@agent-relay/factory 0.1.68 → 0.1.70

package/dist/orchestrator/factory.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
 import { dirname, isAbsolute, resolve } from 'node:path';
 import { DEFAULT_READINESS_RECONCILE_TIMEOUT_MS, FactoryConfigSchema } from '../config/schema.js';
 import { linearByStatePath, linearByIdPath, linearByUuidPath } from '../constants/linear.js';
@@ -10,17 +10,18 @@ import { VerificationPipeline } from '../environments/verification-pipeline.js';
 import { factoryWorktreeIssueSlug, factoryWorktreePath } from '../git/agent-worktree.js';
 import { InMemoryStateStore } from '../state/in-memory-state-store.js';
 import { dispatchHandedOffToBabysitters, dispatchLifecycleOccupiesSlot, dispatchPhaseOccupiesSlot, } from '../state/dispatch-lifecycle-slot.js';
-import { containsExplicitIssueReference, containsIssueKey, factoryBranchBelongsToIssue } from '../issue-key-match.js';
+import { branchImplementsIssue, containsExplicitIssueReference, containsIssueKey, factoryBranchBelongsToIssue, prBodyDisclaimsClosing, prClosureAuthority } from '../issue-key-match.js';
 import { normalizeLogger, normalizeLogValue, setSafeErrorStack, stringifyLogValue } from '../logging.js';
 import { isInFactoryScope } from '../safety/factory-scope.js';
 import { dispatchRelayflowForChangeEvent } from '../dispatch/relayflow-registry.js';
-import { dispatchAgentIdentityKey } from '../dispatch/work-unit-identity.js';
+import { dispatchAgentIdentityKey, dispatchIssueIdentity, mirrorWorkUnitOrigin } from '../dispatch/work-unit-identity.js';
 import { deriveDescriptorsFromMount, prescriptiveInstructions, } from '@agent-relay/integration-prompts';
 import { parseGithubHumanInputRequest, renderAgentTask, } from '../dispatch/templates.js';
 import { resolveTestGuidance } from '../dispatch/test-guidance.js';
 import { HeuristicTriage, TieredTriage, babysitterSpec, isShapeLabel, scopeFromLabels, swarmChannel, swarmMemberSlugs, swarmTaskFor } from '../triage/index.js';
 import { agentNameForRole, sanitizeAgentSlug } from '../triage/agent-names.js';
 import { isResourceSubscriptionsUnavailable } from '../subscriptions/index.js';
+import { DispatchLifecycleMigrationConflictError } from '../ports/state.js';
 import { AppGithubWriteback, FACTORY_GITHUB_STATUS_LABELS, GhCliGithubWriteback, MountGithubRead, MountLinearWriteback, MountSlackWriteback, slackChannelAliases, slackChannelSegment } from '../writeback/index.js';
 import { parseSlackThreadReply, slackThreadReplyGlob } from '../subscriptions/slack-filter.js';
 import { asRecord, parseJsonContent, stableHash, wrappedPayload } from '../writeback/shared.js';
@@ -28,6 +29,7 @@ import { issueKey, } from './batch-tracker.js';
 import { dependencyIdentity, findDependencyCycle, parseBlockedBy, resolveDependency, } from './dependencies.js';
 import { CoalescedTaskQueue } from './coalesced-task-queue.js';
 import { findAgentProcessByName, readProcessIdentity } from './process-identity.js';
+import { writeJsonFileAtomically } from './atomic-json-file.js';
 import { readFactoryInFlightRegistry, terminatePids } from './reaper.js';
 import { createFactoryCloudEventV1, factoryCloudReleaseReasonV1, } from '../observability/events.js';
 import { telemetryErrorClass } from '../observability/error-class.js';
@@ -482,6 +484,9 @@ export class FactoryLoop {
     #liveHeartbeatInFlight = false;
     #liveHeartbeatRefresh;
     #liveHeartbeatLastWriteMs = 0;
+    #heartbeatStartedAtMs;
+    #progressSequence = 0;
+    #lastProgressAtMs;
     #stoppingHeartbeatRefreshActive = false;
     #readinessReconcileTimer;
     #readinessReconcileInFlight;
@@ -643,7 +648,9 @@ export class FactoryLoop {
     #started = false;
     #startMode;
     #stopping = false;
+    #readOnly;
     constructor(config, ports) {
+        this.#readOnly = ports.readOnly ?? false;
         this.#config = config;
         this.#mount = ports.mount;
         // Resolved role<->state mapping. The CLI injects a name-resolved, per-team
@@ -729,7 +736,14 @@ export class FactoryLoop {
                 }
             },
         });
-        this.#wireFleetEvents();
+        // Read-only commands consume no fleet events, and subscribing is not free:
+        // the relay client mints this process's workspace identity to open the
+        // socket. Wiring it here unconditionally is what made `factory status`
+        // register an agent it then abandoned before presence (factory-cloud#55).
