@agent-relay/factory 0.1.64 → 0.1.66

package/dist/orchestrator/factory.js

@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, isAbsolute, resolve } from 'node:path';
-import { FactoryConfigSchema } from '../config/schema.js';
+import { DEFAULT_READINESS_RECONCILE_TIMEOUT_MS, FactoryConfigSchema } from '../config/schema.js';
 import { linearByStatePath, linearByIdPath, linearByUuidPath } from '../constants/linear.js';
 import { stateResolutionFromIds } from '../linear/state-resolver.js';
 import { GithubMergeGate, closeProbePr } from '../github/index.js';
@@ -9,6 +9,7 @@ import { factoryGithubIssueCommentDraftName, isFactoryGithubIssueCommentDraftNam
 import { VerificationPipeline } from '../environments/verification-pipeline.js';
 import { factoryWorktreeIssueSlug, factoryWorktreePath } from '../git/agent-worktree.js';
 import { InMemoryStateStore } from '../state/in-memory-state-store.js';
+import { dispatchHandedOffToBabysitters, dispatchLifecycleOccupiesSlot, dispatchPhaseOccupiesSlot, } from '../state/dispatch-lifecycle-slot.js';
 import { containsExplicitIssueReference, containsIssueKey, factoryBranchBelongsToIssue } from '../issue-key-match.js';
 import { normalizeLogger, normalizeLogValue, setSafeErrorStack, stringifyLogValue } from '../logging.js';
 import { isInFactoryScope } from '../safety/factory-scope.js';
@@ -29,6 +30,8 @@ import { CoalescedTaskQueue } from './coalesced-task-queue.js';
 import { findAgentProcessByName, readProcessIdentity } from './process-identity.js';
 import { readFactoryInFlightRegistry, terminatePids } from './reaper.js';
 import { createFactoryCloudEventV1, factoryCloudReleaseReasonV1, } from '../observability/events.js';
+import { telemetryErrorClass } from '../observability/error-class.js';
+import { derivedReadinessReconcileState, publicHealthFromHeartbeat, readinessReconcileInFlightMs, } from './public-health.js';
 import { boundedRunCostTotal, CostLedger } from '../cost/ledger.js';
 import { createTicketDispatchDelivery } from '../delivery/ticket-dispatch.js';
 import { canonicalTrajectorySessionRef, renderTrajectoryPointer, stripTrajectoryPointers, } from '../trajectory.js';
@@ -139,9 +142,28 @@ const STOP_TEARDOWN_TIMEOUT_MS = 2_500;
 const DISPATCH_LIFECYCLE_LEASE_MS = 5 * 60_000;
 const DISPATCH_LIFECYCLE_RENEW_MS = 60_000;
 const DISPATCH_LIFECYCLE_RETRY_MS = 1_000;
+/**
+ * Ceiling on the durable capacity-wait re-arm (#303).
+ *
+ * The retry was a flat 1 Hz with no bound at all. When the batch was wedged,
+ * every queued issue re-read the shared state document once a second forever —
+ * production measured 1477 state GETs in 111 s — and the timers could not even
+ * keep up, so they coalesced into a continuous spin against the serialized
+ * store. Waiting for capacity is legitimate and must not be abandoned (a real
+ * multi-hour run holds the slot honestly), so what is bounded is the *rate*.
+ */
+const DISPATCH_LIFECYCLE_RETRY_MAX_MS = 30_000;
+/** Rate limit for the capacity-wait warning once the backoff has capped. */
+const DISPATCH_LIFECYCLE_CAPACITY_WAIT_LOG_MS = 60_000;
 const DISPATCH_WRITEBACK_MAX_ATTEMPTS = 3;
 const DISPATCH_WRITEBACK_RETRY_MS = 250;
 const HELD_PAST_DEADLINE_RELEASE_REASON = 'held-past-deadline';
+/**
+ * Release reason for a lifecycle that took a batch slot and never placed an
+ * agent (#303). Deliberately distinct from `held-past-deadline`: that one
+ * means a team ran and never finished, this one means no team ever existed.
+ */
+const AGENTLESS_SLOT_PAST_DEADLINE_RELEASE_REASON = 'agentless-slot-past-deadline';
 const HELD_DEADLINE_OVERDUE_RETRY_MS = 1_000;
 const STARTUP_AGENT_EXIT_DRAIN_TIMEOUT_MS = 30_000;
 const RECONCILED_AGENT_EXIT_CONCURRENCY = 4;
@@ -185,6 +207,38 @@ const DISCOVERY_SWEEP_RENEW_MS = 30_000;
 const READINESS_RECONCILE_FAILURE_THRESHOLD = 3;
 const DISCOVERY_CHANGE_EVENT_LIMIT = 1_000;
 const DISCOVERY_OVERLOAD_BACKOFF_MAX_MS = 5 * 60_000;
+/** First rung of the ladder when the 429 advertises no `Retry-After`. */
+const DISCOVERY_OVERLOAD_BACKOFF_BASE_MS = 5_000;
+/**
+ * Floor for the advertised delay. `Retry-After: 0` would otherwise pin the
+ * whole ladder at zero (`0 * 2 ** n` is still zero) and turn respecting the
+ * dependency into hammering it.
+ */
+const DISCOVERY_OVERLOAD_BACKOFF_MIN_MS = 1_000;
+/**
+ * Ceiling for the ladder once the dependency has told us how long to wait.
+ *
+ * relayfile sheds an overloaded workspace DO with a 429 in milliseconds
+ * carrying `Retry-After: 5`, and #297 is what happened when the ladder ignored
+ * that and climbed to `DISCOVERY_OVERLOAD_BACKOFF_MAX_MS` anyway: the
+ * dependency asked for five seconds, Factory slept for five minutes, probed
+ * for recovery once per cap-length window, and presented a transient upstream
+ * blip as a sustained outage. The ratchet still escalates — it is just bounded
+ * by roughly what was actually asked for, and never *below* it, so this is a
+ * ceiling and not a licence to retry sooner than the dependency allows.
+ */
+const DISCOVERY_OVERLOAD_ADVERTISED_BACKOFF_MAX_MS = 30_000;
+/**
+ * How many relayfile operations one sweep may have shed before the sweep is
+ * abandoned rather than continued.
+ *
+ * Per-item overload skips that item and keeps going (#297, the same principle
+ * as #292), but skipping must not degenerate into grinding a shedding
+ * dependency through an entire backlog one 429 at a time. Past this many, the
+ * dependency is not serving this sweep at all: abort, back off, and let the
+ * ratchet do its job.
+ */
+const DISCOVERY_OVERLOAD_PER_SWEEP_LIMIT = 5;
 const GITHUB_FACTORY_LABEL = 'factory';
 const GITHUB_LIFECYCLE_LABELS = new Set(['factory:in-progress', 'factory:human-review']);
 const GITHUB_MIRROR_TITLE_PREFIX = '[factory]';
@@ -259,6 +313,20 @@ class DispatchLifecycleClaimRefusedError extends Error {
         this.name = 'DispatchLifecycleClaimRefusedError';
     }
 }
+/**
+ * The deadline that makes a hung sweep reachable by the existing recovery path.
+ * Its message is fully internal (one integer), so it is safe to persist into
+ * the operator-facing `readinessReconcile.lastError`.
+ */
+class ReadinessReconcileTimeoutError extends Error {
+    timeoutMs;
+    code = 'FACTORY_READINESS_RECONCILE_TIMEOUT';
+    constructor(timeoutMs) {
+        super(`readiness reconcile sweep exceeded its ${timeoutMs}ms deadline`);
+        this.timeoutMs = timeoutMs;
+        this.name = 'ReadinessReconcileTimeoutError';
+    }
+}
 const realClock = {
     now: () => Date.now(),
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -369,7 +437,17 @@ export class FactoryLoop {
     #dispatchLifecycleRetryTimers = new Map();
     #dispatchLifecycleDrives = new Set();
     #abandonedDispatchReasons = new Map();
-    #dispatchLifecycleCapacityWaitLogged = new Set();
+    /**
+     * Live batch-capacity waits, keyed by issue (#303).
+     *
+     * Replaces a `Set` of "already logged" keys. That set made the wait a
+     * one-shot log and nothing else: after the first line, an outage in which
+     * every issue was stuck behind a wedged slot was indistinguishable from an
+     * idle Factory on every operator surface. The wait now carries its own start
+     * instant and attempt count, which is what both the escalating warning and
+     * `status().dispatchCapacity` are derived from.
+     */
+    #dispatchLifecycleCapacityWaits = new Map();
     #dispatchLifecycleOwnershipWaitLogged = new Set();
     #dispatchClaimStatuses = new Map();
     #localReleaseCheckpoints = new Map();
@@ -408,12 +486,41 @@ export class FactoryLoop {
     #readinessReconcileTimer;
     #readinessReconcileInFlight;
     #readinessReconcileIntervalMs = 60_000;
+    #readinessReconcileTimeoutMs = DEFAULT_READINESS_RECONCILE_TIMEOUT_MS;
+    // Set for exactly as long as a sweep is running. `state` is derived from
+    // this, so an in-flight pass can no longer masquerade as the last settled one.
+    #readinessReconcileInFlightSinceMs;
+    /**
+     * The work a deadline gave up waiting on. The deadline bounds the wait, not
+     * the sweep, so this is still live: shutdown has to drain it, and `state` has
+     * to keep counting from when it actually started.
+     *
+     * Two fields rather than a collection, because every live abandoned wait
+     * converges on the same sweep. They are all `runOnce()` calls with the same
+     * `dryRun`, so whatever they are queued behind, the first one out starts the
+     * sweep and the rest coalesce onto it — they settle together. So the newest
+     * wait is a sufficient drain target, and the earliest start is the honest
+     * age. Both matter (#301 review): keeping only the newest start advanced the
+     * age by two intervals every two intervals, so at `reconcileTimeoutMs ===
+     * reconcileIntervalMs` it never reached three and `stalled` was never
+     * reported; keeping one record per wait grew without bound in exactly the
+     * never-settling case this change exists for.
+     *
+     * The wait, deliberately, and never `#runOnceInFlight`: a mismatched-`dryRun`
+     * sweep is waited BEHIND rather than coalesced onto, so that handle can name
+     * an unrelated sweep, and the readiness pass would then start its own work
+     * after shutdown believed it had drained everything. The wait covers the
+     * queueing and the sweep it eventually runs, in every branch.
+     */
+    #readinessReconcileAbandonedWait;
+    #readinessReconcileAbandonedSinceMs;
     #readinessReconcileConsecutiveFailures = 0;
     #readinessReconcileLastDurationMs;
     #readinessReconcileLastStartedAtMs;
     #readinessReconcileLastCompletedAtMs;
     #readinessReconcileLastFailureAtMs;
     #readinessReconcileLastError;
+    #readinessReconcileLastErrorClass;
     #liveEventQueue = [];
     #liveEventDrainScheduled = false;
     #liveEventDrainActive = false;
@@ -501,7 +608,34 @@ export class FactoryLoop {
     // so the loop's catch no longer runs the failure-handoff reaper for it; the
     // pass reaps inline and must write to the same paths runLoop would.
     #loopReapPaths;
+    /**
+     * The first 429 relayfile raised during this sweep, kept for its
+     * `Retry-After` and reason when the sweep decides how long to back off.
