_MS = 30_000;
 const RECONCILED_AGENT_EXIT_CONCURRENCY = 4;
 const SLACK_EVENT_WATERMARK_CACHE_MS = 60_000;
@@ -152,6 +157,7 @@ const REMOTE_OPERATION_PROGRESS_INTERVAL_MS = 15_000;
 const REMOTE_OPERATION_SLOW_WARN_MS = 30_000;
 const DISCOVERY_SWEEP_LEASE_MS = 5 * 60_000;
 const DISCOVERY_SWEEP_RENEW_MS = 30_000;
+const READINESS_RECONCILE_FAILURE_THRESHOLD = 3;
 const DISCOVERY_CHANGE_EVENT_LIMIT = 1_000;
 const DISCOVERY_OVERLOAD_BACKOFF_MAX_MS = 5 * 60_000;
 const GITHUB_FACTORY_LABEL = 'factory';
@@ -221,6 +227,7 @@ export class FactoryLoop {
     #mount;
     #states;
     #fleet;
+    #fleetControlPlane;
     #ticketDispatchDelivery;
     #triage;
     #linear;
@@ -310,6 +317,9 @@ export class FactoryLoop {
     #dispatchClaimStatuses = new Map();
     #localReleaseCheckpoints = new Map();
     #dispatchLifecycleRenewTimer;
+    #heldAgentDeadlineTimer;
+    #heldAgentDeadlineDueAtMs;
+    #heldAgentDeadlineSweepInFlight;
     #clarificationSweepTimer;
     #clarificationSweepDueAtMs;
     #clarificationSweepInFlight;
@@ -341,6 +351,12 @@ export class FactoryLoop {
     #readinessReconcileTimer;
     #readinessReconcileInFlight;
     #readinessReconcileIntervalMs = 60_000;
+    #readinessReconcileConsecutiveFailures = 0;
+    #readinessReconcileLastDurationMs;
+    #readinessReconcileLastStartedAtMs;
+    #readinessReconcileLastCompletedAtMs;
+    #readinessReconcileLastFailureAtMs;
+    #readinessReconcileLastError;
     #liveEventQueue = [];
     #liveEventDrainScheduled = false;
     #liveEventDrainActive = false;
@@ -419,7 +435,9 @@ export class FactoryLoop {
     #runOnceInFlightDryRun;
     #discoverySession;
     #discoverySweepEpoch;
+    #discoverySweepStartedAtMs;
     #discoverySweepRenewTimer;
+    #discoverySweepRenewalInFlight;
     #discoverySweepLeaseLost = false;
     #discoveryOverloadError;
     #resolvedIssueSource;
@@ -438,7 +456,6 @@ export class FactoryLoop {
         // synced records (state.name but no state.id) without the states catalog.
         this.#states = ports.stateResolution ?? stateResolutionFromIds(config.stateIds, config.linear.states);
         installFactoryDraftPredicate(this.#mount, config);
-        this.#fleet = ports.fleet;
         this.#ticketDispatchDelivery = ports.ticketDispatchDelivery ?? createTicketDispatchDelivery({
             mountRoot: config.localMountRoot,
         });
@@ -447,7 +464,7 @@ export class FactoryLoop {
             safety: config.safety,
         });
         this.#githubWritebackProvided = Boolean(ports.githubWriteback);
-        this.#githubWriteback = ports.githubWriteback ?? new GhCliGithubWriteback();
+        this.#githubWriteback = ports.githubWriteback ?? defaultGithubWriteback(config, ports.mount);
         this.#slack = config.slack ? MountSlackWriteback(ports.mount, config.slack) : ports.slack;
         this.#github = ports.github ?? MountGithubRead(ports.mount);
         this.#mergeGate = ports.mergeGate ?? new GithubMergeGate();
@@ -469,6 +486,13 @@ export class FactoryLoop {
         this.#probePrResolver = ports.probePrResolver ?? ((issue) => this.#resolveIssuePr(issue));
         this.#logger = normalizeLogger(ports.logger ?? console);
         this.#clock = ports.clock ?? realClock;
+        this.#fleetControlPlane = new FleetControlPlaneCircuit({
+            timeoutMs: config.fleetHealth.rosterTimeoutMs,
+            failureThreshold: config.fleetHealth.failureThreshold,
+            resetTimeoutMs: config.fleetHealth.resetTimeoutMs,
+            now: () => this.#clock.now(),
+        });
+        this.#fleet = guardFleetControlPlane(ports.fleet, this.#fleetControlPlane);
         this.#processIdentityReader = ports.processIdentityReader ?? readProcessIdentity;
         this.#processFinder = ports.processFinder ?? ((agentName, opts) => findAgentProcessByName(agentName, {
             readProcessIdentity: this.#processIdentityReader,
@@ -576,11 +600,32 @@ export class FactoryLoop {
         this.#batchView = batch;
         return batch;
     }
+    /**
+     * Resolves once this issue's durable dispatch row reaches a terminal phase,
+     * and reports which one. A caller that turns the run into an exit code needs
+     * the phase: a dispatch that hit capacity returns an empty hold result and
+     * schedules a durable retry, so the pre-wait result says nothing about how
+     * the run actually ended.
+     *
+     * `undefined` means no terminal phase was observed — there was no lifecycle
+     * row to wait on, or the wait ended because Factory is stopping.
+     */
     async waitForDispatchTerminal(issue) {
         const key = issueKey(issue);
         const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
-        if (lifecycle && isTerminalDispatchLifecycle(lifecycle))
-            return;
+        // No durable row means this dispatch never claimed a lifecycle: a
+        // dependency park, a triage escalation, and a label refusal all return
+        // before the claim. Nothing can ever become terminal, so polling would
+        // never stop and the caller would never produce an exit code at all.
+        if (!lifecycle)
+            return undefined;
+        if (isTerminalDispatchLifecycle(lifecycle))
+            return lifecycle.phase;
+        // Capture the phase at the moment this waiter observes it. The waiters are
+        // shared across callers of one row and carry no payload, so a re-read after
+        // the fact can race lifecycle cleanup or a reopened dispatch for the same
+        // issue and report a different run — or none.
+        let observedPhase;
         await new Promise((resolve) => {
             let settled = false;
             let timer;
@@ -589,10 +634,11 @@ export class FactoryLoop {
                 waiters = new Set();
                 this.#dispatchTerminalWaiters.set(key, waiters);
             }
-            const finish = () => {
+            const finish = (phase) => {
                 if (settled)
                     return;
                 settled = true;
+                observedPhase = phase;
                 if (timer)
                     clearTimeout(timer);
                 const current = this.#dispatchTerminalWaiters.get(key);
@@ -615,7 +661,7 @@ export class FactoryLoop {
                 try {
                     const latest = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
                     if (latest && isTerminalDispatchLifecycle(latest)) {
-                        this.#resolveDispatchTerminalWaiters(issue);
+                        this.#resolveDispatchTerminalWaiters(issue, latest.phase);
                         return;
                     }
                     if (latest?.phase === 'waiting-for-human' && this.#startMode === 'dispatch-owner') {
@@ -645,6 +691,10 @@ export class FactoryLoop {
             };
             void poll();
         });
+        // `observedPhase` is whatever resolved THIS waiter. It stays undefined only
+        // when the wait ended without a terminal resolution at all — Factory is
+        // stopping — which is exactly what `undefined` reports.
+        return observedPhase;
     }
     async start(opts = {}) {
         if (this.#started) {
@@ -785,6 +835,11 @@ export class FactoryLoop {
         if (this.#dispatchLifecycleRenewTimer)
             clearInterval(this.#dispatchLifecycleRenewTimer);
         this.#dispatchLifecycleRenewTimer = undefined;
+        if (this.#heldAgentDeadlineTimer)
+            clearTimeout(this.#heldAgentDeadlineTimer);
+        this.#heldAgentDeadlineTimer = undefined;
+        this.#heldAgentDeadlineDueAtMs = undefined;
+        await this.#heldAgentDeadlineSweepInFlight;
         for (const timer of this.#dispatchLifecycleRetryTimers.values())
             clearTimeout(timer);
         this.#dispatchLifecycleRetryTimers.clear();
@@ -1122,24 +1177,40 @@ export class FactoryLoop {
         this.#readinessReconcileTimer.unref?.();
     }
     async #reconcileReadyIssues() {
+        const startedAtMs = this.#clock.now();
+        this.#readinessReconcileLastStartedAtMs = startedAtMs;
         this.#increment('readinessReconcileSweeps');
         this.#logger.info?.('[factory] periodic readiness reconciliation started', {
             intervalMs: this.#readinessReconcileIntervalMs,
         });
         try {
             const report = await this.runOnce();
+            this.#readinessReconcileConsecutiveFailures = 0;
+            this.#readinessReconcileLastDurationMs = this.#elapsedSince(startedAtMs);
+            this.#readinessReconcileLastCompletedAtMs = this.#clock.now();
+            this.#readinessReconcileLastError = undefined;
             this.#logger.info?.('[factory] periodic readiness reconciliation completed', {
+                durationMs: this.#readinessReconcileLastDurationMs,
                 candidates: report.pulled.length,
                 dispatched: report.dispatched.length,
                 skipped: report.skipped.length,
             });
         }
         catch (error) {
+            const errorMessage = describeError(error).errorMessage;
+            this.#readinessReconcileConsecutiveFailures += 1;
+            this.#readinessReconcileLastDurationMs = this.#elapsedSince(startedAtMs);
+            this.#readinessReconcileLastFailureAtMs = this.#clock.now();
+            this.#readinessReconcileLastError = errorMessage;
             this.#increment('readinessReconcileErrors');
             this.#logger.warn?.('[factory] periodic readiness reconciliation failed; retry remains scheduled', {
-                error: describeError(error).errorMessage,
+                error: errorMessage,
+                durationMs: this.#readinessReconcileLastDurationMs,
+                consecutiveFailures: this.#readinessReconcileConsecutiveFailures,
+                degraded: this.#readinessReconcileConsecutiveFailures >= READINESS_RECONCILE_FAILURE_THRESHOLD,
             });
         }
+        await this.#refreshLiveHeartbeat();
     }
     #scheduleLivePoll(delayMs, options) {
         if (this.#livePollTimer || !this.#started)
@@ -1796,7 +1867,30 @@ export class FactoryLoop {
             }
         }
     }
+    async #assertFleetControlPlaneAvailable() {
+        try {
+            await this.#fleet.roster();
+            this.#increment('fleetControlPlaneProbeSuccesses');
+        }
+        catch (error) {
+            const health = this.#fleetControlPlane.status();
+            this.#increment('fleetControlPlaneProbeFailures');
+            if (health.state === 'open')
+                this.#increment('fleetControlPlaneCircuitOpen');
+            this.#logger.error?.('[factory] fleet control plane unavailable; dispatch paused', {
+                state: health.state,
+                consecutiveFailures: health.consecutiveFailures,
+                retryAtMs: health.retryAtMs,
+                error: health.lastError ?? 'unknown control-plane failure',
+            });
+            throw contextualError('Factory dispatch paused because the fleet control plane is unavailable', error);
+        }
+    }
     async #runOnceWithDiscoveryFence(opts) {
+        const sweepStartedAtMs = this.#clock.now();
+        if (!(opts.dryRun ?? this.#config.dryRun)) {
+            await this.#assertFleetControlPlaneAvailable();
+        }
         let claim = await this.#state.claimDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, this.#clock.now(), DISCOVERY_SWEEP_LEASE_MS);
         if (!claim.acquired && claim.reason === 'backoff') {
             const delayMs = Math.max(0, claim.state.backoffUntilMs - this.#clock.now());
@@ -1812,6 +1906,8 @@ export class FactoryLoop {
         if (!claim.acquired || !claim.lease) {
             this.#increment('discoverySweepsSkippedInFlight');
             this.#logger.info?.('[factory] skipped discovery because another process owns the sweep lease', {
+                owner: claim.state.lease?.owner,
+                epoch: claim.state.lease?.epoch,
                 leaseUntilMs: claim.state.lease?.leaseUntilMs,
             });
             return {
@@ -1823,7 +1919,23 @@ export class FactoryLoop {
                 discoveryDeferred: 'sweep-in-flight',
             };
         }
+        if (claim.reclaimedLease) {
+            this.#increment('discoverySweepOrphanTakeovers');
+            this.#logger.warn?.('[factory] reclaimed discovery sweep lease from a stopped process', {
+                owner: claim.lease.owner,
+                epoch: claim.lease.epoch,
+                previousOwner: claim.reclaimedLease.owner,
+                previousEpoch: claim.reclaimedLease.epoch,
+                previousLeaseUntilMs: claim.reclaimedLease.leaseUntilMs,
+            });
+        }
+        this.#logger.info?.('[factory] discovery sweep lease claimed', {
+            owner: claim.lease.owner,
+            epoch: claim.lease.epoch,
+            leaseUntilMs: claim.lease.leaseUntilMs,
+        });
         this.#discoverySweepEpoch = claim.lease.epoch;
+        this.#discoverySweepStartedAtMs = sweepStartedAtMs;
         this.#discoverySweepLeaseLost = false;
         this.#discoveryOverloadError = undefined;
         this.#startDiscoverySweepRenewal(claim.lease.epoch);
@@ -1834,6 +1946,11 @@ export class FactoryLoop {
             if (this.#discoveryOverloadError)
                 throw this.#discoveryOverloadError;
             const checkpoint = await this.#finalizeDiscoveryCheckpoint();
+            // Do not clear the durable lease while a renewal can still be waiting on
+            // the same state-file lock. A late renewal that observes the completed
+            // (lease-less) checkpoint is a false lease-loss signal and can poison an
+            // otherwise successful reconcile cycle.