+        // The live paths wire in `#start()` instead, where the subscription is
+        // actually used and the identity is meant to persist.
+        if (!this.#readOnly)
+            this.#wireFleetEvents();
     }
     async #resolveIntegrationInstructions() {
         if (this.#integrationInstructionsRefresh) {
@@ -807,7 +821,7 @@ export class FactoryLoop {
      * row to wait on, or the wait ended because Factory is stopping.
      */
     async waitForDispatchTerminal(issue) {
-        const key = issueKey(issue);
+        const key = dispatchLifecycleKey(issue);
         const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
         // No durable row means this dispatch never claimed a lifecycle: a
         // dependency park, a triage escalation, and a label refusal all return
@@ -893,6 +907,13 @@ export class FactoryLoop {
         return observedPhase;
     }
     async start(opts = {}) {
+        // A read-only instance was built with no fleet event wiring and, in the
+        // CLI, with a fleet client that cannot register. Starting one would be a
+        // half-live daemon; refuse rather than let a future caller reintroduce the
+        // side effect this mode exists to remove.
+        if (this.#readOnly) {
+            throw new Error('Factory was constructed read-only and cannot be started');
+        }
         if (this.#started) {
             return;
         }
@@ -1290,6 +1311,7 @@ export class FactoryLoop {
         }
     }
     async #startLiveHeartbeat() {
+        this.#beginHeartbeatLifetime();
         this.#liveHeartbeatActive = true;
         await this.#writeLiveHeartbeat('running');
         this.#scheduleLiveHeartbeatRefresh();
@@ -1354,6 +1376,11 @@ export class FactoryLoop {
         await this.#writeLoopHeartbeat(this.#config.loop.heartbeatPath, this.#config.loop.registryPath, status, 0, 0);
         this.#liveHeartbeatLastWriteMs = this.#clock.now();
     }
+    #beginHeartbeatLifetime() {
+        this.#heartbeatStartedAtMs = this.#clock.now();
+        this.#progressSequence = 0;
+        this.#lastProgressAtMs = undefined;
+    }
     #liveOptions(overrides) {
         return {
             transport: overrides.transport ?? this.#config.liveSubscription.transport,
@@ -1853,7 +1880,7 @@ export class FactoryLoop {
         try {
             const batch = await this.#batch();
             const records = batch.inFlight
-                .filter((record) => !record.dryRun && !this.#completionInFlight.has(issueKey(record.issue)));
+                .filter((record) => !record.dryRun && !this.#completionInFlight.has(dispatchLifecycleKey(record.issue)));
             if (records.length === 0) {
                 return;
             }
@@ -2009,7 +2036,7 @@ export class FactoryLoop {
     async #orphanedPrMetaPaths(record) {
         const wanted = [];
         if (this.#usesDurableDispatchLifecycle()) {
-            const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+            const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue));
             const receipts = lifecycle?.pullRequests ?? (lifecycle?.pullRequest ? [lifecycle.pullRequest] : []);
             for (const receipt of receipts)
                 wanted.push({ repo: receipt.repo, prNumber: receipt.number });
@@ -2294,6 +2321,10 @@ export class FactoryLoop {
             leaseReleased = completed;
             if (!completed)
                 throw new Error('discovery sweep lease was lost before completion');
+            // This is the progress boundary consumed by deployment health. A timer
+            // firing, a sweep starting, or a failed/deferred sweep must not move it.