+     *
+     * Before #297 this doubled as a sweep-wide kill switch: any 429 from any
+     * relayfile call latched here and `#runOnceWithDiscoveryFence` then threw it
+     * away along with everything the sweep had already accomplished. It is now
+     * only evidence, never a verdict — see `#discoverySweepOverloads` for the
+     * fuse that still ends a sweep the dependency is genuinely refusing to serve.
+     */
     #discoveryOverloadError;
+    /** Relayfile operations this sweep has been shed on. */
+    #discoverySweepOverloads = 0;
+    /**
+     * The longest `Retry-After` any operation in this sweep advertised.
+     *
+     * `#discoveryOverloadError` latches the FIRST 429, so deriving the backoff
+     * from it alone would let the durable window expire before a later, longer
+     * advertised delay permits — breaking the very guarantee #297 is about. The
+     * backoff takes the maximum instead.
+     */
+    #discoverySweepRetryAfterSeconds;
+    /**
+     * Whether relayfile served at least one ready work unit end to end during
+     * this sweep — its issue read, or a dispatch built on it. This is what
+     * decays the durable overload ratchet; see `#discoveryOverloadOutcome`.
+     */
+    #discoverySweepProgress = false;
     #resolvedIssueSource;
     #integrationInstructions;
     #integrationInstructionsRefresh;
@@ -906,6 +1040,7 @@ export class FactoryLoop {
             clearTimeout(timer);
         this.#dispatchLifecycleRetryTimers.clear();
         this.#abandonedDispatchReasons.clear();
+        this.#dispatchLifecycleCapacityWaits.clear();
         this.#dispatchLifecycleOwnershipWaitLogged.clear();
         if (this.#completionSweepTimer)
             clearTimeout(this.#completionSweepTimer);
@@ -917,6 +1052,14 @@ export class FactoryLoop {
             clearTimeout(this.#previewSweepTimer);
         this.#previewSweepTimer = undefined;
         await this.#readinessReconcileInFlight;
+        // #301 review: the deadline ends the *wait*, so `#readinessReconcileInFlight`
+        // can settle with its `runOnce()` still live. Shutdown releases dispatch
+        // lifecycle leases and disposes ports below, and `#isPassFatalFailure` only
+        // fences a stopping sweep once something in it throws — so a sweep whose
+        // dependency recovers cleanly would otherwise dispatch through torn-down
+        // state. Draining here restores exactly the pre-deadline shutdown contract:
+        // stop() outlives the sweep it started.
+        await this.#readinessReconcileAbandonedWait;
         await this.#previewSweepInFlight;
         this.#stoppingHeartbeatRefreshActive = await this.#stopLiveHeartbeat('stopping');
         try {
@@ -1067,6 +1210,9 @@ export class FactoryLoop {
         const options = this.#liveOptions(overrides);
         this.#liveTransport = options.transport;
         this.#readinessReconcileIntervalMs = options.reconcileIntervalMs;
+        // `start()` overrides skip the schema's cross-field check, so re-apply its
+        // floor here: a deadline under one interval would kill every pass.
+        this.#readinessReconcileTimeoutMs = Math.max(options.reconcileTimeoutMs, options.reconcileIntervalMs);
         this.#liveConnectStartedAtMs = this.#clock.now();
         this.#liveReplaySkewMarginMs = options.replaySkewMarginMs;
         const highWatermark = await this.#currentEventHighWatermark();
@@ -1103,10 +1249,27 @@ export class FactoryLoop {
             this.#logger.info?.('[factory] running startup ready-issue backfill before draining buffered events', {
                 highWatermarkRouteUnavailable: highWatermark.routeUnavailable,
             });
+            // Review follow-up on #300 (P1, cubic). The startup backfill is a
+            // discovery pass like any other, and it is the one most likely to hang:
+            // #36 measured 61 minutes here while the Relayfile mirror hydrated on a
+            // cold container. Stamping it means a wedged FIRST pass is visible as
+            // in-flight, instead of leaving the timestamps empty and the derived
+            // state reading `healthy` forever.
+            //
+            // Only the timestamps. `consecutiveFailures` and `lastError` belong to
+            // the reconcile loop's own failure accounting, which owns the degraded
+            // threshold and the #297 reason allowlist; a startup failure is already
+            // counted by `liveStartupBackfillErrors` and reported through `#error`.
+            const backfillStartedAtMs = this.#clock.now();
+            this.#readinessReconcileLastStartedAtMs = backfillStartedAtMs;
             try {
                 await this.runOnce();
+                this.#readinessReconcileLastDurationMs = this.#elapsedSince(backfillStartedAtMs);
+                this.#readinessReconcileLastCompletedAtMs = this.#clock.now();
             }
             catch (error) {
+                this.#readinessReconcileLastDurationMs = this.#elapsedSince(backfillStartedAtMs);
+                this.#readinessReconcileLastFailureAtMs = this.#clock.now();
                 // A startup backfill failure must not abort the daemon: log it and fall
                 // back to the live event stream (plus any buffered events) instead of
                 // leaving the factory down.
@@ -1198,6 +1361,7 @@ export class FactoryLoop {
             eventLimit: overrides.eventLimit ?? this.#config.liveSubscription.eventLimit,
             replaySkewMarginMs: overrides.replaySkewMarginMs ?? this.#config.liveSubscription.replaySkewMarginMs,
             reconcileIntervalMs: overrides.reconcileIntervalMs ?? this.#config.liveSubscription.reconcileIntervalMs,
+            reconcileTimeoutMs: overrides.reconcileTimeoutMs ?? this.#config.liveSubscription.reconcileTimeoutMs,
         };
     }
     async #currentEventCursor(limit) {
@@ -1246,19 +1410,82 @@ export class FactoryLoop {
         }, delayMs);
         this.#readinessReconcileTimer.unref?.();
     }
+    /**
+     * Runs one sweep under a deadline (#296).
+     *
+     * The sweep itself cannot be cancelled — `runOnce()` owns a durable discovery
+     * lease and abandoning it mid-flight is not safe — so expiry rejects *this*
+     * wait and leaves the underlying pass to finish on its own. That is enough:
+     * the rejection is what reaches the failure path, which re-arms the timer.
+     * A later reconcile pass coalesces onto the still-running `runOnce()` and
+     * fails on its own deadline too, so a persistent hang keeps counting up to
+     * `degraded` instead of going quiet.
+     */
+    async #runOnceWithReadinessDeadline() {
+        const timeoutMs = this.#readinessReconcileTimeoutMs;
+        const startedAtMs = this.#clock.now();
+        const sweep = this.runOnce();
+        let timer;
+        try {
+            return await new Promise((resolve, reject) => {
+                timer = setTimeout(() => {
+                    this.#increment('readinessReconcileDeadlineExceeded');
+                    if (this.#readinessReconcileAbandonedSinceMs === undefined) {
+                        // `state` ages from the FIRST wait that gave up on this work, not
+                        // from whenever the latest one began.
+                        this.#readinessReconcileAbandonedSinceMs = startedAtMs;
+                        // The abandoned pass is still running against the live control
+                        // plane. Report where it lands, so an operator can tell a
+                        // dependency that recovered late from one that never answered.
+                        // Attached once, so a wedge is reported once and not per expiry.
+                        void sweep.then((report) => this.#logger.warn?.('[factory] abandoned readiness sweep completed after its deadline', {
+                            timeoutMs,
+                            overrunMs: this.#elapsedSince(startedAtMs) - timeoutMs,
+                            dispatched: report.dispatched.length,
+                        }), (error) => this.#logger.warn?.('[factory] abandoned readiness sweep failed after its deadline', {
+                            timeoutMs,
+                            overrunMs: this.#elapsedSince(startedAtMs) - timeoutMs,
+                            error: describeError(error).errorMessage,
+                        })).catch(() => undefined);
+                    }
+                    // Newest wait wins as the drain target: it settles no earlier than
+                    // the ones before it, and clearing on it clears them all.
+                    const wait = sweep.catch(() => undefined).then(() => {
+                        if (this.#readinessReconcileAbandonedWait !== wait)
+                            return;
+                        this.#readinessReconcileAbandonedWait = undefined;
+                        this.#readinessReconcileAbandonedSinceMs = undefined;
+                    });
+                    this.#readinessReconcileAbandonedWait = wait;
+                    reject(new ReadinessReconcileTimeoutError(timeoutMs));
+                }, timeoutMs);
+                timer.unref?.();
+                // Attaching handlers here is also what keeps a late rejection from the
+                // abandoned pass from surfacing as an unhandled rejection.
+                sweep.then(resolve, reject);
+            });
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
     async #reconcileReadyIssues() {
         const startedAtMs = this.#clock.now();
         this.#readinessReconcileLastStartedAtMs = startedAtMs;
+        this.#readinessReconcileInFlightSinceMs = startedAtMs;
         this.#increment('readinessReconcileSweeps');
         this.#logger.info?.('[factory] periodic readiness reconciliation started', {
             intervalMs: this.#readinessReconcileIntervalMs,
+            timeoutMs: this.#readinessReconcileTimeoutMs,
         });
         try {
-            const report = await this.runOnce();
+            const report = await this.#runOnceWithReadinessDeadline();
             this.#readinessReconcileConsecutiveFailures = 0;
             this.#readinessReconcileLastDurationMs = this.#elapsedSince(startedAtMs);
             this.#readinessReconcileLastCompletedAtMs = this.#clock.now();
             this.#readinessReconcileLastError = undefined;
+            this.#readinessReconcileLastErrorClass = undefined;
             this.#logger.info?.('[factory] periodic readiness reconciliation completed', {
                 durationMs: this.#readinessReconcileLastDurationMs,
                 candidates: report.pulled.length,
@@ -1267,11 +1494,28 @@ export class FactoryLoop {
             });
         }
         catch (error) {
-            const errorMessage = describeError(error).errorMessage;
+            // #297: all four relayfile overload reason codes share one message, and
+            // `lastError` is what an operator reads from /evidence. Without the
+            // reason, "workspace durable object is busy" cannot be told apart from
+            // three other conditions with three different remedies.
+            //
+            // Allowlisted, because this is a persisted operator-facing surface and
+            // not just a log line: `lastError` is returned from `status()` and
+            // written into the loop heartbeat file, so an unbounded
+            // dependency-controlled string would land on disk.
+            const overload = relayfileOverload(error);
+            const errorMessage = overload
+                ? `${describeError(error).errorMessage} ` +
+                    `[relayfile ${overload.status} ${relayfileOverloadReasonLabel(overload.reason)}` +
+                    `${overload.retryAfterSeconds === undefined ? '' : `; retry-after=${overload.retryAfterSeconds}s`}]`
+                : describeError(error).errorMessage;
             this.#readinessReconcileConsecutiveFailures += 1;
             this.#readinessReconcileLastDurationMs = this.#elapsedSince(startedAtMs);
             this.#readinessReconcileLastFailureAtMs = this.#clock.now();
             this.#readinessReconcileLastError = errorMessage;
+            // The class, unlike the message, is publishable: #295 puts it on the
+            // unauthenticated health surface through the same allowlist.