+            await this.#stopDiscoverySweepRenewal();
             if (this.#discoverySweepLeaseLost) {
                 throw new Error('discovery sweep lease was lost before checkpoint commit');
             }
@@ -1841,9 +1958,16 @@ export class FactoryLoop {
             leaseReleased = completed;
             if (!completed)
                 throw new Error('discovery sweep lease was lost before completion');
+            this.#logger.info?.('[factory] discovery sweep checkpoint committed', {
+                owner: claim.lease.owner,
+                epoch: claim.lease.epoch,
+                durationMs: this.#elapsedSince(sweepStartedAtMs),
+                checkpointUpdatedAtMs: checkpoint?.updatedAtMs,
+            });
             return report;
         }
         catch (error) {
+            await this.#stopDiscoverySweepRenewal();
             const overload = relayfileOverload(error);
             if (overload) {
                 const consecutiveOverloads = claim.state.consecutiveOverloads + 1;
@@ -1868,11 +1992,10 @@ export class FactoryLoop {
             throw error;
         }
         finally {
-            if (this.#discoverySweepRenewTimer)
-                clearInterval(this.#discoverySweepRenewTimer);
-            this.#discoverySweepRenewTimer = undefined;
+            await this.#stopDiscoverySweepRenewal();
             this.#discoverySession = undefined;
             this.#discoverySweepEpoch = undefined;
+            this.#discoverySweepStartedAtMs = undefined;
             this.#discoveryOverloadError = undefined;
             // This sweep is over either way (committed, deferred, or lease lost) —
             // a stale `true` here would otherwise make every #listRelayfileTree
@@ -2080,27 +2203,69 @@ export class FactoryLoop {
         }
     }
     #startDiscoverySweepRenewal(epoch) {
-        let renewalInFlight = false;
         this.#discoverySweepRenewTimer = setInterval(() => {
-            if (renewalInFlight || this.#discoverySweepLeaseLost)
+            if (this.#discoverySweepRenewalInFlight || this.#discoverySweepLeaseLost)
                 return;
-            renewalInFlight = true;
-            void this.#state.renewDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, epoch, this.#clock.now(), DISCOVERY_SWEEP_LEASE_MS).then((renewed) => {
-                if (!renewed && this.#discoverySweepEpoch === epoch) {
-                    this.#discoverySweepLeaseLost = true;
-                    this.#increment('discoverySweepLeaseLosses');
-                    this.#logger.warn?.('[factory] discovery sweep lease renewal was rejected; fencing further tree requests');
+            const renewal = this.#renewDiscoverySweepLease(epoch);
+            this.#discoverySweepRenewalInFlight = renewal;
+            void renewal.finally(() => {
+                if (this.#discoverySweepRenewalInFlight === renewal) {
+                    this.#discoverySweepRenewalInFlight = undefined;
                 }
-            }).catch((error) => {
-                this.#logger.warn?.('[factory] discovery sweep lease renewal failed; retaining the current lease window', {
-                    error: describeError(error).errorMessage,
-                });
-            }).finally(() => {
-                renewalInFlight = false;
             });
         }, DISCOVERY_SWEEP_RENEW_MS);
         this.#discoverySweepRenewTimer.unref?.();
     }
+    async #renewDiscoverySweepLease(epoch) {
+        const requestedAtMs = this.#clock.now();
+        try {
+            let renewal;
+            if (this.#state.renewDiscoverySweepWithDetails) {
+                renewal = await this.#state.renewDiscoverySweepWithDetails(this.#workspaceId, this.#discoverySweepOwner, epoch, requestedAtMs, DISCOVERY_SWEEP_LEASE_MS);
+            }
+            else {
+                const renewed = await this.#state.renewDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, epoch, requestedAtMs, DISCOVERY_SWEEP_LEASE_MS);
+                renewal = renewed
+                    ? {
+                        renewed: true,
+                        lease: {
+                            owner: this.#discoverySweepOwner,
+                            epoch,
+                            leaseUntilMs: requestedAtMs + DISCOVERY_SWEEP_LEASE_MS,
+                        },
+                    }
+                    : { renewed: false, reason: 'unknown' };
+            }
+            if (!renewal.renewed && this.#discoverySweepEpoch === epoch) {
+                this.#discoverySweepLeaseLost = true;
+                this.#increment('discoverySweepLeaseLosses');
+                this.#logger.warn?.('[factory] discovery sweep lease renewal was rejected; fencing further tree requests', {
+                    reason: renewal.reason,
+                    requestedOwner: this.#discoverySweepOwner,
+                    requestedEpoch: epoch,
+                    requestedAtMs,
+                    elapsedMs: this.#elapsedSince(this.#discoverySweepStartedAtMs ?? requestedAtMs),
+                    observedOwner: renewal.observedLease?.owner,
+                    observedEpoch: renewal.observedLease?.epoch,
+                    observedLeaseUntilMs: renewal.observedLease?.leaseUntilMs,
+                });
+            }
+        }
+        catch (error) {
+            this.#logger.warn?.('[factory] discovery sweep lease renewal failed; retaining the current lease window', {
+                owner: this.#discoverySweepOwner,
+                epoch,
+                requestedAtMs,
+                error: describeError(error).errorMessage,
+            });
+        }
+    }
+    async #stopDiscoverySweepRenewal() {
+        if (this.#discoverySweepRenewTimer)
+            clearInterval(this.#discoverySweepRenewTimer);
+        this.#discoverySweepRenewTimer = undefined;
+        await this.#discoverySweepRenewalInFlight;
+    }
     async #prepareDiscoverySession(claim) {
         const checkpoint = structuredClone(claim.state.checkpoint ?? {
             trees: {},
@@ -2592,7 +2757,7 @@ export class FactoryLoop {
             await this.#state.clearBabysitterSession(this.#workspaceId, issueKey(lifecycle.issue));
             this.#dispatchLifecycleEpochs.delete(key);
             this.#abandonedDispatchReasons.delete(key);
-            this.#resolveDispatchTerminalWaiters(lifecycle.issue);
+            this.#resolveDispatchTerminalWaiters(lifecycle.issue, 'abandoned');
             await this.#writeInFlightRegistry().catch((error) => {
                 this.#logger.warn?.('[factory] failed to rewrite registry after orphaned claim release', {
                     issue: issue.key,
@@ -2947,6 +3112,16 @@ export class FactoryLoop {
                     reports.push(failedIterationReport(error, opts.dryRun ?? this.#config.dryRun));
                     await this.#reapDispatchFailureHandoffsNow(heartbeatPath, registryPath);
                     await this.#writeLoopHeartbeat(heartbeatPath, registryPath, 'running', iteration + 1, maxIterations);
+                    const fleetControlPlane = this.#fleetControlPlane.status();
+                    if (fleetControlPlane.state !== 'closed') {
+                        this.#increment('loopCircuitBreaks');
+                        this.#logger.error?.('[factory] stopping loop because dispatch is paused by the fleet control-plane circuit', {
+                            state: fleetControlPlane.state,
+                            consecutiveFailures: fleetControlPlane.consecutiveFailures,
+                            retryAtMs: fleetControlPlane.retryAtMs,
+                        });
+                        throw new FleetControlPlaneCircuitOpenError(fleetControlPlane.retryAtMs ?? this.#clock.now(), fleetControlPlane.state);
+                    }
                     if (consecutiveFailures >= maxConsecutiveFailures) {
                         this.#increment('loopCircuitBreaks');
                         this.#logger.error?.('[factory] stopping loop after consecutive iteration failures', {
@@ -3102,6 +3277,13 @@ export class FactoryLoop {
             };
         }
         this.#clearDependencyPark(batch, dispatchDecision.issue);
+        // Event-driven and direct dispatches do not necessarily pass through issue
+        // discovery. Admit them before creating previews, claiming a lifecycle, or
+        // consuming a dispatch attempt. The mutation proxy probes again at the
+        // actual spawn/resume boundary so a later control-plane fault still fails
+        // closed.