+            this.#progressSequence += 1;
+            this.#lastProgressAtMs = this.#clock.now();
             this.#logger.info?.('[factory] discovery sweep checkpoint committed', {
                 owner: claim.lease.owner,
                 epoch: claim.lease.epoch,
@@ -2560,12 +2591,13 @@ export class FactoryLoop {
                 const labels = isGithubIssue(issue)
                     ? new Set(issue.labels.map((label) => label.trim().toLowerCase()))
                     : undefined;
-                const requiredLabel = this.#config.safety.requireLabel.trim().toLowerCase();
+                // Must stay the same scope test as dispatch and as
+                // #reconcileOrphanedGithubInProgress. Gating on the scope label alone
+                // left every title-scoped issue stuck in `factory:in-progress` forever.
                 const mayRecoverGithubOrphan = !wasReady &&
                     !dryRun &&
                     issueSource === 'github' &&
-                    Boolean(requiredLabel) &&
-                    Boolean(labels?.has(requiredLabel)) &&
+                    isInFactoryScope(issue, this.#config.safety) &&
                     Boolean(labels?.has('factory:in-progress')) &&
                     !labels?.has('factory:human-review');
                 if (!mayRecoverGithubOrphan) {
@@ -3182,9 +3214,13 @@ export class FactoryLoop {
         if (!isGithubIssue(issue))
             return { recovered: false, reason: 'issue is not GitHub-native' };
         const labels = new Set(issue.labels.map((label) => label.trim().toLowerCase()));
-        const required = this.#config.safety.requireLabel.trim().toLowerCase();
-        if (!required ||
-            !labels.has(required) ||
+        // Recovery must admit exactly what dispatch admits. Dispatch accepts the
+        // configured title prefix OR the scope label (`isInFactoryScope`), but this
+        // gate used to demand the label alone — so an issue admitted by its title
+        // could be dispatched and then never un-stuck, keeping `factory:in-progress`
+        // forever once its dispatch died. factory#139 is the live instance: title
+        // `[factory] ...`, and its only label is `factory:in-progress`.
+        if (!isInFactoryScope(issue, this.#config.safety) ||
             !labels.has('factory:in-progress') ||
             labels.has('factory:human-review'))
             return { recovered: false, reason: 'issue is not an orphan-recovery candidate' };
@@ -3316,7 +3352,7 @@ export class FactoryLoop {
         }
     }
     async #releaseOrphanedGithubLifecycle(issue, identity, candidate) {
-        let key = candidate.key;
+        const key = candidate.key;
         let lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
         if (!lifecycle)
             return true;
@@ -3356,7 +3392,6 @@ export class FactoryLoop {
                     });
                     return false;
                 }
-                key = claim.key ?? key;
                 lifecycle = claim.lifecycle;
                 epoch = claim.lease.epoch;
                 this.#dispatchLifecycleEpochs.set(key, epoch);
@@ -3499,7 +3534,7 @@ export class FactoryLoop {
         const record = batch.start(decision, false);
         if (!record) {
             if (durableAdoption) {
-                const durable = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(decision.issue));
+                const durable = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(decision.issue));
                 if (durable) {
                     this.#scheduleDispatchLifecycleRetry(inFlightRecordFromLifecycle(durable));
                     this.#increment('githubOrphanedPullRequestsAdopted');
@@ -3750,6 +3785,7 @@ export class FactoryLoop {
         const maxConsecutiveFailures = Math.min(5, Math.max(1, Math.trunc(opts.maxConsecutiveFailures ?? this.#config.loop.maxConsecutiveFailures)));
         const heartbeatPath = opts.heartbeatPath ?? this.#config.loop.heartbeatPath;
         const registryPath = opts.registryPath ?? this.#config.loop.registryPath;
+        this.#beginHeartbeatLifetime();
         this.#loopReapPaths = { heartbeatPath, registryPath };
         const reports = [];
         let consecutiveFailures = 0;
@@ -3814,15 +3850,29 @@ export class FactoryLoop {
         }
     }
     async triageIssue(issue) {
-        return this.#triage.triage(issue, {
+        return await this.#triageWithOrigin(issue);
+    }
+    /**
+     * The mirror origin is a property of the issue Factory fed in, not of the
+     * engine's answer, so it is re-attached here rather than trusted from the
+     * engine. `TriageDecisionSchema` drops unknown keys, so `LlmTriage` returns a
+     * decision that has lost it, and a custom `TriageEngine` never set it at all
+     * — either way a Linear mirror would fall back to `linear:<uuid>` and
+     * duplicate its own GitHub-native arrival, which is the defect #211 fixes.