+            this.#readinessReconcileLastErrorClass = telemetryErrorClass(error);
             this.#increment('readinessReconcileErrors');
             this.#logger.warn?.('[factory] periodic readiness reconciliation failed; retry remains scheduled', {
                 error: errorMessage,
@@ -1280,6 +1524,11 @@ export class FactoryLoop {
                 degraded: this.#readinessReconcileConsecutiveFailures >= READINESS_RECONCILE_FAILURE_THRESHOLD,
             });
         }
+        finally {
+            // Cleared before the heartbeat write below, so a slow-but-successful pass
+            // does not stamp its own tail as `stalled`.
+            this.#readinessReconcileInFlightSinceMs = undefined;
+        }
         await this.#refreshLiveHeartbeat();
     }
     #scheduleLivePoll(delayMs, options) {
@@ -2008,13 +2257,29 @@ export class FactoryLoop {
         this.#discoverySweepStartedAtMs = sweepStartedAtMs;
         this.#discoverySweepLeaseLost = false;
         this.#discoveryOverloadError = undefined;
+        this.#discoverySweepOverloads = 0;
+        this.#discoverySweepRetryAfterSeconds = undefined;
+        this.#discoverySweepProgress = false;
         this.#startDiscoverySweepRenewal(claim.lease.epoch);
         let leaseReleased = false;
         try {
             this.#discoverySession = await this.#prepareDiscoverySession(claim);
+            // #297: a 429 raised anywhere in the sweep used to latch and be rethrown
+            // here, discarding a completed pass — every issue read, every dispatch —
+            // because of one transient shed operation. The work this sweep did is
+            // now kept instead, and the ratchet below records that the dependency is
+            // shedding but still serving.
             const report = await this.#performRunOnce(opts);
-            if (this.#discoveryOverloadError)
+            // The exception, and the reason skipping shed units cannot make a sweep
+            // unconditionally green: a sweep that was shed AND got no work unit
+            // through accomplished nothing. There is no progress to preserve, and
+            // committing it would report a clean sweep over a dependency that served
+            // none of it — leaving `readinessReconcile` healthy while Factory
+            // dispatches nothing, which is the #292 wedge wearing the other costume.
+            // Fail it so the ratchet escalates and readiness reflects reality.
+            if (this.#discoveryOverloadError !== undefined && !this.#discoverySweepProgress) {
                 throw this.#discoveryOverloadError;
+            }
             const checkpoint = await this.#finalizeDiscoveryCheckpoint();
             // Do not clear the durable lease while a renewal can still be waiting on
             // the same state-file lock. A late renewal that observes the completed
@@ -2024,7 +2289,8 @@ export class FactoryLoop {
             if (this.#discoverySweepLeaseLost) {
                 throw new Error('discovery sweep lease was lost before checkpoint commit');
             }
-            const completed = await this.#state.completeDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, claim.lease.epoch, checkpoint);
+            const residual = this.#discoveryOverloadOutcome(claim.state.consecutiveOverloads, 'committed');
+            const completed = await this.#commitDiscoverySweep(claim.lease.epoch, checkpoint, residual);
             leaseReleased = completed;
             if (!completed)
                 throw new Error('discovery sweep lease was lost before completion');
@@ -2040,18 +2306,18 @@ export class FactoryLoop {
             await this.#stopDiscoverySweepRenewal();
             const overload = relayfileOverload(error);
             if (overload) {
-                const consecutiveOverloads = claim.state.consecutiveOverloads + 1;
-                const delayMs = discoveryOverloadBackoffMs(overload.retryAfterSeconds, consecutiveOverloads);
-                const backoffUntilMs = this.#clock.now() + delayMs;
-                leaseReleased = await this.#state.deferDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, claim.lease.epoch, backoffUntilMs, consecutiveOverloads);
-                this.#increment('discoveryOverloadBackoffs');
+                const outcome = this.#discoveryOverloadOutcome(claim.state.consecutiveOverloads, 'aborted', error);
+                leaseReleased = await this.#state.deferDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, claim.lease.epoch, outcome.backoffUntilMs, outcome.consecutiveOverloads);
                 this.#logger.warn?.('[factory] Relayfile discovery overloaded; backing off before another sweep', {
                     status: overload.status,
                     reason: overload.reason,
-                    retryAfterSeconds: overload.retryAfterSeconds,
-                    delayMs,
-                    backoffUntilMs,
-                    consecutiveOverloads,
+                    retryAfterSeconds: outcome.retryAfterSeconds,
+                    delayMs: outcome.delayMs,
+                    backoffUntilMs: outcome.backoffUntilMs,
+                    consecutiveOverloads: outcome.consecutiveOverloads,
+                    previousOverloads: claim.state.consecutiveOverloads,
+                    sweepOverloads: this.#discoverySweepOverloads,
+                    sweepProgress: this.#discoverySweepProgress,
                 });
                 // backoffUntilMs is already durable via deferDiscoverySweep, and the
                 // next runOnce() honors it at the pre-claim wait above — sleeping
@@ -2067,6 +2333,9 @@ export class FactoryLoop {
             this.#discoverySweepEpoch = undefined;
             this.#discoverySweepStartedAtMs = undefined;
             this.#discoveryOverloadError = undefined;
+            this.#discoverySweepOverloads = 0;
+            this.#discoverySweepRetryAfterSeconds = undefined;
+            this.#discoverySweepProgress = false;
             // This sweep is over either way (committed, deferred, or lease lost) —
             // a stale `true` here would otherwise make every #listRelayfileTree
             // call outside a fresh claim (Slack lookups, PR confirmation, the
@@ -2078,6 +2347,94 @@ export class FactoryLoop {
             }
         }
     }
+    /**
+     * Commit the sweep, carrying any residual overload backoff into the store.
+     *
+     * `completeDiscoverySweepWithOverload` is optional on the port so a store
+     * written before #297 keeps working. When one of those is injected and this
+     * sweep HAS a residual, the backoff cannot be persisted and the next sweep
+     * would retry immediately — so this says so, loudly and with a counter,
+     * rather than degrading in silence. The sweep itself still commits: losing
+     * the backoff is worse than pre-#297 behaviour only if nobody notices.
+     */
+    async #commitDiscoverySweep(epoch, checkpoint, residual) {
+        if (residual && this.#state.completeDiscoverySweepWithOverload) {
+            return await this.#state.completeDiscoverySweepWithOverload(this.#workspaceId, this.#discoverySweepOwner, epoch, checkpoint, { consecutiveOverloads: residual.consecutiveOverloads, backoffUntilMs: residual.backoffUntilMs });
+        }
+        if (residual) {
+            this.#increment('discoveryOverloadResidualUnsupported');
+            this.#logger.warn?.('[factory] state store cannot persist the Relayfile overload backoff; it will be lost', {
+                store: this.#state.constructor?.name,
+                consecutiveOverloads: residual.consecutiveOverloads,
+                backoffUntilMs: residual.backoffUntilMs,
+                delayMs: residual.delayMs,
+            });
+        }
+        return await this.#state.completeDiscoverySweep(this.#workspaceId, this.#discoverySweepOwner, epoch, checkpoint);
+    }
+    /**
+     * How the durable overload ratchet should read after this sweep, or
+     * `undefined` if relayfile never shed anything and the ordinary reset
+     * applies.
+     *
+     * #297, deliverable 3. `consecutiveOverloads` used to clear only on a
+     * *fully* clean sweep, so under sustained mild load the ratchet essentially
+     * never cleared: it climbed to the cap on the first bad sweep and stayed
+     * there, probing for recovery once per cap-length window, long after the
+     * dependency had recovered. Requiring perfection to clear a ratchet means
+     * the ratchet does not clear.
+     *
+     * The signal that replaces "was this sweep perfect" is "did relayfile serve
+     * any of this sweep's work units", because that is what the ratchet is
+     * actually for. A shedding DO rejects ALL background traffic —
+     * `oldest_inflight_age` does this regardless of how few requests are in
+     * flight — so a sweep against a genuinely overloaded workspace gets not one
+     * unit through and still escalates, all the way to the cap. A sweep that did
+     * get units through proves the dependency is serving us, so it decays by one
+     * rung. Decay, not reset: getting work done while being shed is not evidence
+     * that the overload is over, only that it is survivable.
+     */
+    #discoveryOverloadOutcome(previousOverloads, sweepOutcome, error) {
+        const overload = relayfileOverload(error) ?? relayfileOverload(this.#discoveryOverloadError);
+        if (!overload)
+            return undefined;
+        // The longest delay anything in this sweep asked for, not just the one the
+        // latched or terminating error carried — see `#discoverySweepRetryAfterSeconds`.
+        const advertised = [this.#discoverySweepRetryAfterSeconds, overload.retryAfterSeconds]
+            .filter((value) => value !== undefined);
+        const retryAfterSeconds = advertised.length > 0 ? Math.max(...advertised) : undefined;
+        // Deliberately NOT "the sweep reached its end". A sweep in which relayfile
+        // shed EVERY unit still runs the loop to the end, and it got nothing done;
+        // treating that as progress would decay the ratchet in exactly the case it
+        // exists for. (`#runOnceWithDiscoveryFence` turns that sweep into an
+        // aborted one before it can commit, so the escalate branch here is reached
+        // only through `sweepOutcome === 'aborted'` — but the rule is a property of
+        // progress, not of which caller asked, and is written that way.)
+        const consecutiveOverloads = this.#discoverySweepProgress
+            ? Math.max(0, previousOverloads - 1)
+            : previousOverloads + 1;
+        const delayMs = discoveryOverloadBackoffMs(retryAfterSeconds, consecutiveOverloads);
+        const backoffUntilMs = this.#clock.now() + delayMs;
+        this.#increment('discoveryOverloadBackoffs');
+        if (sweepOutcome === 'committed') {
+            this.#logger.warn?.('[factory] discovery sweep committed despite Relayfile overload', {
+                status: overload.status,
+                reason: overload.reason,
+                retryAfterSeconds,
+                sweepOverloads: this.#discoverySweepOverloads,
+                previousOverloads,
+                consecutiveOverloads,
+                delayMs,
+                backoffUntilMs,
+            });
+        }
+        return {
+            consecutiveOverloads,
+            backoffUntilMs,
+            delayMs,
+            ...(retryAfterSeconds === undefined ? {} : { retryAfterSeconds }),
+        };
+    }
     async #performRunOnce(opts = {}) {
         const dryRun = opts.dryRun ?? this.#config.dryRun;
         const startedAtMs = this.#clock.now();
@@ -2125,15 +2482,57 @@ export class FactoryLoop {
             let readyIssueReads = 0;
             const issueEntries = [];
             for (const path of paths) {
-                const issue = await this.#readIssue(path);
+                let issue;
+                let shed = false;
+                try {
+                    issue = await this.#readIssue(path);
+                }
+                catch (error) {
+                    // #297: `#readIssue` rethrows relayfile overload and swallows every
+                    // other read fault, so this catch only ever sees the backend
+                    // shedding THIS issue's read. That is a fact about one work unit:
+                    // a sweep that pulled 40 issues and was shed on the 39th must keep
+                    // the other 39, exactly as #292 argued for dispatch failures. The
+                    // fuse is what still ends a sweep the backend is refusing.
+                    const overload = relayfileOverload(error);
+                    // Defensive: anything `#readIssue` did not swallow and is not a 429
+                    // is not ours to reclassify, and must surface as itself.