+        if (!dryRun)
+            await this.#assertFleetControlPlaneAvailable();
         const durableDispatch = !dryRun && this.#usesDurableDispatchLifecycle();
         // Local dispatches need the same deterministic branch identity as remote
         // ones. Without it, every worker starts in the configured shared checkout
@@ -3282,7 +3464,7 @@ export class FactoryLoop {
                 await this.#notifyTicketDispatch(dispatchDecision, liveIssue, record, result);
             }
             if (!dryRun) {
-                await this.#ensureSlackDispatchThread(record, result);
+                await this.#ensureSlackDispatchThread(record, result, liveIssue);
             }
             return result;
         }
@@ -3375,6 +3557,7 @@ export class FactoryLoop {
     }
     status() {
         const batch = this.#batchView;
+        const nowMs = this.#clock.now();
         const inFlightDispatches = batch?.inFlight
             .filter((record) => !record.dryRun)
             .map((record) => ({
@@ -3389,7 +3572,7 @@ export class FactoryLoop {
             claim: {
                 ...(record.dispatchClaim ?? this.#dispatchClaimStatuses.get(issueKey(record.issue)) ?? {
                     state: 'pending',
-                    updatedAtMs: this.#clock.now(),
+                    updatedAtMs: nowMs,
                 }),
             },
         })) ?? [];
@@ -3404,9 +3587,12 @@ export class FactoryLoop {
                 capacityBlocked: parked.capacityBlocked,
             })) ?? [],
             counters: { ...this.#counters },
+            fleetControlPlane: this.#fleetControlPlane.status(),
             slackDegraded: this.#slackDegraded,
             slackDegradedReason: this.#slackDegradedReason,
             eventListener: this.#eventListenerStatus(),
+            readinessReconcile: this.#readinessReconcileStatus(),
+            heldAgents: batch?.inFlight.flatMap((record) => heldAgentsForRecord(record, nowMs, this.#config.dispatch.agentHoldTimeoutMs, this.#config.terminalState)) ?? [],
         };
     }
     #eventListenerStatus() {
@@ -3427,6 +3613,34 @@ export class FactoryLoop {
         }
         return { state: 'starting' };
     }
+    #readinessReconcileStatus() {
+        const consecutiveFailures = this.#readinessReconcileConsecutiveFailures;
+        const state = this.#startMode !== 'live'
+            ? 'not-running'
+            : consecutiveFailures >= READINESS_RECONCILE_FAILURE_THRESHOLD
+                ? 'degraded'
+                : consecutiveFailures > 0
+                    ? 'retrying'
+                    : 'healthy';
+        return {
+            state,
+            consecutiveFailures,
+            failureThreshold: READINESS_RECONCILE_FAILURE_THRESHOLD,
+            ...(this.#readinessReconcileLastDurationMs !== undefined
+                ? { lastDurationMs: this.#readinessReconcileLastDurationMs }
+                : {}),
+            ...(this.#readinessReconcileLastStartedAtMs !== undefined
+                ? { lastStartedAtMs: this.#readinessReconcileLastStartedAtMs }
+                : {}),
+            ...(this.#readinessReconcileLastCompletedAtMs !== undefined
+                ? { lastCompletedAtMs: this.#readinessReconcileLastCompletedAtMs }
+                : {}),
+            ...(this.#readinessReconcileLastFailureAtMs !== undefined
+                ? { lastFailureAtMs: this.#readinessReconcileLastFailureAtMs }
+                : {}),
+            ...(this.#readinessReconcileLastError ? { lastError: this.#readinessReconcileLastError } : {}),
+        };
+    }
     on(event, listener) {
         let listeners = this.#listeners.get(event);
         if (!listeners) {
@@ -3687,6 +3901,7 @@ export class FactoryLoop {
                     });
                 }
             }
+            this.#rescheduleHeldAgentDeadlineSweep();
         }
         catch (error) {
             this.#logger.warn?.('[factory] failed to re-adopt durable in-flight agents', { error });
@@ -3799,6 +4014,93 @@ export class FactoryLoop {
         }, DISPATCH_LIFECYCLE_RENEW_MS);
         this.#dispatchLifecycleRenewTimer.unref?.();
     }
+    #scheduleHeldAgentDeadline(record) {
+        if (this.#stopping || record.dryRun || record.heldSinceAtMs === undefined || record.agents.size === 0)
+            return;
+        const dueAtMs = record.heldSinceAtMs + this.#config.dispatch.agentHoldTimeoutMs;
+        if (this.#heldAgentDeadlineTimer &&
+            this.#heldAgentDeadlineDueAtMs !== undefined &&
+            this.#heldAgentDeadlineDueAtMs <= dueAtMs)
+            return;
+        if (this.#heldAgentDeadlineTimer)
+            clearTimeout(this.#heldAgentDeadlineTimer);
+        this.#heldAgentDeadlineDueAtMs = dueAtMs;
+        const remainingMs = dueAtMs - this.#clock.now();
+        // An overdue lifecycle can temporarily be fenced by another owner. Avoid
+        // a zero-delay reschedule loop while its lease is being reclaimed.
+        const delayMs = remainingMs <= 0
+            ? HELD_DEADLINE_OVERDUE_RETRY_MS
+            : Math.min(remainingMs, 2_147_483_647);
+        this.#heldAgentDeadlineTimer = setTimeout(() => {
+            this.#heldAgentDeadlineTimer = undefined;
+            this.#heldAgentDeadlineDueAtMs = undefined;
+            const sweep = this.#sweepHeldAgentDeadlines()
+                .catch((error) => {
+                this.#logger.warn?.('[factory] held-agent deadline sweep failed; retrying', {
+                    error: describeError(error).errorMessage,
+                });
+            })
+                .finally(() => {
+                if (this.#heldAgentDeadlineSweepInFlight === sweep)
+                    this.#heldAgentDeadlineSweepInFlight = undefined;
+                this.#rescheduleHeldAgentDeadlineSweep();
+            });
+            this.#heldAgentDeadlineSweepInFlight = sweep;
+        }, delayMs);
+        this.#heldAgentDeadlineTimer.unref?.();
+    }
+    #rescheduleHeldAgentDeadlineSweep() {
+        if (this.#stopping)
+            return;
+        for (const record of this.#batchView?.inFlight ?? [])
+            this.#scheduleHeldAgentDeadline(record);
+    }
+    async #sweepHeldAgentDeadlines() {
+        const nowMs = this.#clock.now();
+        const timeoutMs = this.#config.dispatch.agentHoldTimeoutMs;
+        for (const record of [...(await this.#batch()).inFlight]) {
+            const heldSinceAtMs = record.heldSinceAtMs;
+            if (record.dryRun ||
+                heldSinceAtMs === undefined ||
+                record.agents.size === 0 ||
+                nowMs - heldSinceAtMs < timeoutMs)
+                continue;
+            const key = issueKey(record.issue);
+            if (this.#abandonedDispatchReasons.has(key))
+                continue;
+            if (this.#usesDurableDispatchLifecycle()) {
+                const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
+                if (!lifecycle || isTerminalDispatchLifecycle(lifecycle))
+                    continue;
+                // Terminal writeback already won the race. Finish its normal release
+                // reason instead of relabeling an acknowledged completion as a timeout.
+                if (lifecycle.phase === 'releasing') {
+                    await this.#finishDurableRelease(record, lifecycle.releaseReason);
+                    continue;
+                }
+                if (!await this.#assertDispatchLifecycleOwner(record))
+                    continue;
+            }
+            const heldForMs = Math.max(0, this.#clock.now() - heldSinceAtMs);
+            const details = {
+                issue: record.issue.key,
+                heldForMs,
+                holdTimeoutMs: timeoutMs,
+                waitingForTerminalState: this.#config.terminalState,
+                reason: HELD_PAST_DEADLINE_RELEASE_REASON,
+                agents: [...record.agents.keys()].sort(),
+            };
+            this.#logger.warn?.('[factory] releasing agents held past deadline', details);
+            await this.#abandonStuckDispatch(record, HELD_PAST_DEADLINE_RELEASE_REASON);
+            const lifecycle = this.#usesDurableDispatchLifecycle()
+                ? await this.#state.getDispatchLifecycle(this.#workspaceId, key)
+                : undefined;
+            if (!lifecycle || isTerminalDispatchLifecycle(lifecycle)) {
+                this.#increment('heldPastDeadlineReleases');
+                this.#logger.warn?.('[factory] released agents held past deadline', details);
+            }
+        }
+    }
     async #renewDispatchLifecycles() {
         for (const [key, epoch] of [...this.#dispatchLifecycleEpochs]) {
             const renewed = await this.#state.renewDispatchLifecycle(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch, this.#clock.now(), DISPATCH_LIFECYCLE_LEASE_MS);
@@ -4164,6 +4466,7 @@ export class FactoryLoop {
         });
     }
     async #saveDispatchLifecycle(record, phase, pullRequest, releaseReason, releasedAgentNames = new Set(), telemetry = {}) {
+        record.lifecyclePhase = phase;
         if (record.dryRun || !this.#usesDurableDispatchLifecycle())
             return true;
         if (isTerminalDispatchPhase(phase))
@@ -4188,12 +4491,25 @@ export class FactoryLoop {
             }
             for (const agent of lifecycle.agents) {
                 const previousAgent = previous?.agents.find((candidate) => candidate.name === agent.name);
-                if (previousAgent?.releasedAtMs !== undefined)
-                    agent.releasedAtMs = previousAgent.releasedAtMs;
+                // The in-flight record is authoritative for release state: the stamp
+                // now lives on the tracked agent and round-trips through the lifecycle,
+                // so a still-released agent brings its own stamp here. Inheriting the
+                // previous row's stamp instead would refile a respawned worker as
+                // released — a respawn reuses both the agent name and the deterministic
+                // invocation id, so neither can tell the generations apart — and every
+                // consumer that filters on `releasedAtMs` would then treat a live
+                // worker as gone.
                 if (previousAgent?.costUsage)
                     agent.costUsage = structuredClone(previousAgent.costUsage);
-                if (releasedAgentNames.has(agent.name))
-                    agent.releasedAtMs ??= this.#clock.now();
+                if (releasedAgentNames.has(agent.name)) {
+                    const releasedAtMs = agent.releasedAtMs ?? this.#clock.now();
+                    agent.releasedAtMs = releasedAtMs;
+                    // Keep the record the single source of the stamp, so the next save
+                    // carries it without having to read it back off the durable row.
+                    const tracked = record.agents.get(agent.name);
+                    if (tracked)
+                        tracked.releasedAtMs ??= releasedAtMs;
+                }
             }
             const saved = await this.#state.saveDispatchLifecycle(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch, this.#clock.now(), lifecycle);
             if (!saved) {
@@ -4221,10 +4537,14 @@ export class FactoryLoop {
             return true;
         });
     }
-    #resolveDispatchTerminalWaiters(issue) {
+    // Every caller of this knows the phase the row settled in, and each waiter
+    // must be handed it directly. A waiter that instead re-read the shared row
+    // after release could see it cleared, or see the next dispatch for the same
+    // issue, and classify the wrong run.