+     */
+    async #triageWithOrigin(issue) {
+        const decision = await this.#triage.triage(issue, {
             config: this.#config,
             repoMap: repoMapFromConfig(this.#config),
         });
+        return decisionWithMirrorOrigin(decision, issue);
     }
     async dispatch(decision, opts = {}) {
         const dryRun = opts.dryRun ?? this.#config.dryRun;
         const phase = triageEscalationReason(decision) ? 'escalation' : 'dispatch';
-        const key = `${issueStateKey(decision.issue)}:${dryRun ? 'dry-run' : 'live'}:${phase}`;
+        // The dispatch concurrency gate is per work unit: a mirror of an issue
+        // already being dispatched must join that call, not start a second one.
+        const key = `${dispatchLifecycleKey(decision.issue)}:${dryRun ? 'dry-run' : 'live'}:${phase}`;
         const inFlight = this.#dispatchInFlight.get(key);
         if (inFlight) {
             this.#increment('dispatchDuplicateSuppressed');
@@ -3850,9 +3900,9 @@ export class FactoryLoop {
             return existingRecord.result;
         }
         if (!dryRun && this.#usesDurableDispatchLifecycle()) {
-            const durable = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(decision.issue));
+            const durable = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(decision.issue));
             if (durable && !isTerminalDispatchLifecycle(durable)) {
-                if (durable.result && this.#dispatchLifecycleEpochs.has(issueKey(decision.issue))) {
+                if (durable.result && this.#dispatchLifecycleEpochs.has(dispatchLifecycleKey(decision.issue))) {
                     return durable.result;
                 }
                 if (this.#startMode === 'dispatch-owner') {
@@ -4107,7 +4157,7 @@ export class FactoryLoop {
                     state: 'pending',
                     updatedAtMs: this.#clock.now(),
                 };
-                this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+                this.#dispatchClaimStatuses.set(dispatchLifecycleKey(record.issue), record.dispatchClaim);
             }
             await this.#writeInFlightRegistry();
             const comment = dispatchComment(dispatchDecision, agents);
@@ -4115,10 +4165,37 @@ export class FactoryLoop {
             if (!dryRun) {
                 const issue = await this.#readIssue(dispatchDecision.issue.path);
                 if (!issue || !this.#isIssueReady(issue)) {
-                    throw new LiveDispatchStateChangedError(dispatchDecision.issue.key);
+                    // The agents spawned a few lines above can reach terminal before we
+                    // get here. Their completion writeback parks the issue — Linear
+                    // `humanReview`, or the GitHub human-review label — and stamps
+                    // *this same record's* lifecycle on the way past. Re-reading the
+                    // issue then shows "not ready", but the writer was us.
+                    //
+                    // Treating that as a foreign change is not a cosmetic misreport: the
+                    // catch below classifies LiveDispatchStateChangedError as terminal
+                    // and calls #releaseAndTerminateAgents, so a dispatch whose agents
+                    // finished quickly tore down its own completed work and reported
+                    // RETRYABLE to its supervisor (factory#319).
+                    //
+                    // Only THIS dispatch's own confirmed issue writeback may excuse the
+                    // change. Lifecycle phases are not enough: `publishing` is entered
+                    // before the PR is published and `parking` before anything touches
+                    // the issue, so a phase records local progress, not authorship — and
+                    // a foreign park landing during those awaits would be misread as
+                    // ours (codex review on #321). Losing the row to another owner is a
+                    // different condition and is still caught where it always was, by
+                    // #saveDispatchLifecycle returning false.
+                    if (record.issueWritebackConfirmedAtMs === undefined) {
+                        throw new LiveDispatchStateChangedError(dispatchDecision.issue.key);
+                    }
+                    // The claim is moot and would be wrong to write: it would drag an
+                    // issue our own lifecycle has already parked back to `implementing`.