+                    if (!overload)
+                        throw error;
+                    const fuse = this.#discoveryOverloadFuseError();
+                    if (fuse)
+                        throw fuse;
+                    shed = true;
+                    this.#increment('discoveryOverloadItemsSkipped');
+                    this.#logger.warn?.('[factory] relayfile shed a ready-issue read; skipping it and continuing the sweep', {
+                        path,
+                        status: overload.status,
+                        reason: overload.reason,
+                        retryAfterSeconds: overload.retryAfterSeconds,
+                        sweepOverloads: this.#discoverySweepOverloads,
+                    });
+                    recordSkip({ issue: issueRefFromPath(path), reason: perItemDispatchSkipReason(error) });
+                }
                 readyIssueReads += 1;
+                // Relayfile served this work unit's read: the dependency is shedding
+                // but not refusing, which is what decays the ratchet (#297).
+                //
+                // `issue` is required, not just `!shed`: `#readIssue` returns
+                // `undefined` for a body it could not read at all, and the known
+                // phantom condition — the tree listing issue paths whose bodies are
+                // absent — makes every read return `undefined`. Crediting those would
+                // decay the ratchet on a sweep that served nothing.
+                if (!shed && issue)
+                    this.#discoverySweepProgress = true;
                 lastReadyReadProgressAtMs = this.#logTimedProgress(this.#config.issueSource === 'github'
                     ? '[factory] GitHub ready issue read progress'
                     : '[factory] Linear ready issue read progress', startedAtMs, lastReadyReadProgressAtMs, { read: readyIssueReads, total: paths.length, path });
-                if (issue && issueSource === 'linear') {
-                    await this.#recordCanonicalIssueState(issue);
+                if (!shed) {
+                    if (issue && issueSource === 'linear') {
+                        await this.#recordCanonicalIssueState(issue);
+                    }
+                    issueEntries.push({ path, issue });
                 }
-                issueEntries.push({ path, issue });
                 await this.#refreshLiveHeartbeatIfDue();
             }
             if (issueSource === 'github') {
@@ -2222,6 +2621,9 @@ export class FactoryLoop {
                     // A completed dispatch — even one that parks or escalates the issue —
                     // proves the pipeline still works, so the fuse below starts over.
                     unclassifiedFailuresSinceDispatch = 0;
+                    // ...and proves relayfile is still serving this sweep, which is what
+                    // decays the durable overload ratchet (#297).
+                    this.#discoverySweepProgress = true;
                     if (result.agents.length === 0 && !dryRun) {
                         const reason = result.hold?.kind === 'dependency-cycle'
                             ? `dependency cycle detected: ${result.hold.cycle?.join(' -> ') ?? 'unknown cycle'}`
@@ -2235,13 +2637,47 @@ export class FactoryLoop {
                     }
                 }
                 catch (error) {
+                    // The failure may have left half-spawned agents behind, persisted as
+                    // failure handoffs on the way out of `#dispatchUnlocked`. runLoop's
+                    // catch used to reap them because every such error aborted the pass;
+                    // now that most of them are skipped, the reap has to happen here.
+                    //
+                    // BEFORE the fatality check, not after (#298 review, round two): the
+                    // 429 that trips the overload fuse aborts this pass, and a direct
+                    // `runOnce()` — the `factory run-once` CLI, `#reconcileReadyIssues` —
+                    // has no runLoop catch behind it, so the unit that trips the fuse
+                    // would leak the agents it had already spawned. Reaping first covers
+                    // the abort and the skip with one call; it is idempotent, so the
+                    // runLoop catch finding nothing left to do is free.
+                    if (mayHaveSpawnedBeforeFailing(error)) {
+                        await this.#reapDispatchFailureHandoffsNow();
+                    }
                     // #292: issues in a pass are independent work units, so a failure
                     // that is about ONE unit costs that unit and nothing else. Only the
                     // conditions named in `#isPassFatalFailure` — the ones where
                     // continuing the pass is meaningless — abort the whole sweep.
-                    if (this.#isPassFatalFailure(error, dryRun))
-                        throw error;
-                    if (!isClassifiedPerItemDispatchFailure(error)) {
+                    if (this.#isPassFatalFailure(error, dryRun)) {
+                        // The overload fuse may have been tripped by a 429 that a caller
+                        // swallowed, leaving an unrelated error in hand. The fence keys
+                        // the durable backoff off `relayfileOverload(error)`, so hand it
+                        // the 429 rather than whatever surfaced last.
+                        throw this.#discoveryOverloadFuseError() ?? error;
+                    }
+                    const overload = relayfileOverload(error);
+                    if (overload) {
+                        // #297: shedding is a state of the dependency, not a fault of this
+                        // work unit, so it stays out of `counters.errors` and gets its own
+                        // counter — the same split #293 made for undispatchable units.
+                        this.#increment('discoveryOverloadItemsSkipped');
+                        this.#logger.warn?.('[factory] relayfile shed this work unit; skipping it and continuing the sweep', {
+                            issue: issueRef(issue).key,
+                            status: overload.status,
+                            reason: overload.reason,
+                            retryAfterSeconds: overload.retryAfterSeconds,
+                            sweepOverloads: this.#discoverySweepOverloads,
+                        });
+                    }
+                    else if (!isClassifiedPerItemDispatchFailure(error)) {
                         unclassifiedFailuresSinceDispatch += 1;
                         // A pass-wide fault can arrive disguised as a run of per-item
                         // faults. Skipping every unit would then hand back a green report
@@ -2260,11 +2696,6 @@ export class FactoryLoop {
                             error: describeError(error).errorMessage,
                         });
                         this.#error(error, issueRef(issue));
-                        // The failure may have left half-spawned agents behind. runLoop's
-                        // catch used to reap them because this error aborted the pass;
-                        // now that the pass survives, the reap has to happen here or the
-                        // agents leak until the next failed iteration.
-                        await this.#reapDispatchFailureHandoffsNow();
                     }
                     else {
                         // Not an error — the unit simply cannot be dispatched right now —
@@ -2313,6 +2744,21 @@ export class FactoryLoop {
             }
         }
     }
+    /**
+     * The 429 that ended this sweep, when relayfile has shed
+     * `DISCOVERY_OVERLOAD_PER_SWEEP_LIMIT` operations and skipping the next work
+     * unit would just be grinding a shedding dependency. Undefined below that.
+     *
+     * Returns the *latched* 429 rather than whatever error is in hand, because
+     * `#runOnceWithDiscoveryFence` keys the durable backoff off
+     * `relayfileOverload(error)` and a caller may have swallowed the 429 that
+     * tripped the fuse.
+     */
+    #discoveryOverloadFuseError() {
+        if (this.#discoverySweepOverloads < DISCOVERY_OVERLOAD_PER_SWEEP_LIMIT)
+            return undefined;
+        return this.#discoveryOverloadError;
+    }
     /**
      * Whether a failure raised while processing ONE work unit must abort the
      * whole readiness pass instead of skipping that unit.
@@ -2333,10 +2779,11 @@ export class FactoryLoop {
      *   one would be recorded as an ordinary per-issue skip. The run report
      *   would then claim a clean pass over work this process no longer has the
      *   right to touch.
-     * - Relayfile signalled overload for this sweep. The backend is shedding
-     *   load; grinding through the remaining units makes it worse, and
-     *   `#runOnceWithDiscoveryFence` is going to rethrow this at the fence
-     *   anyway.
+     * - Relayfile has shed `DISCOVERY_OVERLOAD_PER_SWEEP_LIMIT` operations in
+     *   this sweep. A single shed operation is per-item and skippable (#297),
+     *   but past this the backend is not serving this sweep at all: grinding
+     *   through the remaining units makes it worse, and the fence needs the 429
+     *   to set the durable backoff.
      * - The factory is stopping. Teardown is in progress and dispatching more
      *   agents now leaks them past the shutdown deadline.
      * - The fleet control-plane circuit is no longer closed, **on a live pass**.
@@ -2365,7 +2812,15 @@ export class FactoryLoop {
     #isPassFatalFailure(error, dryRun) {
         // Sweep-scoped: these are about this process's right or ability to run the
         // pass at all, so they hold for a dry run exactly as for a live one.
-        if (this.#discoverySweepLeaseLost || this.#discoveryOverloadError !== undefined || this.#stopping) {
+        if (this.#discoverySweepLeaseLost || this.#stopping) {
+            return true;
+        }
+        // #297: relayfile overload used to sit alongside those two, and it did not
+        // belong there. A 429 on ONE work unit is a fact about that unit's read or
+        // write, not about this process's right to run the pass — and because the
+        // flag latched for the whole sweep, the first transient shed also made
+        // every later unit fatal. Only sustained shedding is now pass-fatal.
+        if (this.#discoverySweepOverloads >= DISCOVERY_OVERLOAD_PER_SWEEP_LIMIT) {
             return true;
         }
         // Fleet-scoped, and therefore live-only. See the doc comment above.
@@ -3231,14 +3686,40 @@ export class FactoryLoop {
             return result;
         }
         catch (error) {
-            if (relayfileOverload(error) && this.#discoverySweepEpoch !== undefined) {
+            const overload = relayfileOverload(error);
+            if (overload && this.#discoverySweepEpoch !== undefined) {
                 this.#discoveryOverloadError ??= error;
+                this.#discoverySweepOverloads += 1;
+                if (overload.retryAfterSeconds !== undefined) {
+                    this.#discoverySweepRetryAfterSeconds = Math.max(this.#discoverySweepRetryAfterSeconds ?? 0, overload.retryAfterSeconds);
+                }
+                this.#increment('discoveryOverloadOperations');
+                // #297: relayfile's four overload reason codes — inflight_limit,
+                // oldest_inflight_age, router_inflight_limit, durable_object_overloaded
+                // — all share ONE message string, and they mean four different things:
+                // a DO-local admission cap, one stuck op poisoning every background
+                // caller, a Worker-global isolate cap, and the Cloudflare runtime
+                // shedding the object outright. `relayfileOverload()` has always parsed
+                // the reason; nothing on this path ever printed it, and during the
+                // 2026-08-20 outage that ambiguity was the single biggest obstacle to
+                // diagnosis. Unconditional, unlike the failure warn below: a 429 is
+                // always worth one line.
+                this.#increment(`discoveryOverloadReason:${relayfileOverloadReasonLabel(overload.reason)}`);
+                this.#logger.warn?.('[factory] relayfile shed a discovery operation', {
+                    ...metadata,
+                    status: overload.status,
+                    reason: overload.reason,
+                    retryAfterSeconds: overload.retryAfterSeconds,
+                    sweepOverloads: this.#discoverySweepOverloads,
+                    elapsedMs: this.#elapsedSince(startedAtMs),
+                });
             }
             if (opts.logFailure || waitWarnings > 0) {
                 this.#increment('relayfileOperationFailures');
                 this.#logger.warn?.('[factory] relayfile operation failed', {
                     ...metadata,
                     elapsedMs: this.#elapsedSince(startedAtMs),
+                    ...(overload ? { status: overload.status, reason: overload.reason } : {}),
                     error: describeError(error).errorMessage,
                 });
             }
@@ -3587,6 +4068,14 @@ export class FactoryLoop {
         if (!await this.#saveDispatchLifecycle(record, 'dispatching')) {
             throw new Error(`Dispatch lifecycle ownership lost immediately before spawning ${dispatchDecision.issue.key}`);
         }
+        // That save stamped `slotHeldSinceAtMs`: the row occupies a batch slot from
+        // here on. Arm its deadline before the first await rather than after a
+        // placement succeeds — `#fleet.spawn` deliberately carries no mutation
+        // timeout, so a first attempt that hangs in an otherwise idle process would
+        // otherwise hold the slot with no timer that can ever fire. That is the
+        // exact shape of #303, reached through the fresh dispatch path instead of
+        // the durable one (#303 review, CodeRabbit).