+    #resolveDispatchTerminalWaiters(issue, phase) {
         const key = issueKey(issue);
         for (const resolve of this.#dispatchTerminalWaiters.get(key) ?? [])
-            resolve();
+            resolve(phase);
         this.#dispatchTerminalWaiters.delete(key);
     }
     #scheduleDispatchLifecycleRetry(record) {
@@ -4311,7 +4631,7 @@ export class FactoryLoop {
         if (!lifecycle)
             return;
         if (isTerminalDispatchLifecycle(lifecycle)) {
-            this.#resolveDispatchTerminalWaiters(lifecycle.issue);
+            this.#resolveDispatchTerminalWaiters(lifecycle.issue, lifecycle.phase);
             return;
         }
         if (lifecycle.phase === 'waiting-for-human')
@@ -4367,6 +4687,7 @@ export class FactoryLoop {
         const batch = await this.#batch();
         const durableRecord = inFlightRecordFromLifecycle(lifecycle);
         const record = lifecycle.phase === 'releasing' ? durableRecord : batch.restore(durableRecord);
+        this.#scheduleHeldAgentDeadline(record);
         if (!await this.#assertDispatchLifecycleOwner(record))
             return;
         if (acquiredNow && this.#config.babysitter.enabled)
@@ -4691,7 +5012,7 @@ export class FactoryLoop {
         await this.#stopGithubIssueCommentWatcherForIssue(record.issue);
         await this.#writeInFlightRegistry();
         this.#increment('dispatchLifecycleStaleIssuesAbandoned');
-        this.#resolveDispatchTerminalWaiters(record.issue);
+        this.#resolveDispatchTerminalWaiters(record.issue, 'abandoned');
         this.#logger.info?.('[factory] abandoned durable dispatch whose live issue is no longer ready', {
             issue: record.issue.key,
             reason,
@@ -4767,7 +5088,7 @@ export class FactoryLoop {
         this.#increment(releaseReason === 'issue-human-review' ? 'humanReview' : 'done');
         this.#emit('issue-done', { issue: record.issue });
         await this.#writeInFlightRegistry();
-        this.#resolveDispatchTerminalWaiters(record.issue);
+        this.#resolveDispatchTerminalWaiters(record.issue, 'complete');
         return true;
     }
     async #assertDispatchLifecycleOwner(record) {
@@ -5790,6 +6111,8 @@ export class FactoryLoop {
             updatedAtMs,
             registryPath,
             eventListener: this.#eventListenerStatus(),
+            readinessReconcile: this.#readinessReconcileStatus(),
+            fleetControlPlane: this.#fleetControlPlane.status(),
         };
         await mkdir(dirname(path), { recursive: true });
         await writeFile(path, `${JSON.stringify(heartbeat, null, 2)}\n`, 'utf8');
@@ -6048,6 +6371,22 @@ export class FactoryLoop {
             }
             try {
                 await this.#fleet.release(agentName, reason);
+                // Invalidate the spawn memory the moment the release is confirmed, so a
+                // retry for the same deterministic invocation spawns a real worker
+                // instead of inheriting this one's claim. Shutdown is excluded on
+                // purpose: nothing is being retried there, and a takeover must still be
+                // free to adopt agents this process merely stopped supervising.
+                if (record && batch && context !== 'stop') {
+                    const releasedInvocationId = batch.recordRelease(record, agentName, this.#clock.now());
+                    if (releasedInvocationId) {
+                        this.#logger.debug?.('[factory] released agent invocation is no longer dispatchable', {
+                            issue: record.issue.key,
+                            agentName,
+                            reason,
+                            invocationId: releasedInvocationId,
+                        });
+                    }
+                }
                 if (record)
                     await this.#reportAgent(record, tracked, 'agent.released', { releaseReason: reason });
             }
@@ -6214,7 +6553,7 @@ export class FactoryLoop {
         const updatedAtMs = this.#clock.now();
         const agents = [];
         const seenAgents = new Set();
-        const appendAgent = async (issue, agentName, tracked) => {
+        const appendAgent = async (issue, agentName, tracked, hold) => {
             const key = registryHandoffKey(issue, agentName);
             if (seenAgents.has(key)) {
                 return;
@@ -6240,6 +6579,12 @@ export class FactoryLoop {
                 ...(fleetTracked?.invocationId ? { invocationId: fleetTracked.invocationId } : {}),
                 ...(fleetTracked?.node ? { node: fleetTracked.node } : {}),
                 ...(dispatchClaim ? { dispatchClaim: { ...dispatchClaim } } : {}),
+                ...(hold?.heldSinceAtMs !== undefined ? {
+                    heldSinceAtMs: hold.heldSinceAtMs,
+                    holdDeadlineAtMs: hold.heldSinceAtMs + this.#config.dispatch.agentHoldTimeoutMs,
+                    waitingForTerminalState: this.#config.terminalState,
+                    ...(hold.lifecyclePhase ? { lifecyclePhase: hold.lifecyclePhase } : {}),
+                } : {}),
             });
         };
         if (!empty) {
@@ -6250,7 +6595,7 @@ export class FactoryLoop {
                     this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
                 }
                 for (const [agentName, tracked] of record.agents) {
-                    await appendAgent(record.issue, agentName, tracked);
+                    await appendAgent(record.issue, agentName, tracked, record);
                 }
             }
         }
@@ -6271,7 +6616,11 @@ export class FactoryLoop {
         const batch = await this.#batch();
         const invocationId = batch.invocationIdFor(record.issue, spec);
         const existing = record.agents.get(spec.name);
-        if (existing?.result) {
+        // A released placement keeps its bookkeeping entry, but it is not a worker.
+        // Answering with its old spawn result here would report a synthetic success
+        // for a process that no longer exists.
+        if (existing?.result && existing.releasedAtMs === undefined) {
+            this.#scheduleHeldAgentDeadline(record);
             return { name: existing.result?.name ?? spec.name };
         }
         if (!batch.shouldSpawn(record, invocationId)) {
@@ -6298,6 +6647,7 @@ export class FactoryLoop {
         const rosterAgent = roster.agents.find((agent) => agent.name === spec.name);
         if (rosterAgent) {
             const trackedPlacement = this.#fleet.trackedAgents?.().get(spec.name);
+            record.heldSinceAtMs ??= this.#clock.now();
             batch.recordSpawn(record, spec, invocationId, {
                 name: spec.name,
                 sessionRef: existing?.sessionRef ?? spec.sessionRef,
@@ -6307,6 +6657,7 @@ export class FactoryLoop {
             if (!await this.#saveDispatchLifecycle(record, 'dispatching')) {
                 throw new Error(`Dispatch lifecycle ownership lost after adopting ${spec.name}`);
             }
+            this.#scheduleHeldAgentDeadline(record);
             const adopted = record.agents.get(spec.name);
             if (adopted)
                 await this.#reportAgent(record, adopted, 'agent.adopted');
@@ -6318,6 +6669,7 @@ export class FactoryLoop {
             result = await this.#fleet.spawn({
                 name: spec.name,
                 capability: spec.capability,
+                identityKey: dispatchAgentIdentityKey(record.issue, spec.role),
                 node: spec.node ?? 'self',
                 repo: spec.repo,
                 task: spec.task,
@@ -6339,10 +6691,12 @@ export class FactoryLoop {
                     : 'agent_spawn_failed',
             });
         }
+        record.heldSinceAtMs ??= this.#clock.now();
         batch.recordSpawn(record, spec, invocationId, result);
         if (!await this.#saveDispatchLifecycle(record, 'dispatching')) {
             throw new Error(`Dispatch lifecycle ownership lost after spawning ${spec.name}`);
         }
+        this.#scheduleHeldAgentDeadline(record);
         const spawned = record.agents.get(result.name);
         if (spawned)
             await this.#reportAgent(record, spawned, 'agent.spawned');
@@ -6417,6 +6771,16 @@ export class FactoryLoop {
                 return;
             }
         }
+        // Swarm workers share the lead's checkout and lifecycle branch. If a worker
+        // exit reached the publication/completion paths below, whichever worker
+        // finished first would publish whatever partial state was on the shared
+        // branch and mark every swarm member "done" via the shared-branch PR probe,
+        // releasing the still-working lead. The lead alone is authoritative for
+        // publication and completion in a swarm.
+        if (exiting?.spec.swarmRole === 'worker') {
+            this.#increment('swarmWorkerExitsSuppressed');
+            return;
+        }
         if (isCompletionReason(reason)) {
             if (exiting?.spec.role === 'implementer' && await this.#issueHasCompletionPr(record, {
                 openOnly: this.#config.babysitter.enabled,
@@ -6661,6 +7025,7 @@ export class FactoryLoop {
                     const result = await this.#fleet.spawn({
                         name: tracked.spec.name,
                         capability: tracked.spec.capability,
+                        identityKey: dispatchAgentIdentityKey(record.issue, tracked.spec.role),
                         node: tracked.result?.node ?? tracked.spec.node ?? 'self',
                         repo: tracked.spec.repo,
                         task: tracked.spec.task,
@@ -7301,7 +7666,10 @@ export class FactoryLoop {
         try {
             const thread = await this.#slackDispatchThreadFor(record);
             if (thread && this.#slack) {
-                await this.#slack.reply(thread.threadId, `:warning: ${record.issue.key}: the implementer exited without opening a PR (after a retry). It needs a human look.`);
+                const issue = await this.#readIssue(record.issue.path);
+                if (!issue)
+                    return;
+                await this.#slack.reply(thread.threadId, `:warning: ${slackIssueSubject(issue, slackNotificationRepos(record.decision))}\nThe implementer exited without opening a PR after a retry; this needs a human look.`);
             }
         }
         catch (error) {
@@ -7362,6 +7730,8 @@ export class FactoryLoop {
     // record leaves the batch.