+                }
+                else {
+                    implementingStateId = await this.#applyDispatchClaim(record, issue, comment);
+                    record.issueWritebackConfirmedAtMs = this.#clock.now();
+                    this.#emit('writeback-verified', { issue: dispatchDecision.issue, path: issue.path });
                 }
-                implementingStateId = await this.#applyDispatchClaim(record, issue, comment);
-                this.#emit('writeback-verified', { issue: dispatchDecision.issue, path: issue.path });
             }
             const result = {
                 issue: dispatchDecision.issue,
@@ -4245,7 +4322,7 @@ export class FactoryLoop {
                 ...(tracked.result?.node ? { node: tracked.result.node } : {}),
             })),
             claim: {
-                ...(record.dispatchClaim ?? this.#dispatchClaimStatuses.get(issueKey(record.issue)) ?? {
+                ...(record.dispatchClaim ?? this.#dispatchClaimStatuses.get(dispatchLifecycleKey(record.issue)) ?? {
                     state: 'pending',
                     updatedAtMs: nowMs,
                 }),
@@ -4475,7 +4552,25 @@ export class FactoryLoop {
                 if (previews.length > 0)
                     this.#previewReferences.set(issueKey(lifecycle.issue), previews);
                 hasNonterminalDurableLifecycle = true;
-                const claim = await this.#state.claimDispatchLifecycle(this.#workspaceId, key, lifecycle, this.#dispatchLifecycleOwner, this.#clock.now(), DISPATCH_LIFECYCLE_LEASE_MS);
+                // A work unit whose keys cannot be reconciled must not strand the rows
+                // behind it — #315 is the same lesson from the shed-read path. Retain
+                // the conflicting rows, leave that one unit blocked for an operator,
+                // and carry on adopting the rest.
+                let claim;
+                try {
+                    claim = await this.#state.claimDispatchLifecycle(this.#workspaceId, key, lifecycle, this.#dispatchLifecycleOwner, this.#clock.now(), DISPATCH_LIFECYCLE_LEASE_MS);
+                }
+                catch (error) {
+                    if (!(error instanceof DispatchLifecycleMigrationConflictError))
+                        throw error;
+                    this.#increment('dispatchLifecycleMigrationConflicts');
+                    this.#logger.error?.('[factory] dispatch is blocked for one work unit until its keys are reconciled', {
+                        issue: lifecycle.issue.key,
+                        canonicalKey: error.canonicalKey,
+                        conflictingKeys: error.conflictingKeys,
+                    });
+                    continue;
+                }
                 if (!claim.acquired || !claim.lease) {
                     // The other process may have crashed while its nominal lease is
                     // still live. Keep this process attached so it reclaims the row
@@ -4483,7 +4578,7 @@ export class FactoryLoop {
                     this.#scheduleDispatchLifecycleRetry(inFlightRecordFromLifecycle(claim.lifecycle));
                     continue;
                 }
-                this.#dispatchLifecycleEpochs.set(claim.key ?? key, claim.lease.epoch);
+                this.#dispatchLifecycleEpochs.set(key, claim.lease.epoch);
                 this.#hydrateCostLedger(claim.lifecycle);
                 if (claim.lifecycle.phase === 'waiting-for-human')
                     continue;
@@ -4492,7 +4587,37 @@ export class FactoryLoop {
                 if (!durableRecord.dryRun &&
                     claim.lifecycle.phase !== 'writeback-applied' &&
                     claim.lifecycle.phase !== 'releasing') {
-                    liveIssue = await this.#readIssue(durableRecord.issue.path);
+                    // `#readIssue` swallows every read failure except a relayfile 429,
+                    // which it rethrows so callers can back off. On this path that
+                    // rethrow aborted the whole adoption: this row was never restored
+                    // into the batch, every later row was skipped, and no hold deadline
+                    // was armed for any of them (#315). Startup already degrades safely
+                    // when the issue is simply unreadable — it treats the row as not
+                    // externally terminal and lets the retry driver carry it — so a shed
+                    // read must degrade the same way rather than strand the batch.
+                    try {
+                        liveIssue = await this.#readIssue(durableRecord.issue.path);
+                    }
+                    catch (error) {
+                        const overload = relayfileOverload(error);
+                        if (!overload)
+                            throw error;
+                        this.#increment('startupIssueReadsShed');
+                        this.#logger.warn?.('[factory] startup issue read was shed; adopting without it', {
+                            issue: durableRecord.issue.key,
+                            status: overload.status,
+                            reason: relayfileOverloadReasonLabel(overload.reason),
+                        });
+                    }
+                    // A row persisted before #211 has no `origin`, so a Linear mirror
+                    // still resolves to `linear:<uuid>` and a GitHub-native arrival for
+                    // the same work unit would claim alongside it — the rolling-upgrade
+                    // form of the duplicate this change removes. Nothing on the row links
+                    // it to its upstream, but the issue we just read does, so backfill it
+                    // here under the lease this process already holds. The next claim or
+                    // load then recognises the row by identity and re-keys it.