+        this.#scheduleHeldAgentDeadline(record);
         if (!dryRun)
             await this.#ensureGithubAgentQuestionWatch(record, liveIssue);
         const spawnedForReaperHandoff = [];
@@ -3778,6 +4267,7 @@ export class FactoryLoop {
             slackDegradedReason: this.#slackDegradedReason,
             eventListener: this.#eventListenerStatus(),
             readinessReconcile: this.#readinessReconcileStatus(),
+            dispatchCapacity: this.#dispatchCapacityStatus(),
             heldAgents: batch?.inFlight.flatMap((record) => heldAgentsForRecord(record, nowMs, this.#config.dispatch.agentHoldTimeoutMs, this.#config.terminalState)) ?? [],
         };
     }
@@ -3801,17 +4291,66 @@ export class FactoryLoop {
     }
     #readinessReconcileStatus() {
         const consecutiveFailures = this.#readinessReconcileConsecutiveFailures;
-        const state = this.#startMode !== 'live'
+        // #296 owns the numerator here, #295/#300 own the derivation. The earliest
+        // sweep still running — after a deadline expiry that is the abandoned one,
+        // not the current wait, or every expiry would restart the clock and a
+        // permanently stuck pass would read as merely `retrying`.
+        const inFlightSinceMs = Math.min(this.#readinessReconcileInFlightSinceMs ?? Number.POSITIVE_INFINITY, this.#readinessReconcileAbandonedSinceMs ?? Number.POSITIVE_INFINITY);
+        const settled = this.#startMode !== 'live'
             ? 'not-running'
+            // Failure-count ladder only. Precedence against `stalled` belongs to
+            // `derivedReadinessReconcileState`, which outranks everything here: a
+            // stall is the more specific fact, and `consecutiveFailures` ships
+            // alongside so nothing an alarm keyed on `degraded` needs is lost.
             : consecutiveFailures >= READINESS_RECONCILE_FAILURE_THRESHOLD
                 ? 'degraded'
                 : consecutiveFailures > 0
                     ? 'retrying'
                     : 'healthy';
+        // The counters above only move when a pass *settles*. A pass that hangs
+        // takes neither path, so `settled` would keep reporting the last finished
+        // pass — `healthy` — for as long as the process is stuck (#295). The
+        // in-flight age is the only field that can express that, so derive the
+        // state from it rather than trusting the last write.
+        const timestamps = {
+            intervalMs: this.#readinessReconcileIntervalMs,
+            ...(Number.isFinite(inFlightSinceMs) ? { inFlightSinceMs } : {}),
+            ...(this.#readinessReconcileLastStartedAtMs !== undefined
+                ? { lastStartedAtMs: this.#readinessReconcileLastStartedAtMs }
+                : {}),
+            ...(this.#readinessReconcileLastCompletedAtMs !== undefined
+                ? { lastCompletedAtMs: this.#readinessReconcileLastCompletedAtMs }
+                : {}),
+            ...(this.#readinessReconcileLastFailureAtMs !== undefined
+                ? { lastFailureAtMs: this.#readinessReconcileLastFailureAtMs }
+                : {}),
+        };
+        const nowMs = this.#clock.now();
+        // Defence in depth (#300 review, CodeRabbit). These derivations are new
+        // code from another module on a path that `status()` and every heartbeat
+        // write depend on. A throw here would take out the liveness signal the
+        // crash reaper reads — the diagnostic causing the outage it exists to
+        // explain — so a failure costs the derived fields and nothing else.
+        let inFlightMs;
+        let derived = settled;
+        try {
+            inFlightMs = readinessReconcileInFlightMs(timestamps, nowMs);
+            derived = derivedReadinessReconcileState({ ...timestamps, state: settled }, nowMs);
+        }
+        catch (error) {
+            this.#logger.warn?.('[factory] readiness health derivation failed; reporting the settled state', {
+                error: describeError(error).errorMessage,
+            });
+            inFlightMs = undefined;
+            derived = settled;
+        }
         return {
-            state,
+            state: derived === 'unknown' ? settled : derived,
             consecutiveFailures,
             failureThreshold: READINESS_RECONCILE_FAILURE_THRESHOLD,
+            intervalMs: this.#readinessReconcileIntervalMs,
+            ...(Number.isFinite(inFlightSinceMs) ? { inFlightSinceMs } : {}),
+            ...(inFlightMs !== undefined ? { inFlightMs } : {}),
             ...(this.#readinessReconcileLastDurationMs !== undefined
                 ? { lastDurationMs: this.#readinessReconcileLastDurationMs }
                 : {}),
@@ -3825,6 +4364,9 @@ export class FactoryLoop {
                 ? { lastFailureAtMs: this.#readinessReconcileLastFailureAtMs }
                 : {}),
             ...(this.#readinessReconcileLastError ? { lastError: this.#readinessReconcileLastError } : {}),
+            ...(this.#readinessReconcileLastErrorClass
+                ? { lastErrorClass: this.#readinessReconcileLastErrorClass }
+                : {}),
         };
     }
     on(event, listener) {
@@ -4142,7 +4684,7 @@ export class FactoryLoop {
                 if (timer)
                     clearTimeout(timer);
                 this.#dispatchLifecycleRetryTimers.delete(key);
-                this.#dispatchLifecycleCapacityWaitLogged.delete(key);
+                this.#dispatchLifecycleCapacityWaits.delete(key);
                 clearedKeys.add(key);
                 this.#increment('dispatchLifecycleGithubAliasesCollapsed');
             }
@@ -4200,10 +4742,67 @@ export class FactoryLoop {
         }, DISPATCH_LIFECYCLE_RENEW_MS);
         this.#dispatchLifecycleRenewTimer.unref?.();
     }
+    /**
+     * The wall-clock deadline that can free this record's batch slot, if any.
+     *
+     * Two clocks, never both. `heldSinceAtMs` is stamped by the first successful
+     * placement and bounds a team that ran and never reached a terminal state.
+     * A record that has no `heldSinceAtMs` never had a placement at all, and
+     * before #303 that made it permanently unreapable: `#scheduleHeldAgentDeadline`
+     * armed no timer and `#sweepHeldAgentDeadlines` skipped it, so a row that
+     * reached `dispatching` and lost its process held the only batch slot
+     * forever. Such a row is definitionally stuck — nothing but a placement can
+     * move it, and no placement is coming — so it gets the much shorter
+     * `agentlessHoldTimeoutMs` anchored on when it took the slot.
+     *
+     * The anchor is deliberately not `agents.size === 0`: `recordPlanned` writes
+     * the spec before the spawn returns, so a process that died mid-spawn leaves
+     * an agent entry with no result and still no placement.
+     */
+    /**
+     * Does this in-flight record hold a `batchSize` slot right now?
+     *
+     * The same predicate the state stores apply to the durable row, asked of the
+     * in-memory one. Phase alone is not it: once every implementer repo has been
+     * handed to a babysitter, admission stops counting the lifecycle, so
+     * reporting it as an occupant would name slots that are not blocking
+     * anything (#303 review, codex).
+     */
+    #recordOccupiesSlot(record) {
+        return dispatchPhaseOccupiesSlot(record.lifecyclePhase) && !dispatchHandedOffToBabysitters(record.decision.implementers, [...record.agents.values()].map((tracked) => ({ releasedAtMs: tracked.releasedAtMs, spec: tracked.spec })));
+    }
+    #holdDeadline(record) {
+        if (record.dryRun)
+            return undefined;
+        if (record.heldSinceAtMs !== undefined) {
+            const timeoutMs = this.#config.dispatch.agentHoldTimeoutMs;
+            return {
+                kind: 'agents',
+                sinceAtMs: record.heldSinceAtMs,
+                timeoutMs,
+                dueAtMs: record.heldSinceAtMs + timeoutMs,
+            };
+        }
+        // Only a row that is actually holding a slot is worth reaping; a `queued`
+        // or `waiting-for-human` row costs nothing and may wait indefinitely.
+        if (record.slotHeldSinceAtMs === undefined || !this.#recordOccupiesSlot(record)) {
+            return undefined;
+        }
+        const timeoutMs = this.#config.dispatch.agentlessHoldTimeoutMs;
+        return {
+            kind: 'agentless',
+            sinceAtMs: record.slotHeldSinceAtMs,
+            timeoutMs,
+            dueAtMs: record.slotHeldSinceAtMs + timeoutMs,
+        };
+    }
     #scheduleHeldAgentDeadline(record) {
-        if (this.#stopping || record.dryRun || record.heldSinceAtMs === undefined || record.agents.size === 0)
+        if (this.#stopping)
             return;
-        const dueAtMs = record.heldSinceAtMs + this.#config.dispatch.agentHoldTimeoutMs;
+        const deadline = this.#holdDeadline(record);
+        if (!deadline)
+            return;
+        const dueAtMs = deadline.dueAtMs;
         if (this.#heldAgentDeadlineTimer &&
             this.#heldAgentDeadlineDueAtMs !== undefined &&
             this.#heldAgentDeadlineDueAtMs <= dueAtMs)
@@ -4243,14 +4842,16 @@ export class FactoryLoop {
     }
     async #sweepHeldAgentDeadlines() {
         const nowMs = this.#clock.now();
-        const timeoutMs = this.#config.dispatch.agentHoldTimeoutMs;
         for (const record of [...(await this.#batch()).inFlight]) {
-            const heldSinceAtMs = record.heldSinceAtMs;
-            if (record.dryRun ||
-                heldSinceAtMs === undefined ||
-                record.agents.size === 0 ||
-                nowMs - heldSinceAtMs < timeoutMs)
+            const deadline = this.#holdDeadline(record);
+            if (!deadline || nowMs < deadline.dueAtMs)
                 continue;
+            // The durable row wins the classification when there is one. The
+            // in-memory record can lag a placement made in another process, and
+            // reading the stale one would relabel a team that did run as
+            // never-placed — which also excludes its agents from the release below,
+            // leaking live workers (#303 review, CodeRabbit).
+            let effective = deadline;
             const key = issueKey(record.issue);
             if (this.#abandonedDispatchReasons.has(key))
                 continue;
@@ -4264,26 +4865,42 @@ export class FactoryLoop {
                     await this.#finishDurableRelease(record, lifecycle.releaseReason);
                     continue;
                 }
+                // Re-derive against the durable row before tearing anything down. The
+                // in-memory record can be a beat behind a placement that just
+                // succeeded in this process or a takeover in another, and the
+                // never-placed deadline exists precisely to catch rows nothing is
+                // moving — it must not be what ends a dispatch that just started
+                // moving (#303 must-not-fire).