     async #abandonStuckDispatch(record, reason) {
         const key = issueKey(record.issue);
+        const heldPastDeadline = reason === HELD_PAST_DEADLINE_RELEASE_REASON;
+        const agentReleaseReason = heldPastDeadline ? HELD_PAST_DEADLINE_RELEASE_REASON : 'issue-abandoned';
         this.#abandonedDispatchReasons.set(key, reason);
         if (!await this.#saveDispatchLifecycle(record, 'abandoning', undefined, reason, new Set(), { cancellationReason: 'dispatch_failed' })) {
             this.#increment('abandonedDispatchReleaseRetries');
@@ -7387,9 +7757,9 @@ export class FactoryLoop {
         }
         const agents = [...record.agents];
         for (const [agentName, tracked] of agents) {
-            if (tracked.spec.role === 'implementer')
+            if (!heldPastDeadline && tracked.spec.role === 'implementer')
                 continue;
-            this.#fleet.markAgentTerminal?.(agentName, `implementer-terminal:${reason}`);
+            this.#fleet.markAgentTerminal?.(agentName, heldPastDeadline ? HELD_PAST_DEADLINE_RELEASE_REASON : `implementer-terminal:${reason}`);
         }
         const worktreeHandoffs = this.#dispatchFailureHandoffs(record, []);
         let cleanupComplete = true;
@@ -7402,13 +7772,13 @@ export class FactoryLoop {
             const worktreeAgentNames = new Set(worktreeHandoffs.map((handoff) => handoff.name));
             const nonWorktreeAgents = agents.filter(([name]) => !worktreeAgentNames.has(name));
             if (nonWorktreeAgents.length > 0) {
-                const failed = await this.#releaseAndTerminateAgents(nonWorktreeAgents, 'issue-abandoned', 'completion');
+                const failed = await this.#releaseAndTerminateAgents(nonWorktreeAgents, agentReleaseReason, 'completion');
                 cleanupComplete = failed.length === 0;
             }
-            cleanupComplete = await this.#teardownFailedDispatchWorktrees(worktreeHandoffs) && cleanupComplete;
+            cleanupComplete = await this.#teardownFailedDispatchWorktrees(worktreeHandoffs, agentReleaseReason) && cleanupComplete;
         }
         else if (agents.length > 0) {
-            const failed = await this.#releaseAndTerminateAgents(agents, 'issue-abandoned', 'completion');
+            const failed = await this.#releaseAndTerminateAgents(agents, agentReleaseReason, 'completion');
             cleanupComplete = failed.length === 0;
         }
         if (!cleanupComplete) {
@@ -7537,6 +7907,7 @@ export class FactoryLoop {
         const result = await this.#fleet.resume({
             name,
             sessionRef: tracked.sessionRef,
+            identityKey: dispatchAgentIdentityKey(record.issue, tracked.spec.role),
             node: tracked.result?.node ?? tracked.spec.node ?? 'self',
             capability: tracked.spec.capability,
             repo: tracked.spec.repo,
@@ -7665,6 +8036,7 @@ export class FactoryLoop {
                 const result = await this.#fleet.spawn({
                     name: replacementSpec.name,
                     capability: replacementSpec.capability,
+                    identityKey: dispatchAgentIdentityKey(record.issue, replacementSpec.role),
                     node: tracked.result?.node ?? replacementSpec.node ?? 'self',
                     repo: replacementSpec.repo,
                     task: replacementSpec.task,
@@ -7997,7 +8369,11 @@ export class FactoryLoop {
             return await this.#postAgentQuestionToGithub(record, question, 'no Slack dispatch thread exists');
         }
         try {
-            await this.#slack.reply(threadId, agentQuestionSlackText(record.issue, question, this.#config.slack.stakeholderUserIds));
+            const issue = await this.#readIssue(record.issue.path);
+            if (!issue) {
+                throw new Error(`Unable to describe Slack question notification for unreadable issue ${record.issue.key}`);
+            }
+            await this.#slack.reply(threadId, agentQuestionSlackText(issue, question, this.#config.slack.stakeholderUserIds, slackNotificationRepos(record.decision)));
             this.#increment('agentQuestionsPostedToSlack');
             this.#recordSlackWritebackSuccess('agent-question');
             return true;
@@ -8099,10 +8475,13 @@ export class FactoryLoop {
             return await this.#deliverClarificationQuestionToGithub(key, claimed, `Slack writeback is degraded${this.#slackDegradedReason ? `: ${this.#slackDegradedReason}` : ''}`);
         }
         try {
-            await this.#slack.reply(claimed.threadId, agentQuestionSlackText(claimed.issue, {
+            if (!claimedIssue) {
+                throw new Error(`Unable to describe Slack question notification for unreadable issue ${claimed.issue.key}`);
+            }
+            await this.#slack.reply(claimed.threadId, agentQuestionSlackText(claimedIssue, {
                 agentName: claimed.askerName,
                 question: claimed.question,
-            }, this.#config.slack.stakeholderUserIds));
+            }, this.#config.slack.stakeholderUserIds, slackNotificationRepos(claimed.decision)));
             const completed = await this.#state.completeClarificationQuestionDelivery(this.#workspaceId, key, this.#clarificationWakeOwner, this.#clock.now());
             if (!completed) {
                 this.#increment('clarificationQuestionDeliveryOwnershipLost');
@@ -8300,7 +8679,11 @@ export class FactoryLoop {
             return;
         }
         try {
-            await this.#slack.reply(threadId, agentQuestionSlackText(record.issue, question, this.#config.slack.stakeholderUserIds));
+            const issue = await this.#readIssue(record.issue.path);
+            if (!issue) {
+                throw new Error(`Unable to describe Slack question mirror for unreadable issue ${record.issue.key}`);
+            }
+            await this.#slack.reply(threadId, agentQuestionSlackText(issue, question, this.#config.slack.stakeholderUserIds, slackNotificationRepos(record.decision)));
             this.#increment('agentQuestionsMirroredToSlack');
             this.#recordSlackWritebackSuccess('agent-question-mirror');
         }
@@ -9121,6 +9504,15 @@ export class FactoryLoop {
                         previewStartCommand: spec.preview?.startCommand,
                     } : {}),
                     ...(this.#fleet.lifecycleActionName ? { lifecycleActionName: this.#fleet.lifecycleActionName } : {}),
+                    ...(spec.swarmRole && spec.channel ? {
+                        swarm: {
+                            role: spec.swarmRole,
+                            channel: spec.channel,
+                            otherMemberNames: decision.implementers
+                                .filter((implementer) => implementer.channel === spec.channel && implementer.name !== spec.name)
+                                .map((implementer) => implementer.name),
+                        },
+                    } : {}),
                 }),
             };
         };
@@ -9395,7 +9787,7 @@ export class FactoryLoop {
                 prMetaShowsMerged(snapshot) &&
                 prSnapshotIssueMatchScore(snapshot, session.issue.key) >= 30) {
                 await this.#state.clearBabysitterSession(this.#workspaceId, persistedKey);
-                await this.#advanceMergedPrToDone(snapshot, record);
+                await this.#advanceMergedPrToDone(snapshot, session.repo, record);
                 this.#increment('babysitterOwnershipRestoreMerged');
                 this.#logger.info?.('[factory] completed restored lifecycle whose pull request was already merged', {
                     issue: session.issue.key,
@@ -10516,7 +10908,7 @@ export class FactoryLoop {
         if (owned) {
             if (prMetaShowsMerged(snapshot)) {
                 if (owned.record)
-                    await this.#advanceMergedPrToDone(snapshot, owned.record);
+                    await this.#advanceMergedPrToDone(snapshot, repo, owned.record);
                 else
                     await this.#cancelBabysitterWake(owned.key);
                 return;
@@ -10572,7 +10964,7 @@ export class FactoryLoop {
             return;
         }
         if (prMetaShowsMerged(snapshot)) {
-            await this.#advanceMergedPrToDone(snapshot, record);
+            await this.#advanceMergedPrToDone(snapshot, repo, record);
             return;
         }
         if (!this.#config.babysitter.enabled) {
@@ -10630,12 +11022,18 @@ export class FactoryLoop {
         }
         return best?.record;
     }
-    async #advanceMergedPrToDone(snapshot, record) {
+    async #advanceMergedPrToDone(snapshot, repo, record) {
+        const mergedPullRequest = { repo, number: snapshot.number, url: snapshot.url };
         if (record) {
-            await this.#completeIssue(record, { targetState: 'done', runMergeGate: false, completionReason: 'pr-merged' });
+            await this.#completeIssue(record, {
+                targetState: 'done',
+                runMergeGate: false,
+                completionReason: 'pr-merged',
+                mergedPullRequest,
+            });
             return;
         }
-        const issue = await this.#findMergeAdvanceIssueForPr(snapshot);
+        const issue = await this.#findMergeAdvanceIssueForPr(snapshot, repo);
         if (!issue) {
             this.#increment('mergedPrAdvanceNoIssue');
             return;
@@ -10670,11 +11068,13 @@ export class FactoryLoop {
                     const channel = await this.#slackChannelDir();
                     if (channel) {
                         const systemOfRecord = githubIssue ? 'GitHub issue closed' : 'Linear state set to Done';
+                        const subject = slackIssueSubject(issue, [repo]);
+                        const pullRequest = slackPullRequestLink(mergedPullRequest);
                         const root = await this.#slack.postThread({
                             channel,
-                            text: `${issue.key}: PR merged; ${systemOfRecord}.`,
+                            text: `${subject}\nPR merged · ${pullRequest} · ${systemOfRecord}`,
                         });
-                        await this.#slack.reply(root.threadId, `${issue.key}: ${systemOfRecord}.`);
+                        await this.#slack.reply(root.threadId, `${subject}\n${systemOfRecord} · ${pullRequest}`);
                         this.#recordSlackWritebackSuccess('merge-done-thread');
                     }
                 }
@@ -10688,7 +11088,7 @@ export class FactoryLoop {
             this.#error(error, issueRef(issue));
         }
     }
-    async #findMergeAdvanceIssueForPr(snapshot) {
+    async #findMergeAdvanceIssueForPr(snapshot, eventRepo) {
         // An issue is "upstream" of a merge if it sits in the agent-implementing or
         // human-review role for its team. UUIDs are globally unique, so the reverse
         // role lookup covers every team without per-team scoping here.
@@ -10697,16 +11097,34 @@ export class FactoryLoop {
             return role === 'agentImplementing' || role === 'humanReview';
         };
         let best;
+        let ambiguous = false;
         const scanStartedAtMs = this.#clock.now();
         // This no-record path runs after agents are released, so there is no
         // tracked PR identity left. Keep the scan simple and prefer branch identity
         // over title/body references to avoid "related to AR-N" body false positives.
         const githubSource = await this.#issueSource() === 'github';
+        // A GitHub-native issue key is a bare number; the same number exists
+        // independently in every configured repository. Only a same-repo candidate
+        // may complete the merge, so a merged PR in one repo can never close an
+        // unrelated issue that happens to share its number in another. #276.
+        const eventRepoKey = validGithubRepo(eventRepo) ? eventRepo.toLowerCase() : undefined;
+        if (githubSource && !eventRepoKey) {
+            this.#logger.warn?.('[factory] merge advance skipped: event repo is not identifiable', {
+                prNumber: snapshot.number,
+            });
+            return undefined;
+        }
         const paths = githubSource ? await this.#githubIssuePaths() : await this.#listRelayfileTree(ISSUE_ROOT, 'merge advance issue scan');
         for (const path of paths) {
             if (githubSource ? !isGithubIssueFilePath(path) : !isIssueFilePath(path)) {
                 continue;
             }
+            if (githubSource) {
+                const issueParts = githubIssuePathParts(path);
+                if (!issueParts || `${issueParts.owner}/${issueParts.repo}`.toLowerCase() !== eventRepoKey) {
+                    continue;
+                }
+            }
             const issue = await this.#readIssue(path);
             if (!issue || (githubSource
                 ? issue.state?.name?.trim().toLowerCase() === 'closed'
@@ -10719,10 +11137,27 @@ export class FactoryLoop {
             const score = prSnapshotIssueMatchScore(snapshot, issue.key);
             if (score > 0 && (!best || score > best.score)) {
                 best = { issue, score };
+                ambiguous = false;
+            }
+            else if (score > 0 && best && score === best.score) {
+                ambiguous = true;
             }
         }
+        // Fail-closed on a tie. A silent first-wins on unrelated same-score
+        // candidates is the exact class of quiet corruption we are removing.