+                    if (liveIssue)
+                        await this.#backfillMirrorOrigin(key, claim, liveIssue);
                     // A babysat Linear issue already at Done may have merged while this
                     // process was down. Let authoritative PR restoration drive the
                     // normal `complete` path so merged work is not mislabeled abandoned.
@@ -4522,7 +4647,7 @@ export class FactoryLoop {
                 if (claim.lifecycle.phase === 'running' &&
                     this.#ticketDispatchNotificationIsPending(claim.lifecycle)) {
                     if (!liveIssue) {
-                        this.#dispatchLifecycleEpochs.delete(claim.key ?? key);
+                        this.#dispatchLifecycleEpochs.delete(key);
                         this.#scheduleDispatchLifecycleRetry(restored);
                         throw new Error(`Unable to recover ticket-dispatch notification ${restored.issue.key}: issue is not currently readable`);
                     }
@@ -4629,11 +4754,28 @@ export class FactoryLoop {
                     });
                 }
             }
-            this.#rescheduleHeldAgentDeadlineSweep();
         }
         catch (error) {
             this.#logger.warn?.('[factory] failed to re-adopt durable in-flight agents', { error });
         }
+        finally {
+            // Arming has to survive everything above it (#315).
+            //
+            // This is the only thing that arms a hold deadline for a row that
+            // survived a restart, and it used to be the last statement of the `try`.
+            // Two fleet awaits sit above it — `reconcileTrackedAgents`, which is not
+            // circuit-proxied and so reaches the transport, and the guarded `roster`,
+            // which throws outright once the circuit is open. With the broker down
+            // either one throws, the catch logs, and no hold deadline is armed for
+            // that boot: the #304 reaper is present in the build and was never
+            // scheduled. That is the failure mode reaping exists to clear, so the
+            // arming must not be reachable only along the happy path.
+            //
+            // A `dispatching` row is additionally armed by the per-row retry driver
+            // below, which is why the wedge shows up on a `running` row: `running` is
+            // the one slot-occupying phase that never gets a retry scheduled here.
+            this.#rescheduleHeldAgentDeadlineSweep();
+        }
     }
     async #deduplicateQueuedGithubLifecycleAliases(lifecycles) {
         const groups = new Map();
@@ -4852,7 +4994,7 @@ export class FactoryLoop {
             // never-placed — which also excludes its agents from the release below,
             // leaking live workers (#303 review, CodeRabbit).
             let effective = deadline;
-            const key = issueKey(record.issue);
+            const key = dispatchLifecycleKey(record.issue);
             if (this.#abandonedDispatchReasons.has(key))
                 continue;
             if (this.#usesDurableDispatchLifecycle()) {
@@ -4904,6 +5046,36 @@ export class FactoryLoop {
             }
         }
     }
+    /**
+     * Records the upstream origin on an adopted lifecycle that predates it.
+     * Best-effort: a failed write leaves the row exactly as it was, and the next
+     * startup tries again.
+     */
+    async #backfillMirrorOrigin(key, claim, liveIssue) {
+        const epoch = claim.lease?.epoch;
+        if (epoch === undefined || claim.lifecycle.issue.origin)
+            return;
+        const origin = mirrorWorkUnitOrigin(liveIssue);
+        if (!origin)
+            return;
+        const issue = { ...claim.lifecycle.issue, origin };
+        const enriched = {
+            ...claim.lifecycle,
+            issue,
+            decision: { ...claim.lifecycle.decision, issue },
+        };
+        const saved = await this.#state.saveDispatchLifecycle(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch, this.#clock.now(), enriched).catch((error) => {
+            this.#logger.warn?.('[factory] could not backfill mirror origin on an adopted lifecycle', {
+                issue: claim.lifecycle.issue.key,
+                error: describeError(error).errorMessage,
+            });
+            return false;
+        });
+        if (!saved)
+            return;
+        claim.lifecycle = enriched;
+        this.#increment('dispatchLifecycleMirrorOriginsBackfilled');
+    }
     async #renewDispatchLifecycles() {
         for (const [key, epoch] of [...this.#dispatchLifecycleEpochs]) {