+                const durable = this.#holdDeadline(inFlightRecordFromLifecycle(lifecycle));
+                if (!durable || this.#clock.now() < durable.dueAtMs)
+                    continue;
+                effective = durable;
                 if (!await this.#assertDispatchLifecycleOwner(record))
                     continue;
             }
-            const heldForMs = Math.max(0, this.#clock.now() - heldSinceAtMs);
+            const agentless = effective.kind === 'agentless';
+            const heldForMs = Math.max(0, this.#clock.now() - effective.sinceAtMs);
             const details = {
                 issue: record.issue.key,
                 heldForMs,
-                holdTimeoutMs: timeoutMs,
+                holdTimeoutMs: effective.timeoutMs,
                 waitingForTerminalState: this.#config.terminalState,
-                reason: HELD_PAST_DEADLINE_RELEASE_REASON,
+                reason: agentless ? AGENTLESS_SLOT_PAST_DEADLINE_RELEASE_REASON : HELD_PAST_DEADLINE_RELEASE_REASON,
                 agents: [...record.agents.keys()].sort(),
+                ...(agentless ? { phase: record.lifecyclePhase } : {}),
             };
-            this.#logger.warn?.('[factory] releasing agents held past deadline', details);
-            await this.#abandonStuckDispatch(record, HELD_PAST_DEADLINE_RELEASE_REASON);
+            this.#logger.warn?.(agentless
+                ? '[factory] releasing a dispatch lifecycle that never placed an agent'
+                : '[factory] releasing agents held past deadline', details);
+            await this.#abandonStuckDispatch(record, details.reason);
             const lifecycle = this.#usesDurableDispatchLifecycle()
                 ? await this.#state.getDispatchLifecycle(this.#workspaceId, key)
                 : undefined;
             if (!lifecycle || isTerminalDispatchLifecycle(lifecycle)) {
-                this.#increment('heldPastDeadlineReleases');
-                this.#logger.warn?.('[factory] released agents held past deadline', details);
+                this.#increment(agentless ? 'agentlessSlotPastDeadlineReleases' : 'heldPastDeadlineReleases');
+                this.#logger.warn?.(agentless
+                    ? '[factory] released a dispatch lifecycle that never placed an agent'
+                    : '[factory] released agents held past deadline', details);
             }
         }
     }
@@ -4654,6 +5271,14 @@ export class FactoryLoop {
     }
     async #saveDispatchLifecycle(record, phase, pullRequest, releaseReason, releasedAgentNames = new Set(), telemetry = {}) {
         record.lifecyclePhase = phase;
+        // Mirror what the store stamps, so the reaper's never-placed clock is
+        // readable from the in-memory record between durable reads (#303). The
+        // store still owns the authoritative value; this uses the same predicate so
+        // the two cannot disagree.
+        if (this.#recordOccupiesSlot(record))
+            record.slotHeldSinceAtMs ??= this.#clock.now();
+        else
+            record.slotHeldSinceAtMs = undefined;
         if (record.dryRun || !this.#usesDurableDispatchLifecycle())
             return true;
         if (isTerminalDispatchPhase(phase))
@@ -4721,6 +5346,20 @@ export class FactoryLoop {
             if (isTerminalDispatchLifecycle(lifecycle)) {
                 this.#dispatchLifecycleEpochs.delete(key);
             }
+            // Wake the capacity waiters exactly when this write gives a slot back —
+            // occupied before, not occupied after — and never otherwise (#303
+            // review, cubic).
+            //
+            // Not "when it goes terminal". `releasing` already does not occupy a
+            // slot, so a normal completion frees it one save *before* `complete`,
+            // and a babysitter handoff frees it without ever going terminal at all.
+            // Keying on the terminal save alone therefore both fires for rows that
+            // freed nothing (a `queued` row abandoned at startup) and misses the
+            // writes that actually freed something. The occupancy transition is the
+            // event; the phase is only a proxy for it.
+            if (previous && dispatchLifecycleOccupiesSlot(previous) && !dispatchLifecycleOccupiesSlot(lifecycle)) {
+                this.#resetDispatchCapacityBackoff();
+            }
             return true;
         });
     }
@@ -4734,7 +5373,130 @@ export class FactoryLoop {
             resolve(phase);
         this.#dispatchTerminalWaiters.delete(key);
     }
-    #scheduleDispatchLifecycleRetry(record) {
+    /**
+     * Re-arm delay for a capacity wait: 1 s doubling to a 30 s ceiling (#303).
+     *
+     * Only the capacity path backs off. An ownership wait is already bounded by
+     * `DISPATCH_LIFECYCLE_LEASE_MS`, and every other failure is a real error
+     * whose fast retry is the recovery. A capacity wait has no bound at all —
+     * it ends when some other lifecycle terminates, which may be hours away or,
+     * before this fix, never.
+     */
+    #capacityRetryDelayMs(attempts) {
+        return Math.min(DISPATCH_LIFECYCLE_RETRY_MS * 2 ** Math.max(0, attempts - 1), DISPATCH_LIFECYCLE_RETRY_MAX_MS);
+    }
+    /** Issue keys currently holding a `batchSize` slot, for operator surfaces. */
+    #dispatchSlotOccupants() {
+        return (this.#batchView?.inFlight ?? [])
+            .filter((record) => !record.dryRun && this.#recordOccupiesSlot(record))
+            .map((record) => ({
+            issue: record.issue.key,
+            ...(record.lifecyclePhase ? { phase: record.lifecyclePhase } : {}),
+            agents: record.agents.size,
+            // Specs, not workers: `recordPlanned` writes an entry before the spawn
+            // returns, so `agents > 0` is not proof of a placement (#303 review).
+            placedAgents: [...record.agents.values()].filter((tracked) => tracked.result !== undefined).length,
+            ...(record.heldSinceAtMs !== undefined
+                ? { heldForMs: Math.max(0, this.#clock.now() - record.heldSinceAtMs) }
+                : {}),
+            ...(record.slotHeldSinceAtMs !== undefined
+                ? { slotHeldForMs: Math.max(0, this.#clock.now() - record.slotHeldSinceAtMs) }
+                : {}),
+        }))
+            .sort((left, right) => left.issue.localeCompare(right.issue));
+    }
+    /**
+     * Batch occupancy as an operator-readable fact (#303).
+     *
+     * Before this, a full batch was visible only as the *absence* of dispatch:
+     * `readinessReconcile` stayed green, `consecutiveFailures` stayed 0, and the
+     * one capacity log had fired hours earlier. Publishing occupancy is what
+     * turns "nothing is being dispatched" into a question an operator can answer
+     * without reading the state document.
+     */
+    #dispatchCapacityStatus() {
+        const nowMs = this.#clock.now();
+        const occupants = this.#dispatchSlotOccupants();
+        const waits = [...this.#dispatchLifecycleCapacityWaits.entries()];
+        const longestWaitMs = waits.length === 0
+            ? undefined
+            : Math.max(...waits.map(([, wait]) => Math.max(0, nowMs - wait.sinceAtMs)));
+        return {
+            batchSize: this.#config.batchSize,
+            active: occupants.length,
+            waiting: waits.length,
+            waitWarnMs: this.#config.dispatch.capacityWaitWarnMs,
+            agentlessHoldTimeoutMs: this.#config.dispatch.agentlessHoldTimeoutMs,
+            ...(longestWaitMs !== undefined ? { longestWaitMs } : {}),
+            ...(occupants.length > 0 ? { occupants } : {}),
+            ...(waits.length > 0
+                ? {
+                    waitingIssues: waits
+                        .sort(([, left], [, right]) => left.sinceAtMs - right.sinceAtMs)
+                        .map(([key]) => key),
+                }
+                : {}),
+        };
+    }
+    #recordDispatchCapacityWait(record, key) {
+        const nowMs = this.#clock.now();
+        let wait = this.#dispatchLifecycleCapacityWaits.get(key);
+        if (!wait) {
+            wait = { record, sinceAtMs: nowMs, attempts: 0 };
+            this.#dispatchLifecycleCapacityWaits.set(key, wait);
+            this.#increment('dispatchLifecycleCapacityWaits');
+        }
+        wait.record = record;
+        wait.attempts += 1;
+        const retryMs = this.#capacityRetryDelayMs(wait.attempts);
+        const waitedMs = Math.max(0, nowMs - wait.sinceAtMs);
+        // Escalate on every backoff step, then once a minute after the delay
+        // caps. The old behaviour logged once per key and went silent forever,
+        // which is what made a 14-hour dispatch outage look like an idle Factory.
+        const stepChanged = wait.lastLoggedRetryMs !== retryMs;
+        const overdue = wait.lastLoggedAtMs === undefined ||
+            nowMs - wait.lastLoggedAtMs >= DISPATCH_LIFECYCLE_CAPACITY_WAIT_LOG_MS;
+        if (stepChanged || overdue) {
+            wait.lastLoggedAtMs = nowMs;
+            wait.lastLoggedRetryMs = retryMs;
+            this.#logger.warn?.('[factory] durable dispatch is queued for batch capacity; retries remain active', {
+                issue: record.issue.key,
+                retryMs,
+                attempts: wait.attempts,
+                waitedMs,
+                batchSize: this.#config.batchSize,
+                occupiedBy: this.#dispatchSlotOccupants().map((occupant) => occupant.issue),
+            });
+        }
+        return retryMs;
+    }
+    /**
+     * Put every capacity waiter back on the fast path, because a slot just freed.
+     *
+     * The backoff exists to stop a storm of retries asking a question whose
+     * answer is not changing. When a lifecycle reaches a terminal phase the
+     * answer *has* changed, so parking a waiter behind a 30 s timer would trade
+     * the storm for latency — and for a slot released by another process, that
+     * timer is the only signal this one gets (#303 review follow-up).
+     *
+     * The wait's `sinceAtMs` is deliberately untouched: the issue really has
+     * been waiting that long, and the escalating warning should keep saying so.