+        if (ambiguous) {
+            this.#increment('mergedPrAdvanceAmbiguous');
+            this.#logger.warn?.('[factory] merge advance skipped: multiple candidates tied on match score', {
+                prNumber: snapshot.number,
+                eventRepo,
+                matchedIssue: best?.issue.key,
+                matchScore: best?.score,
+            });
+            return undefined;
+        }
         this.#logger.debug?.(`[factory] scanned ${githubSource ? 'GitHub' : 'Linear'} issues for merged PR advance`, {
             prNumber: snapshot.number,
+            eventRepo,
             durationMs: this.#clock.now() - scanStartedAtMs,
             matchedIssue: best?.issue.key,
             matchScore: best?.score,
@@ -11280,20 +11715,26 @@ export class FactoryLoop {
             }
             if (!await this.#saveDispatchLifecycle(record, 'writeback-applied'))
                 return;
-            if (this.#slack && this.#config.slack && !await this.#shouldSkipSlackWriteback('completion-thread')) {
+            if (issue && this.#slack && this.#config.slack && !await this.#shouldSkipSlackWriteback('completion-thread')) {
                 try {
                     const channel = await this.#slackChannelDir();
                     if (channel) {
                         const merged = opts.completionReason === 'pr-merged';
                         const systemOfRecord = githubIssue ? 'GitHub status' : 'Linear state';
-                        const completionText = merged
-                            ? `${record.issue.key}: PR merged; ${systemOfRecord} set to ${statusLabel}.`
-                            : `${record.issue.key}: factory agents completed${humanReview ? '; awaiting human review' : ''}.\nStatus: ${statusLabel}\nMerge policy: ${this.#config.mergePolicy}`;
-                        const stateText = merged
-                            ? `${record.issue.key}: ${systemOfRecord} set to ${statusLabel}.`
-                            : humanReview
-                                ? `${record.issue.key}: awaiting human review; ${systemOfRecord} set to ${statusLabel}.`
-                                : `${record.issue.key}: ${systemOfRecord} set to ${statusLabel}.`;
+                        const pullRequests = await this.#slackPullRequestRefs(record, opts.mergedPullRequest ? [opts.mergedPullRequest] : []);
+                        const pullRequestLinks = pullRequests.map(slackPullRequestLink).join(' · ');
+                        const subject = slackIssueSubject(issue, slackNotificationRepos(record.decision));
+                        const stateResult = githubIssue && merged && !humanReview
+                            ? 'GitHub issue closed'
+                            : `${systemOfRecord} set to ${statusLabel}`;
+                        const completionText = [
+                            subject,
+                            merged
+                                ? `PR merged${pullRequestLinks ? ` · ${pullRequestLinks}` : ''} · ${stateResult}`
+                                : `Completed${humanReview ? ' · awaiting human review' : ''}${pullRequestLinks ? ` · ${pullRequestLinks}` : ''}`,
+                            ...(!merged ? [`Status: ${statusLabel} · Merge policy: ${this.#config.mergePolicy}`] : []),
+                        ].join('\n');
+                        const stateText = `${subject}\n${stateResult}${pullRequestLinks ? ` · ${pullRequestLinks}` : ''}`;
                         const root = await this.#slack.postThread({
                             channel,
                             text: completionText,
@@ -11769,7 +12210,30 @@ export class FactoryLoop {
         this.#logger.warn?.('[factory] cleared invalid persisted Slack thread id', { issue: key });
         return undefined;
     }
-    async #ensureSlackDispatchThread(record, result) {
+    async #slackPullRequestRefs(record, additional = []) {
+        const lifecycle = await this.#state
+            .getDispatchLifecycle(this.#workspaceId, issueKey(record.issue))
+            .catch(() => undefined);
+        const lifecycleRefs = publishedPullRequests(lifecycle).map((receipt) => ({
+            repo: receipt.repo,
+            number: receipt.number,
+            url: receipt.url,
+        }));
+        const trackedRefs = [...record.agents.values()]
+            .map((tracked) => tracked.spec.ownedPullRequest)
+            .filter((ref) => Boolean(ref))
+            .map((ref) => ({ repo: ref.repo, number: ref.number }));
+        const babysitterRefs = [...this.#babysitterPr.entries()]
+            .filter(([key]) => issueKey(this.#babysitterIssueRefs.get(key) ?? record.issue) === issueKey(record.issue))
+            .map(([, ref]) => ({ repo: ref.repo, number: ref.prNumber }));
+        return uniqueSlackPullRequestRefs([
+            ...additional,
+            ...lifecycleRefs,
+            ...babysitterRefs,
+            ...trackedRefs,
+        ]);
+    }
+    async #ensureSlackDispatchThread(record, result, sourceIssue) {
         if (!this.#slack || !this.#config.slack || result.dryRun) {
             return;
         }
@@ -11805,7 +12269,7 @@ export class FactoryLoop {
             }
             return;
         }
-        const start = this.#postAndWatchSlackDispatchThread(record, result);
+        const start = this.#postAndWatchSlackDispatchThread(record, result, sourceIssue);
         this.#slackWatcherStarts.set(key, start);
         try {
             await start;
@@ -11818,19 +12282,24 @@ export class FactoryLoop {
             this.#slackWatcherStarts.delete(key);
         }
     }
-    async #postAndWatchSlackDispatchThread(record, result) {
+    async #postAndWatchSlackDispatchThread(record, result, sourceIssue) {
         if (!this.#slack || !this.#config.slack) {
             return;
         }
-        const previews = uniquePreviewReferences(result.previews ?? []);
+        const issue = sourceIssue ?? await this.#readIssue(record.issue.path);
+        if (!issue) {
+            throw new Error(`Unable to describe Slack dispatch notification for unreadable issue ${record.issue.key}`);
+        }
+        const previews = uniquePreviewReferences(result.previews ?? this.#previewReferences.get(issueKey(record.issue)) ?? []);
+        const repos = slackNotificationRepos(record.decision);
         const root = await this.#slack.postThread({
             channel: await this.#slackChannelDir() ?? this.#config.slack.channel,
             text: [
-                `${record.issue.key}: factory agents dispatched.`,
-                `State: ${result.stateId ?? 'dispatching'} · Agents: ${result.agents.map((agent) => agent.name).join(', ') || 'none'}`,
+                slackIssueSubject(issue, repos),
+                `Dispatched · ${result.agents.map((agent) => agent.name).join(', ') || 'no agents'} · Repos: ${slackRepoList(repos)}`,
                 ...(previews.length > 0
                     ? [previews.map((preview) => `Live preview (${preview.repo}, tailnet access required): ${preview.url}`).join(' · ')]
-                    : []),
+                    : [`State: ${result.stateId ?? 'dispatching'}`]),
             ].join('\n'),
         });
         await this.#state.setSlackThread(this.#workspaceId, issueKey(record.issue), root.threadId);
@@ -11859,6 +12328,7 @@ export class FactoryLoop {
                 const rebound = await this.#state.rebindConversationSession(this.#workspaceId, conversationId, {
                     name: agentName,
                     sessionRef,
+                    role: owned.tracked.spec.role,
                     node: owned.tracked.result?.node ?? owned.tracked.spec.node,
                     capability: owned.tracked.spec.capability,
                     repo: owned.tracked.spec.repo,
@@ -11891,6 +12361,7 @@ export class FactoryLoop {
             agent: {
                 name: agentName,
                 sessionRef,
+                role: owned.tracked.spec.role,
                 node: owned.tracked.result?.node ?? owned.tracked.spec.node,
                 capability: owned.tracked.spec.capability,
                 repo: owned.tracked.spec.repo,
@@ -11954,9 +12425,20 @@ export class FactoryLoop {
         }, Math.max(1_000, Math.floor(SLACK_CONVERSATION_TURN_LEASE_MS / 3)));
         heartbeat.unref?.();
         try {
+            // Sessions bound after this field was introduced carry their role
+            // durably, so resume never depends on a live lookup by the agent's
+            // current name — which a since-completed rename (e.g. babysitter
+            // retarget) can otherwise leave unresolvable forever. Older
+            // already-persisted sessions fall back to the live lookup.
+            const conversationRole = claimed.agent.role
+                ?? (await this.#batch()).getIssueByAgent(claimed.agent.name)?.agents.get(claimed.agent.name)?.spec.role;
+            if (!conversationRole) {
+                throw new Error(`Cannot resume ${claimed.agent.name}: its dispatch role is unavailable for identity proof`);
+            }
             const result = await this.#fleet.resume({
                 name: claimed.agent.name,
                 sessionRef: claimed.agent.sessionRef,
+                identityKey: dispatchAgentIdentityKey(claimed.issue, conversationRole),
                 node: claimed.agent.node ?? 'self',
                 capability: claimed.agent.capability,
                 repo: claimed.agent.repo,
@@ -12193,13 +12675,13 @@ export class FactoryLoop {
             .filter((part) => Boolean(part))
             .join(' ');
         const replyInstruction = source?.url
-            ? `Reply on the GitHub issue so Factory can resume: ${source.url}`
+            ? 'Reply on the linked GitHub issue so Factory can resume.'
             : 'Reply on the source GitHub issue so Factory can resume.';
         const root = await this.#slack.postThread({
             channel: await this.#slackChannelDir() ?? this.#config.slack.channel,
             text: [
-                `${audience ? `${audience} ` : ''}${decision.issue.key}: factory triage escalation for ${issue.title}`,
-                `Reason: ${reason}`,
+                `${audience ? `${audience} ` : ''}${slackIssueSubject(issue, slackNotificationRepos(decision))}`,
+                `Triage blocked · Reason: ${reason}`,
                 `Question: ${triageEscalationQuestion(decision, issue)} ${replyInstruction}`,
             ].join('\n'),
         });
@@ -12323,12 +12805,15 @@ export class FactoryLoop {
             return;
         }
         const issue = await this.#readIssue(decision.issue.path);
+        if (!issue) {
+            throw new Error(`Unable to describe Slack triage escalation for unreadable issue ${decision.issue.key}`);
+        }
         const stakeholderMentions = slackMentions(this.#config.slack.stakeholderUserIds);
         const root = await this.#slack.postThread({
             channel: await this.#slackChannelDir() ?? this.#config.slack.channel,
             text: [
-                `${stakeholderMentions ? `${stakeholderMentions} ` : ''}${decision.issue.key}: factory triage escalation for ${issue?.title ?? decision.issue.key}`,
-                `Reason: ${reason}`,
+                `${stakeholderMentions ? `${stakeholderMentions} ` : ''}${slackIssueSubject(issue, slackNotificationRepos(decision))}`,
+                `Triage blocked · Reason: ${reason}`,
                 `Question: ${triageEscalationQuestion(decision, issue)}`,
             ].join('\n'),
         });
@@ -12671,7 +13156,11 @@ export class FactoryLoop {
                 waitingAgeMs,
             });
             try {
-                await this.#slack.reply(waiting.threadId, clarificationStaleSlackText(escalated, this.#config.slack.stakeholderUserIds));
+                const issue = await this.#readIssue(escalated.issue.path);
+                if (!issue) {
+                    throw new Error(`Unable to describe stale Slack clarification for unreadable issue ${escalated.issue.key}`);
+                }
+                await this.#slack.reply(waiting.threadId, clarificationStaleSlackText(escalated, issue, this.#config.slack.stakeholderUserIds));
                 const completed = await this.#state.completeClarificationEscalation(this.#workspaceId, key, this.#clarificationWakeOwner, this.#clock.now());
                 if (!completed) {
                     this.#increment('clarificationEscalationOwnershipLost');
@@ -12935,6 +13424,9 @@ export class FactoryLoop {
                 this.#increment('clarificationWakesQueuedForCapacity');
                 return;
             }
+            // A human-answer wake starts a new agent-hold generation. Time spent
+            // parked with the previous team released must not consume its deadline.
+            record.heldSinceAtMs = undefined;
             if (!await this.#saveDispatchLifecycle(record, 'dispatching')) {
                 batch.complete(waiting.issue);
                 await this.#state.releaseClarificationWake(this.#workspaceId, key, this.#clarificationWakeOwner);
@@ -12964,8 +13456,10 @@ export class FactoryLoop {
                         }
                         : await this.#resumeOrColdStartClarificationAgent(parked.name, tracked, waiting);
                     const invocationId = batch.invocationIdFor(record.issue, tracked.spec);
+                    record.heldSinceAtMs ??= this.#clock.now();
                     batch.recordSpawn(record, tracked.spec, invocationId, result);
                     await this.#saveDispatchLifecycle(record, 'dispatching');
+                    this.#scheduleHeldAgentDeadline(record);
                     const live = record.agents.get(result.name);
                     if (live) {
                         resumed.push([result.name, live]);
@@ -13104,6 +13598,7 @@ export class FactoryLoop {
                 const resumed = await this.#fleet.resume({
                     name,
                     sessionRef: tracked.sessionRef,
+                    identityKey: dispatchAgentIdentityKey(waiting.issue, tracked.spec.role),
                     node: tracked.result?.node ?? tracked.spec.node ?? 'self',
                     capability: tracked.spec.capability,
                     repo: tracked.spec.repo,
@@ -13134,6 +13629,7 @@ export class FactoryLoop {
         return await this.#fleet.spawn({
             name,
             capability: tracked.spec.capability,
+            identityKey: dispatchAgentIdentityKey(waiting.issue, tracked.spec.role),
             node: tracked.result?.node ?? tracked.spec.node ?? 'self',
             task,
             workflow: tracked.spec.workflow,
@@ -13447,6 +13943,15 @@ export class FactoryLoop {
         return hasTitlePrefix(issue.title, FACTORY_E2E_MARKER);
     }
 }
+const defaultGithubWriteback = (config, mount) => {
+    if (config.github.identity !== 'app') {
+        return new GhCliGithubWriteback();
+    }
+    if (!mount.githubWrite) {
+        throw new Error('GitHub identity "app" requires a connected workspace GitHub App lifecycle write path; refusing to fall back to the local gh user');
+    }
+    return new AppGithubWriteback(mount.githubWrite);
+};
 export function parseLinearIssue(path, content) {
     const parsed = parseJsonContent(content);
     const payload = wrappedPayload(parsed);
@@ -13784,6 +14289,82 @@ function dispatchIssueUrl(issue) {
         ?? stringValue(source?.url)
         ?? issue.path;
 }
+const SLACK_ISSUE_TITLE_MAX_LENGTH = 120;
+function slackEscapeText(value) {
+    return value
+        .replace(/&/gu, '&amp;')
+        .replace(/</gu, '&lt;')
+        .replace(/>/gu, '&gt;');
+}
+function slackLinkUrl(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' && url.protocol !== 'http:')
+            return undefined;
+        return url.toString()
+            .replace(/\|/gu, '%7C')
+            .replace(/</gu, '%3C')
+            .replace(/>/gu, '%3E');
+    }
+    catch {
+        return undefined;
+    }
+}
+function truncateSlackIssueTitle(title) {
+    const normalized = title.replace(/\s+/gu, ' ').trim() || 'Untitled issue';
+    const characters = Array.from(normalized);
+    if (characters.length <= SLACK_ISSUE_TITLE_MAX_LENGTH)
+        return normalized;
+    return `${characters.slice(0, SLACK_ISSUE_TITLE_MAX_LENGTH - 1).join('').trimEnd()}…`;
+}
+function slackRepoName(repo) {
+    const normalized = repo.trim().replace(/^\/+|\/+$/gu, '');
+    return normalized.slice(normalized.lastIndexOf('/') + 1) || normalized || 'unknown repo';
+}
+function slackNotificationRepos(decision) {
+    const repos = [
+        ...decision.routes.map((route) => route.repo),
+        ...decision.implementers.map((implementer) => implementer.repo),
+    ];
+    return [...new Map(repos
+            .filter((repo) => Boolean(repo.trim()))
+            .map((repo) => [repo.trim().toLowerCase(), repo.trim()])).values()];
+}
+function slackRepoList(repos) {
+    const names = [...new Set(repos.map(slackRepoName))];
+    return slackEscapeText(names.join(', ') || 'unknown repo');
+}
+function slackIssueSubject(issue, repos = []) {
+    const githubSource = githubIssueSourceRef(issue);
+    const githubPath = githubIssuePathParts(issue.path);
+    const githubIdentity = githubSource ?? githubPath;
+    const payload = wrappedPayload(issue.raw);
+    const source = asRecord(payload.source);
+    const fallbackIssueUrl = githubIdentity
+        ? `https://github.com/${githubIdentity.owner}/${githubIdentity.repo}/issues/${githubIdentity.number}`
+        : `https://linear.app/issue/${encodeURIComponent(issue.key)}`;
+    const issueUrl = slackLinkUrl(githubSource?.url
+        ?? stringValue(payload.url)
+        ?? stringValue(payload.html_url)
+        ?? stringValue(source?.url)
+        ?? fallbackIssueUrl) ?? fallbackIssueUrl;
+    const repoNames = [...new Set(repos.map(slackRepoName))];
+    const label = githubIdentity
+        ? `${githubIdentity.repo}#${githubIdentity.number}`
+        : `${repoNames.join(', ') || 'unknown repo'} · ${issue.key}`;
+    return `<${issueUrl}|${slackEscapeText(label)}> — ${slackEscapeText(truncateSlackIssueTitle(issue.title))}`;
+}
+function slackPullRequestLink(pullRequest) {
+    const fallbackUrl = `https://github.com/${pullRequest.repo}/pull/${pullRequest.number}`;
+    const url = slackLinkUrl(pullRequest.url ?? fallbackUrl) ?? fallbackUrl;
+    const label = `${slackRepoName(pullRequest.repo)}#${pullRequest.number}`;
+    return `<${url}|${slackEscapeText(label)}>`;
+}
+function uniqueSlackPullRequestRefs(refs) {
+    return [...new Map(refs
+            .filter((ref) => Boolean(ref.repo.trim()) && Number.isSafeInteger(ref.number) && ref.number > 0)
+            .map((ref) => [`${ref.repo.trim().toLowerCase()}#${ref.number}`, { ...ref, repo: ref.repo.trim() }])).values()];
+}
 function ticketDispatchNotificationText(payload) {
     return `${payload.summary}\n${JSON.stringify(payload)}`;
 }
@@ -13966,13 +14547,19 @@ function labelDerivedDispatchDecision(liveIssue, decision, config) {
             maxImplementers,
         };
     }
-    const implementers = routesByLabel.routes.map(({ slug, route }) => routeImplementerSpec(liveIssue, config, slug, route));
-    const selectedRoutes = scope === 'single' ? routesByLabel.routes.slice(0, 1) : routesByLabel.routes;
+    // Swarm always shares one checkout (lead + workers collaborate live over a
+    // shared relay channel), so — like single/workflow — only the first matched
+    // label route is used; it is never fanned out across repo labels like team.
+    const selectedRoutes = scope === 'single' || scope === 'swarm'
+        ? routesByLabel.routes.slice(0, 1)
+        : routesByLabel.routes;
     const selectedImplementers = scope === 'team'
-        ? implementers
+        ? routesByLabel.routes.map(({ slug, route }) => routeImplementerSpec(liveIssue, config, slug, route))
         : scope === 'single'
-            ? implementers.slice(0, 1)
-            : [];
+            ? routesByLabel.routes.slice(0, 1).map(({ slug, route }) => routeImplementerSpec(liveIssue, config, slug, route))
+            : scope === 'swarm'
+                ? routeSwarmImplementerSpecs(liveIssue, config, selectedRoutes[0]?.route, maxImplementers)
+                : [];
     const routes = selectedRoutes.map(({ route }) => route);
     const workflow = scope === 'workflow'
         ? routeWorkflowSpec(liveIssue, config, selectedRoutes, decision.workflow)
@@ -14101,6 +14688,24 @@ function routeImplementerSpec(issue, config, slug, route) {
         node: 'self',
     };
 }
+function routeSwarmImplementerSpecs(issue, config, route, maxImplementers) {
+    if (!route) {
+        return [];
+    }
+    const channel = swarmChannel(issue);
+    return swarmMemberSlugs(maxImplementers).map((slug) => ({
+        name: agentNameForRole(issue, 'impl', { repo: route.repo, discriminator: slug }),
+        role: 'implementer',
+        capability: config.agentCapabilities.implementer,
+        model: config.models.implementer,
+        task: swarmTaskFor(issue, route, slug, channel),
+        repo: route.repo,
+        clonePath: route.clonePath,
+        channel,
+        swarmRole: slug === 'lead' ? 'lead' : 'worker',
+        node: 'self',
+    }));
+}
 function decisionWithLifecycleBranches(decision, runId, opts = {}) {
     const implementerBranch = (spec) => {
         const runSuffix = `-${runId.slice(0, 8)}`;
@@ -15247,12 +15852,123 @@ const isAllowedFactoryDraft = async (path, content, opts, mount, config) => {
     if (/^\/slack\/channels\/[^/]+\/messages\/.+/u.test(path)) {
         return true;
     }
-    if (isFactoryGithubWritebackPath(path)) {
+    if (await isAllowedFactoryGithubDraft(path, content, opts, mount, config))
+        return true;
+    return false;
+};
+const isFactoryGithubAuthoredArtifactPath = (path) => /^\/github\/repos\/[^/]+\/[^/]+\/(?:pull-requests\/factory-[^/]+\.json|refs\/(?:factory\.json|refs%2Fheads%2Ffactory%2F[^/]+\.json)|pulls\/[1-9]\d*\/close\.json)$/iu.test(path);
+export const isAllowedFactoryGithubArtifactDraft = (path, opts) => opts?.guarded === true && isFactoryGithubAuthoredArtifactPath(path);
+const factoryGithubIssueWriteTarget = (path) => {
+    const match = /^\/github\/repos\/([^/]+)\/([^/]+)\/issues\/([1-9]\d*)(?:\.json|\/(comments|labels)\/([^/]+))$/iu.exec(path);
+    if (!match?.[1] || !match[2] || !match[3])
+        return undefined;
+    const child = match[4];
+    const filename = match[5];
+    if (child === 'comments' && (!filename || !isFactoryGithubIssueCommentDraftName(filename)))
+        return undefined;
+    if (child === 'labels' && (!filename || !isFactoryGithubOperationDraftName(filename)))
+        return undefined;
+    try {
+        return {
+            owner: decodeURIComponent(match[1]),
+            repo: decodeURIComponent(match[2]),
+            number: Number(match[3]),
+            kind: child === 'comments' ? 'comment' : child === 'labels' ? 'label-operation' : 'issue-update',
+        };
+    }
+    catch {
+        return undefined;
+    }
+};
+const factoryGithubRepositoryLabelWriteTarget = (path) => {
+    const match = /^\/github\/repos\/([^/]+)\/([^/]+)\/labels\/([^/]+)$/iu.exec(path);
+    if (!match?.[1] || !match[2] || !match[3] || !isFactoryGithubOperationDraftName(match[3]))
+        return undefined;
+    try {
+        return { owner: decodeURIComponent(match[1]), repo: decodeURIComponent(match[2]) };
+    }
+    catch {
+        return undefined;
+    }
+};
+const githubLifecycleLabel = (name) => Object.values(FACTORY_GITHUB_STATUS_LABELS).find((label) => label.name === name);
+const hasExactKeys = (value, keys) => {
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+};
+const isAllowedFactoryGithubIssueWriteContent = (kind, content) => {
+    const value = asRecord(content);
+    if (!value)
+        return false;
+    if (kind === 'issue-update') {
+        return hasExactKeys(value, ['state']) && value.state === 'closed';
+    }
+    if (kind === 'comment') {
+        return hasExactKeys(value, ['body']) && typeof value.body === 'string' && value.body.trim().length > 0;
+    }
+    if (value.operation === 'add') {
+        return hasExactKeys(value, ['labels', 'operation']) &&
+            Array.isArray(value.labels) && value.labels.length === 1 && Boolean(githubLifecycleLabel(value.labels[0]));
+    }
+    return value.operation === 'remove' && hasExactKeys(value, ['label', 'operation']) && Boolean(githubLifecycleLabel(value.label));
+};
+const isAllowedFactoryGithubRepositoryLabelContent = (content) => {
+    const value = asRecord(content);
+    if (!value || !hasExactKeys(value, ['color', 'description', 'name']))
+        return false;
+    const expected = githubLifecycleLabel(value.name);
+    return Boolean(expected && expected.color === value.color && expected.description === value.description);
+};
+/**
+ * Last-resort mount guard for Factory-authored GitHub drafts. PR/ref paths are
+ * intrinsically Factory-owned. Issue mutations additionally require a current
+ * in-scope issue projection in one of Relayfile's supported repository layouts.