+     */
+    #resetDispatchCapacityBackoff() {
+        if (this.#stopping || this.#dispatchLifecycleCapacityWaits.size === 0)
+            return;
+        for (const [key, wait] of this.#dispatchLifecycleCapacityWaits) {
+            wait.attempts = 0;
+            const timer = this.#dispatchLifecycleRetryTimers.get(key);
+            if (!timer)
+                continue;
+            clearTimeout(timer);
+            this.#dispatchLifecycleRetryTimers.delete(key);
+            this.#scheduleDispatchLifecycleRetry(wait.record);
+        }
+        this.#increment('dispatchCapacityBackoffResets');
+    }
+    #scheduleDispatchLifecycleRetry(record, delayMs = DISPATCH_LIFECYCLE_RETRY_MS) {
         const key = issueKey(record.issue);
         if (this.#stopping || this.#dispatchLifecycleRetryTimers.has(key))
             return;
@@ -4742,23 +5504,17 @@ export class FactoryLoop {
             this.#dispatchLifecycleRetryTimers.delete(key);
             const drive = this.#driveDispatchLifecycle(key)
                 .then(() => {
-                this.#dispatchLifecycleCapacityWaitLogged.delete(key);
+                this.#dispatchLifecycleCapacityWaits.delete(key);
                 this.#dispatchLifecycleOwnershipWaitLogged.delete(key);
             })
                 .catch((error) => {
+                let nextDelayMs = DISPATCH_LIFECYCLE_RETRY_MS;
                 if (error instanceof DispatchLifecycleCapacityError) {
                     this.#dispatchLifecycleOwnershipWaitLogged.delete(key);
-                    if (!this.#dispatchLifecycleCapacityWaitLogged.has(key)) {
-                        this.#dispatchLifecycleCapacityWaitLogged.add(key);
-                        this.#increment('dispatchLifecycleCapacityWaits');
-                        this.#logger.warn?.('[factory] durable dispatch is queued for batch capacity; retries remain active', {
-                            issue: record.issue.key,
-                            retryMs: DISPATCH_LIFECYCLE_RETRY_MS,
-                        });
-                    }
+                    nextDelayMs = this.#recordDispatchCapacityWait(record, key);
                 }
                 else if (error instanceof DispatchLifecycleOwnedElsewhereError) {
-                    this.#dispatchLifecycleCapacityWaitLogged.delete(key);
+                    this.#dispatchLifecycleCapacityWaits.delete(key);
                     if (!this.#dispatchLifecycleOwnershipWaitLogged.has(key)) {
                         this.#dispatchLifecycleOwnershipWaitLogged.add(key);
                         this.#increment('dispatchLifecycleOwnershipWaits');
@@ -4772,18 +5528,18 @@ export class FactoryLoop {
                     }
                 }
                 else {
-                    this.#dispatchLifecycleCapacityWaitLogged.delete(key);
+                    this.#dispatchLifecycleCapacityWaits.delete(key);
                     this.#dispatchLifecycleOwnershipWaitLogged.delete(key);
                     this.#logger.warn?.('[factory] durable dispatch lifecycle retry failed', {
                         issue: record.issue.key,
                         error: describeError(error).errorMessage,
                     });
                 }
-                this.#scheduleDispatchLifecycleRetry(record);
+                this.#scheduleDispatchLifecycleRetry(record, nextDelayMs);
             })
                 .finally(() => this.#dispatchLifecycleDrives.delete(drive));
             this.#dispatchLifecycleDrives.add(drive);
-        }, DISPATCH_LIFECYCLE_RETRY_MS);
+        }, delayMs);
         this.#dispatchLifecycleRetryTimers.set(key, timer);
     }
     #scheduleReleaseRetry(record, reason) {
@@ -6299,8 +7055,32 @@ export class FactoryLoop {
             registryPath,
             eventListener: this.#eventListenerStatus(),
             readinessReconcile: this.#readinessReconcileStatus(),
+            dispatchCapacity: this.#dispatchCapacityStatus(),
             fleetControlPlane: this.#fleetControlPlane.status(),
         };
+        // The deployed container serves `/healthz` straight out of this file and
+        // has no redaction logic of its own, so publish the already-safe view here
+        // rather than leaving that boundary to whoever reads the file (#295).
+        // Derived against this daemon's clock: every duration in it is a
+        // difference between timestamps this process wrote.
+        //
+        // Guarded (#300 review, CodeRabbit): this heartbeat is what the crash
+        // reaper and `/healthz` read to decide the daemon is alive, and several
+        // callers of this method sit outside any try/catch. A projection failure
+        // must cost the diagnostics block, never the heartbeat — the omitted block
+        // is itself legible, since `factory diagnose` reports a missing one rather
+        // than a false green.
+        try {
+            heartbeat.health = publicHealthFromHeartbeat(heartbeat, {
+                nowMs: updatedAtMs,
+                staleMs: this.#config.loop.heartbeatStaleMs,
+            });
+        }
+        catch (error) {
+            this.#logger.warn?.('[factory] public health projection failed; heartbeat written without it', {
+                error: describeError(error).errorMessage,
+            });
+        }
         await mkdir(dirname(path), { recursive: true });
         await writeFile(path, `${JSON.stringify(heartbeat, null, 2)}\n`, 'utf8');
         await this.#writeInFlightRegistry(registryPath, path);
@@ -6319,11 +7099,18 @@ export class FactoryLoop {
         });
     }
     async #reapDispatchFailureHandoffsNow(heartbeatPath = this.#loopReapPaths?.heartbeatPath ?? this.#config.loop.heartbeatPath, registryPath = this.#loopReapPaths?.registryPath ?? this.#config.loop.registryPath) {
-        const handoffs = await this.#state.listFailureHandoffs(this.#workspaceId);
-        if (handoffs.length === 0) {
-            return;
-        }
         try {
+            // Inside the try, not before it (#298 review). Every caller reaps while
+            // already handling a failure and then propagates that failure: the
+            // per-item catch rethrows the dispatch error, runLoop's catch is mid
+            // teardown. A throw from here would REPLACE the error in flight — and a
+            // replaced 429 is no longer recognised as overload at the discovery
+            // fence, silently dropping the advertised backoff. Reaping is
+            // best-effort by construction; the caller's error always wins.
+            const handoffs = await this.#state.listFailureHandoffs(this.#workspaceId);
+            if (handoffs.length === 0) {
+                return;
+            }
             const protectedPids = await this.#protectedPids();
             let registryChanged = false;
             const readyToClear = new Set();
@@ -6699,10 +7486,12 @@ export class FactoryLoop {
         }
         return [...handoffs.values()];
     }
-    async #teardownFailedDispatchWorktrees(handoffs, releaseReason = 'dispatch failed') {
+    async #teardownFailedDispatchWorktrees(handoffs, releaseReason = 'dispatch failed', opts = {}) {
         if (!this.#worktrees || !handoffs.some((handoff) => handoff.worktree))
             return false;
-        const failed = await this.#releaseAndTerminateAgents(handoffs.map((handoff) => [handoff.name, handoff.tracked]), releaseReason, 'completion');
+        const failed = await this.#releaseAndTerminateAgents(handoffs
+            .filter((handoff) => !opts.skipNeverPlacedAgents || handoff.tracked.result !== undefined)
+            .map((handoff) => [handoff.name, handoff.tracked]), releaseReason, 'completion');
         if (failed.length > 0)
             return false;
         try {
@@ -6878,6 +7667,17 @@ export class FactoryLoop {
                     : 'agent_spawn_failed',
             });
         }
+        // The never-placed deadline can fire while this spawn is in flight — that
+        // is the whole point of arming it before the first await, and it makes a
+        // late `spawn` result newly reachable (#303 review, cubic). By now the
+        // reaper may have fenced, released and terminalized the lifecycle, so this
+        // placement belongs to nothing: recording it would attach a live worker to
+        // a record the reaper has finished with, and nothing downstream would ever
+        // release it. Hand it straight to teardown instead.
+        if (!await this.#dispatchLifecycleStillOwned(record)) {
+            await this.#releaseOrphanedLatePlacement(record, spec, result);
+            throw new LatePlacementReleasedError(record.issue.key, result.name ?? spec.name);
+        }
         record.heldSinceAtMs ??= this.#clock.now();
         batch.recordSpawn(record, spec, invocationId, result);
         if (!await this.#saveDispatchLifecycle(record, 'dispatching')) {
@@ -6889,6 +7689,68 @@ export class FactoryLoop {
             await this.#reportAgent(record, spawned, 'agent.spawned');
         return { name: result.name };
     }
+    /**
+     * Is this process still the owner of a lifecycle that is not already done?
+     *
+     * Cheap local checks first — a pending abandon reason, or a dropped epoch,
+     * both of which the reaper sets before anything durable is re-read — then the
+     * durable row, which is authoritative when another owner terminalized it.
+     */
+    async #dispatchLifecycleStillOwned(record) {
+        const key = issueKey(record.issue);
+        if (this.#abandonedDispatchReasons.has(key))
+            return false;
+        if (!this.#usesDurableDispatchLifecycle())
+            return true;
+        const epoch = this.#dispatchLifecycleEpochs.get(key);
+        if (epoch === undefined)
+            return false;
+        const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
+        if (!lifecycle || isTerminalDispatchLifecycle(lifecycle))
+            return false;
+        // A live row is not the same as *our* row. Another owner can reclaim an
+        // expired lease and leave it nonterminal, and the cached epoch here would
+        // still say we hold it (#303 review, cubic). This mirrors exactly what
+        // `saveDispatchLifecycle` will accept — owner, epoch and an unexpired
+        // lease — so a placement is recorded only when the write that follows can
+        // actually land. Otherwise the save fails and the worker leaks through the
+        // generic ownership-lost path instead of orphan cleanup.
+        const lease = lifecycle.lease;
+        return lease !== undefined &&
+            lease.owner === this.#dispatchLifecycleOwner &&
+            lease.epoch === epoch &&
+            lease.leaseUntilMs > this.#clock.now();
+    }
+    /**
+     * Tear down a placement that landed after its lifecycle was already released.
+     *
+     * Deliberately not routed through `#abandonStuckDispatch`: that record is
+     * terminal and its batch entry is gone, so there is nothing left to abandon.
+     * The only thing that still exists is a live worker on the fleet.
+     */
+    async #releaseOrphanedLatePlacement(record, spec, result) {
+        const name = result.name ?? spec.name;
+        this.#increment('lateSpawnPlacementsReleased');
+        this.#logger.warn?.('[factory] releasing an agent that finished spawning after its dispatch was released', {
+            issue: record.issue.key,
+            agent: name,
+            role: spec.role,
+        });
+        this.#fleet.markAgentTerminal?.(name, 'dispatch-released-before-placement');
+        try {
+            await this.#fleet.release(name, 'dispatch-released-before-placement');
+        }
+        catch (error) {
+            // The reaper handoff owns anything this could not clean up; failing here
+            // would only replace a released worker with an unreleased one.
+            this.#increment('lateSpawnPlacementReleaseFailures');
+            this.#logger.warn?.('[factory] failed to release a late placement; leaving it to the orphan reaper', {
+                issue: record.issue.key,
+                agent: name,
+                error: describeError(error).errorMessage,
+            });
+        }
+    }
     async #handleAgentExit(name, reason) {
         if (this.#stopping) {
             return;
@@ -7943,7 +8805,14 @@ export class FactoryLoop {
             this.#scheduleAbandonedDispatchRetry(record, reason);
             return;
         }
-        const agents = [...record.agents];
+        // A never-placed record carries specs, not workers: `recordPlanned` writes
+        // the spec before the spawn returns, so a dispatch that died mid-spawn
+        // leaves a name the broker never issued. Releasing one fails, which fails
+        // the whole cleanup and re-arms the abandon retry forever — turning the
+        // #303 reap into a second, quieter wedge. Their worktrees are still torn
+        // down below.
+        const neverPlaced = reason === AGENTLESS_SLOT_PAST_DEADLINE_RELEASE_REASON;
+        const agents = [...record.agents].filter(([, tracked]) => !neverPlaced || tracked.result !== undefined);
         for (const [agentName, tracked] of agents) {
             if (!heldPastDeadline && tracked.spec.role === 'implementer')
                 continue;
@@ -7963,7 +8832,7 @@ export class FactoryLoop {
                 const failed = await this.#releaseAndTerminateAgents(nonWorktreeAgents, agentReleaseReason, 'completion');
                 cleanupComplete = failed.length === 0;
             }
-            cleanupComplete = await this.#teardownFailedDispatchWorktrees(worktreeHandoffs, agentReleaseReason) && cleanupComplete;
+            cleanupComplete = await this.#teardownFailedDispatchWorktrees(worktreeHandoffs, agentReleaseReason, { skipNeverPlacedAgents: neverPlaced }) && cleanupComplete;
         }
         else if (agents.length > 0) {
             const failed = await this.#releaseAndTerminateAgents(agents, agentReleaseReason, 'completion');
@@ -14941,6 +15810,15 @@ const githubIssueAuthor = (issue) => {
     }
     return source ? undefined : githubAuthorLogin(payload)?.trim() || undefined;
 };
+/**
+ * An `IssueRef` for a path whose issue body could not be read at all — the
+ * shape a relayfile-shed ready-issue read leaves behind (#297). The key is
+ * what an operator needs to correlate the skip; the uuid falls back to it.