+ */
+export const isAllowedFactoryGithubDraft = async (path, content, opts, mount, config) => {
+    if (!opts?.guarded)
+        return false;
+    if (isAllowedFactoryGithubArtifactDraft(path, opts))
         return true;
+    const repositoryLabelTarget = factoryGithubRepositoryLabelWriteTarget(path);
+    if (repositoryLabelTarget) {
+        const repoPath = `/github/repos/${encodeURIComponent(repositoryLabelTarget.owner)}/${encodeURIComponent(repositoryLabelTarget.repo)}/`;
+        return isConfiguredGithubRepoPath(repoPath, config) && isAllowedFactoryGithubRepositoryLabelContent(content);
+    }
+    const target = factoryGithubIssueWriteTarget(path);
+    if (!target)
+        return false;
+    if (!isAllowedFactoryGithubIssueWriteContent(target.kind, content))
+        return false;
+    if (target.kind === 'comment') {
+        const body = asRecord(content)?.body;
+        const draftName = path.slice(path.lastIndexOf('/') + 1);
+        if (typeof body !== 'string' || draftName !== factoryGithubIssueCommentDraftName(body))
+            return false;
+    }
+    const repoPath = `/github/repos/${encodeURIComponent(target.owner)}/${encodeURIComponent(target.repo)}`;
+    if (!isConfiguredGithubRepoPath(`${repoPath}/`, config))
+        return false;
+    const compactRepo = `${encodeURIComponent(target.owner)}__${encodeURIComponent(target.repo)}`;
+    const candidates = [
+        `${repoPath}/issues/by-id/${target.number}.json`,
+        `/github/repos/${compactRepo}/issues/by-id/${target.number}.json`,
+        `${repoPath}/issues/${target.number}/meta.json`,
+        `/github/repos/${compactRepo}/issues/${target.number}/meta.json`,
+        `${repoPath}/issues/${target.number}.json`,
+        `/github/repos/${compactRepo}/issues/${target.number}.json`,
+    ];
+    for (const candidate of candidates) {
+        try {
+            const issue = parseGithubFactoryIssue(candidate, (await mount.readFile(candidate)).content);
+            return issue.state?.name === 'open' && isInFactoryScope(issue, config.safety);
+        }
+        catch {
+            // Try the next canonical/alias shape. Any total miss fails closed.
+        }
     }
     return false;
 };
-const isFactoryGithubWritebackPath = (path) => /^\/github\/repos\/[^/]+\/[^/]+\/(?:pull-requests\/factory-[^/]+\.json|refs\/(?:factory\.json|refs%2Fheads%2Ffactory%2F[^/]+\.json)|pulls\/[1-9]\d*\/close\.json)$/iu.test(path);
 const isIssuePathInFactoryScope = async (mount, path, config) => {
     try {
         return isInFactoryScope(parseLinearIssue(path, (await mount.readFile(path)).content), config.safety);
@@ -15705,6 +16421,7 @@ const cloneTrackedAgent = (tracked) => ({
     result: tracked.result ? { ...tracked.result } : undefined,
     sessionRef: tracked.sessionRef,
     unreachableWakeResumedSessionRef: tracked.unreachableWakeResumedSessionRef,
+    releasedAtMs: tracked.releasedAtMs,
 });
 const durableBabysitterTrackedAgent = (session, capability = 'spawn:claude') => ({
     spec: {
@@ -15722,6 +16439,28 @@ const durableBabysitterTrackedAgent = (session, capability = 'spawn:claude') =>
 });
 const isTerminalDispatchLifecycle = (lifecycle) => lifecycle.phase === 'complete' || lifecycle.phase === 'abandoned';
 const isTerminalDispatchPhase = (phase) => phase === 'complete' || phase === 'abandoned';
+const heldAgentsForRecord = (record, nowMs, holdTimeoutMs, terminalState) => {
+    if (record.dryRun || record.heldSinceAtMs === undefined)
+        return [];
+    const heldSinceAtMs = record.heldSinceAtMs;
+    const holdDeadlineAtMs = heldSinceAtMs + holdTimeoutMs;
+    const heldForMs = Math.max(0, nowMs - heldSinceAtMs);
+    return [...record.agents]
+        .filter(([, tracked]) => Boolean(tracked.result))
+        .map(([name, tracked]) => ({
+        name,
+        role: tracked.spec.role,
+        issue: { ...record.issue },
+        ...(record.lifecyclePhase ? { lifecyclePhase: record.lifecyclePhase } : {}),
+        waitingForTerminalState: terminalState,
+        heldSince: new Date(heldSinceAtMs).toISOString(),
+        heldSinceAtMs,
+        heldForMs,
+        holdDeadline: new Date(holdDeadlineAtMs).toISOString(),
+        holdDeadlineAtMs,
+        pastDeadline: nowMs >= holdDeadlineAtMs,
+    }));
+};
 const costUsageGroupId = (runId, tracked) => JSON.stringify([runId, tracked.spec.invocationId ?? tracked.spec.name]);
 const costEntryId = (groupId, model) => JSON.stringify([groupId, model]);
 const publishedPullRequests = (lifecycle) => {
@@ -15759,7 +16498,11 @@ const lifecycleFromInFlightRecord = (record, runId, phase, updatedAtMs, pullRequ
     decision: structuredClone(record.decision),
     dryRun: record.dryRun,
     phase,
-    agents: [...record.agents].map(([name, tracked]) => ({ name, tracked: cloneTrackedAgent(tracked) })),
+    agents: [...record.agents].map(([name, tracked]) => ({
+        name,
+        tracked: cloneTrackedAgent(tracked),
+        ...(tracked.releasedAtMs !== undefined ? { releasedAtMs: tracked.releasedAtMs } : {}),
+    })),
     invocationIds: [...record.invocationIds],
     result: record.result ? structuredClone(record.result) : undefined,
     ...(record.dispatchClaim ? { dispatchClaim: { ...record.dispatchClaim } } : {}),
@@ -15767,16 +16510,27 @@ const lifecycleFromInFlightRecord = (record, runId, phase, updatedAtMs, pullRequ
     ...(pullRequest ? { pullRequest: { ...pullRequest } } : {}),
     ...(releaseReason ? { releaseReason } : {}),
     ...(cost ? { cost: structuredClone(cost) } : {}),
+    ...(record.heldSinceAtMs !== undefined ? { heldSinceAtMs: record.heldSinceAtMs } : {}),
     updatedAtMs,
 });
 const inFlightRecordFromLifecycle = (lifecycle) => ({
     issue: { ...lifecycle.issue },
     decision: structuredClone(lifecycle.decision),
     dryRun: lifecycle.dryRun,
-    agents: new Map(lifecycle.agents.map((agent) => [agent.name, cloneTrackedAgent(agent.tracked)])),
+    // Release state has to survive takeover with the agents themselves. Without
+    // it the rebuilt record reads a released placement as a live worker and the
+    // spawn gate answers for a process that no longer exists.
+    agents: new Map(lifecycle.agents.map((agent) => [agent.name, {
+            ...cloneTrackedAgent(agent.tracked),
+            releasedAtMs: agent.releasedAtMs ?? agent.tracked.releasedAtMs,
+        }])),
     invocationIds: new Set(lifecycle.invocationIds),
     result: lifecycle.result ? structuredClone(lifecycle.result) : undefined,
     ...(lifecycle.dispatchClaim ? { dispatchClaim: { ...lifecycle.dispatchClaim } } : {}),
+    heldSinceAtMs: lifecycle.heldSinceAtMs ?? (lifecycle.agents.some((agent) => agent.releasedAtMs === undefined)
+        ? lifecycle.updatedAtMs
+        : undefined),
+    lifecyclePhase: lifecycle.phase,
 });
 const dispatchResultFromLifecycle = (lifecycle) => lifecycle.result ? structuredClone(lifecycle.result) : {
     issue: { ...lifecycle.issue },
@@ -15796,7 +16550,14 @@ const triageEscalationReason = (decision) => {
     }
     return `${reasons.join(' and ')}${decision.rationale ? `: ${decision.rationale}` : ''}`;
 };
-class LiveDispatchStateChangedError extends Error {
+/**
+ * The dispatch claim race: another writer changed the issue's live state
+ * between this process reading it and writing back, so the dispatch was
+ * abandoned. Exported so callers outside this module — notably the CLI, which
+ * turns it into a distinct exit code — can recognize it by type rather than by
+ * matching on `error.name`, and so tests can construct a genuine instance.
+ */
+export class LiveDispatchStateChangedError extends Error {
     issueKey;
     constructor(issueKey) {
         super(`Live state changed before writeback for ${issueKey}`);
@@ -15804,6 +16565,10 @@ class LiveDispatchStateChangedError extends Error {
         this.issueKey = issueKey;
     }
 }
+/** Whether a thrown value is a {@link LiveDispatchStateChangedError}. */
+export function isLiveDispatchStateChangedError(error) {
+    return error instanceof LiveDispatchStateChangedError;
+}
 const triageEscalationQuestion = (decision, issue) => {
     const routedRepos = decision.routes.map((route) => route.repo).filter(Boolean);
     const subject = issue?.title?.trim() || decision.issue.key;
@@ -15971,14 +16736,14 @@ const slackUserIdMatchingIdentity = (payload, identity) => {
         ? userId
         : undefined;
 };
-const agentQuestionSlackText = (issue, question, stakeholderUserIds = []) => [
-    slackMentions(stakeholderUserIds),
-    `${issue.key}: ${question.agentName} needs input.`,
+const agentQuestionSlackText = (issue, question, stakeholderUserIds = [], repos = []) => [
+    `${slackMentions(stakeholderUserIds) ?? ''} ${slackIssueSubject(issue, repos)}`.trim(),
+    `${question.agentName} needs input.`,
     `Question: ${question.question}`,
 ].filter((line) => Boolean(line)).join('\n');
-const clarificationStaleSlackText = (waiting, stakeholderUserIds = []) => [
-    slackMentions(stakeholderUserIds),
-    `${waiting.issue.key} has been parked for seven days without a reply.`,
+const clarificationStaleSlackText = (waiting, issue, stakeholderUserIds = []) => [
+    `${slackMentions(stakeholderUserIds) ?? ''} ${slackIssueSubject(issue, slackNotificationRepos(waiting.decision))}`.trim(),
+    'This issue has been parked for seven days without a reply.',
     `Question from ${waiting.askerName}: ${waiting.question} Reply in this thread to wake the saved agent team, or move the issue out of Agent Implementing to cancel the wake.`,
 ].filter((line) => Boolean(line)).join('\n');
 const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');