+ */
+const issueRefFromPath = (path) => {
+    const key = keyFromPath(path);
+    return { uuid: uuidFromPath(path) ?? key, key, path };
+};
 const issueRef = (issue) => ({ uuid: issue.uuid, key: issue.key, path: issue.path });
 // Preserve the historical Linear state namespace while keeping GitHub-native
 // issue numbers independent across repositories in the same workspace.
@@ -16854,10 +17732,54 @@ const relayfileOverload = (error) => {
         stringValue(flat.code) ?? stringValue(data.code) ?? 'rate_limited';
     return { status, reason, ...(retryAfterSeconds === undefined ? {} : { retryAfterSeconds }) };
 };
+/**
+ * relayfile's overload reason codes, allowlisted.
+ *
+ * `IterationReport.skipped[].reason` is serialized to stdout by `factory
+ * run-once`, so it stays a fixed classification plus a known code — the same
+ * public-surface rule #293 applied to error class names — rather than
+ * whatever string the dependency happened to send.
+ */
+const RELAYFILE_OVERLOAD_REASONS = new Set([
+    // Admission gate inside the workspace durable object.
+    'inflight_limit',
+    'oldest_inflight_age',
+    'write_admission_limit',
+    // Worker-side backpressure, per isolate rather than per workspace.
+    'router_inflight_limit',
+    // The Cloudflare runtime shed the object; relayfile only relabels it.
+    'durable_object_overloaded',
+    // relayfileOverload()'s fallback when the body carried no reason at all.
+    'rate_limited',
+]);
+/**
+ * Both the run-report reason and the per-reason counter key are built from
+ * this, so an unknown code from the dependency can neither leak into stdout
+ * nor open an unbounded counter namespace.
+ */
+const relayfileOverloadReasonLabel = (reason) => RELAYFILE_OVERLOAD_REASONS.has(reason) ? reason : 'unrecognized';
+/**
+ * How long to wait before the next discovery sweep after relayfile shed this
+ * one.
+ *
+ * The advertised `Retry-After` is authoritative in BOTH directions (#297):
+ * it is the first rung, so we never retry sooner than the dependency allows,
+ * and it bounds the ceiling, so we never sleep for minutes because of a
+ * request to wait seconds. Without an advertised delay there is nothing to
+ * respect and the original five-minute ladder governs unchanged.
+ */
 const discoveryOverloadBackoffMs = (retryAfterSeconds, consecutiveOverloads) => {
-    const retryAfterMs = Math.max(0, Math.ceil((retryAfterSeconds ?? 0) * 1_000));
-    const exponentialMs = Math.min(DISCOVERY_OVERLOAD_BACKOFF_MAX_MS, 5_000 * (2 ** Math.min(10, Math.max(0, consecutiveOverloads - 1))));
-    return Math.max(retryAfterMs, exponentialMs);
+    const advertisedMs = retryAfterSeconds === undefined
+        ? undefined
+        : Math.max(DISCOVERY_OVERLOAD_BACKOFF_MIN_MS, Math.ceil(retryAfterSeconds * 1_000));
+    const baseMs = advertisedMs ?? DISCOVERY_OVERLOAD_BACKOFF_BASE_MS;
+    // A dependency that asks for longer than the advertised ceiling still gets
+    // what it asked for; the ceiling only stops the ladder from overshooting it.
+    const ceilingMs = advertisedMs === undefined
+        ? DISCOVERY_OVERLOAD_BACKOFF_MAX_MS
+        : Math.max(advertisedMs, DISCOVERY_OVERLOAD_ADVERTISED_BACKOFF_MAX_MS);
+    const steps = Math.min(10, Math.max(0, consecutiveOverloads - 1));
+    return Math.min(ceilingMs, baseMs * (2 ** steps));
 };
 const eventSequenceNumber = (eventId) => {
     const whole = Number(eventId);
@@ -17086,10 +18008,6 @@ const telemetryCategory = (value) => {
     const normalized = value.trim().toLowerCase().replace(/[^a-z0-9._:/-]+/gu, '-');
     return normalized.slice(0, 120) || undefined;
 };
-const telemetryErrorClass = (error) => {
-    const name = error instanceof Error ? error.name : '';
-    return /^[A-Za-z][A-Za-z0-9]{0,63}(?:Error|Exception)$/u.test(name) ? name : 'Error';
-};
 const isTimeoutError = (error) => error instanceof Error && (error.name === 'TimeoutError' || error.name === 'AbortError');
 const retryOnTimeout = async (fn, opts) => {
     let lastError;
@@ -17236,6 +18154,7 @@ const lifecycleFromInFlightRecord = (record, runId, phase, updatedAtMs, pullRequ
     ...(releaseReason ? { releaseReason } : {}),
     ...(cost ? { cost: structuredClone(cost) } : {}),
     ...(record.heldSinceAtMs !== undefined ? { heldSinceAtMs: record.heldSinceAtMs } : {}),
+    ...(record.slotHeldSinceAtMs !== undefined ? { slotHeldSinceAtMs: record.slotHeldSinceAtMs } : {}),
     updatedAtMs,
 });
 const inFlightRecordFromLifecycle = (lifecycle) => ({
@@ -17252,9 +18171,14 @@ const inFlightRecordFromLifecycle = (lifecycle) => ({
     invocationIds: new Set(lifecycle.invocationIds),
     result: lifecycle.result ? structuredClone(lifecycle.result) : undefined,
     ...(lifecycle.dispatchClaim ? { dispatchClaim: { ...lifecycle.dispatchClaim } } : {}),
-    heldSinceAtMs: lifecycle.heldSinceAtMs ?? (lifecycle.agents.some((agent) => agent.releasedAtMs === undefined)
+    heldSinceAtMs: lifecycle.heldSinceAtMs ?? (
+    // A live placement the durable row predates the `heldSinceAtMs` field for.
+    // `tracked.result` is what distinguishes a placement from a spec that
+    // `recordPlanned` wrote and no spawn ever answered (#303).
+    lifecycle.agents.some((agent) => agent.releasedAtMs === undefined && agent.tracked.result !== undefined)
         ? lifecycle.updatedAtMs
         : undefined),
+    slotHeldSinceAtMs: lifecycle.slotHeldSinceAtMs,
     lifecyclePhase: lifecycle.phase,
 });
 const dispatchResultFromLifecycle = (lifecycle) => lifecycle.result ? structuredClone(lifecycle.result) : {
@@ -17290,6 +18214,29 @@ export class LiveDispatchStateChangedError extends Error {
         this.issueKey = issueKey;
     }
 }
+/**
+ * A placement that finished spawning after its dispatch had been released.
+ *
+ * The never-placed deadline (#303) can terminalize a lifecycle while
+ * `#fleet.spawn` is still in flight; the worker is released and the dispatch
+ * unwinds. That is a known, named, self-healing race — the issue returns to the
+ * queue and is re-dispatched — so it must be classified rather than counted as
+ * an unexplained fault. It fires precisely under slow spawns, which is the
+ * condition the deadline exists for, so a degraded fleet produces it
+ * repeatedly; left unclassified, five in a row would trip
+ * `UNCLASSIFIED_DISPATCH_FAILURE_LIMIT` and abort the whole readiness pass,
+ * turning a bounded slot into a stopped sweep (#303 review, factory-lead).
+ */
+export class LatePlacementReleasedError extends Error {
+    issueKey;
+    agentName;
+    constructor(issueKey, agentName) {
+        super(`Dispatch lifecycle for ${issueKey} was released while ${agentName} was still spawning`);
+        this.name = 'LatePlacementReleasedError';
+        this.issueKey = issueKey;
+        this.agentName = agentName;
+    }
+}
 /** Whether a thrown value is a {@link LiveDispatchStateChangedError}. */
 export function isLiveDispatchStateChangedError(error) {
     return error instanceof LiveDispatchStateChangedError;
@@ -17323,7 +18270,32 @@ const UNCLASSIFIED_DISPATCH_FAILURE_LIMIT = 5;
  * skippable and are exempt from the consecutive-failure fuse.
  */
 const isClassifiedPerItemDispatchFailure = (error) => error instanceof LiveDispatchStateChangedError ||
-    error instanceof DispatchLifecycleClaimRefusedError;
+    error instanceof DispatchLifecycleClaimRefusedError ||
+    // #303: the never-placed deadline released this dispatch while its spawn was
+    // still in flight. Named, expected and self-healing — the issue goes back to
+    // the queue — and it recurs under exactly the slow-spawn conditions the
+    // deadline exists for, so leaving it unclassified would let a degraded fleet
+    // trip the pass-abort fuse. Its own counters keep it visible.
+    error instanceof LatePlacementReleasedError ||
+    // Relayfile shedding one operation is a state of the dependency, not an
+    // unexplained fault, and it has its own fuse — see #297 and
+    // DISCOVERY_OVERLOAD_PER_SWEEP_LIMIT.
+    relayfileOverload(error) !== undefined;
+/**
+ * Whether a per-item failure could have left half-spawned agents behind.
+ *
+ * The two lifecycle refusals are decided before `#dispatchUnlocked` spawns
+ * anything, so there is nothing to reap for them. Everything else can fail
+ * *after* a spawn — including relayfile shedding a post-spawn read — having
+ * persisted the agents as failure handoffs on the way out.
+ *
+ * Deliberately a denylist rather than an allowlist: a new failure mode that
+ * nobody classified should default to "reap it", because the cost of a
+ * needless reap is one no-op pass over an empty handoff list, while the cost
+ * of a missed one is leaked agents and duplicate workers on the next retry.
+ */
+const mayHaveSpawnedBeforeFailing = (error) => !(error instanceof LiveDispatchStateChangedError) &&
+    !(error instanceof DispatchLifecycleClaimRefusedError);
 /**
  * The run-report reason recorded for a work unit the pass could not dispatch.
  *
@@ -17334,8 +18306,13 @@ const isClassifiedPerItemDispatchFailure = (error) => error instanceof LiveDispa
  * `describeControlPlaneError` makes for circuit state.
  */
 const perItemDispatchSkipReason = (error) => {
+    const overload = relayfileOverload(error);
+    if (overload)
+        return `relayfile overloaded (${relayfileOverloadReasonLabel(overload.reason)})`;
     if (error instanceof LiveDispatchStateChangedError)
         return 'live state changed during dispatch';
+    if (error instanceof LatePlacementReleasedError)
+        return 'dispatch released while its agent was still spawning';
     if (error instanceof DispatchLifecycleClaimRefusedError) {
         return error.refusal === 'terminal'
             ? 'dispatch lifecycle already terminal'