             const renewed = await this.#state.renewDispatchLifecycle(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch, this.#clock.now(), DISPATCH_LIFECYCLE_LEASE_MS);
@@ -4928,7 +5100,7 @@ export class FactoryLoop {
         }
     }
     async #claimDispatchLifecycle(decision, dryRun, preparedRunId, initial = {}) {
-        const key = issueKey(decision.issue);
+        const key = dispatchLifecycleKey(decision.issue);
         const seed = {
             runId: preparedRunId ?? randomUUID(),
             issue: { ...decision.issue },
@@ -4951,7 +5123,7 @@ export class FactoryLoop {
                 : `dispatch lifecycle is owned by ${claim.lifecycle.lease?.owner ?? 'another publisher'}`;
             throw new DispatchLifecycleClaimRefusedError(decision.issue.key, terminal ? 'terminal' : 'owned-elsewhere', `Refusing to dispatch ${decision.issue.key}: ${reason}`);
         }
-        this.#dispatchLifecycleEpochs.set(claim.key ?? key, claim.lease.epoch);
+        this.#dispatchLifecycleEpochs.set(key, claim.lease.epoch);
         this.#hydrateCostLedger(claim.lifecycle);
         this.#scheduleDispatchLifecycleRenewal();
         if (claim.created) {
@@ -5007,7 +5179,7 @@ export class FactoryLoop {
     }
     async #reportAgent(record, tracked, type, options = {}) {
         const lifecycle = await this.#state
-            .getDispatchLifecycle(this.#workspaceId, issueKey(record.issue))
+            .getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue))
             .catch(() => undefined);
         if (!lifecycle)
             return;
@@ -5035,7 +5207,7 @@ export class FactoryLoop {
     }
     async #handleAgentUsage(usage, key) {
         const record = (await this.#batch()).getIssueByAgent(usage.name);
-        const activeRecord = record && issueKey(record.issue) === key ? record : undefined;
+        const activeRecord = record && dispatchLifecycleKey(record.issue) === key ? record : undefined;
         let tracked = activeRecord?.agents.get(usage.name);
         const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
         // Completion removes the in-memory batch record immediately after the
@@ -5143,7 +5315,7 @@ export class FactoryLoop {
     async #dispatchLifecycleKeyForAgent(name) {
         const record = (await this.#batch()).getIssueByAgent(name);
         if (record?.agents.has(name))
-            return issueKey(record.issue);
+            return dispatchLifecycleKey(record.issue);
         return (await this.#findDispatchLifecycleAgent(name))?.key;
     }
     #serializeDispatchLifecyclePersistence(key, operation) {
@@ -5283,7 +5455,7 @@ export class FactoryLoop {
             return true;
         if (isTerminalDispatchPhase(phase))
             await this.#drainAgentUsage();
-        const key = issueKey(record.issue);
+        const key = dispatchLifecycleKey(record.issue);
         return this.#serializeDispatchLifecyclePersistence(key, async () => {
             const epoch = this.#dispatchLifecycleEpochs.get(key);
             if (epoch === undefined) {
@@ -5368,7 +5540,7 @@ export class FactoryLoop {
     // after release could see it cleared, or see the next dispatch for the same
     // issue, and classify the wrong run.
     #resolveDispatchTerminalWaiters(issue, phase) {
-        const key = issueKey(issue);
+        const key = dispatchLifecycleKey(issue);
         for (const resolve of this.#dispatchTerminalWaiters.get(key) ?? [])
             resolve(phase);
         this.#dispatchTerminalWaiters.delete(key);
@@ -5497,7 +5669,7 @@ export class FactoryLoop {
         this.#increment('dispatchCapacityBackoffResets');
     }
     #scheduleDispatchLifecycleRetry(record, delayMs = DISPATCH_LIFECYCLE_RETRY_MS) {
-        const key = issueKey(record.issue);
+        const key = dispatchLifecycleKey(record.issue);
         if (this.#stopping || this.#dispatchLifecycleRetryTimers.has(key))
             return;
         const timer = setTimeout(() => {
@@ -5547,7 +5719,7 @@ export class FactoryLoop {
             this.#scheduleDispatchLifecycleRetry(record);
             return;
         }
-        const key = issueKey(record.issue);
+        const key = dispatchLifecycleKey(record.issue);
         if (this.#stopping || this.#dispatchLifecycleRetryTimers.has(key))
             return;
         const timer = setTimeout(() => {
@@ -5585,7 +5757,7 @@ export class FactoryLoop {
             if (!claim.acquired || !claim.lease) {
                 throw new DispatchLifecycleOwnedElsewhereError(claim.lifecycle.lease?.leaseUntilMs);
             }
-            this.#dispatchLifecycleEpochs.set(claim.key ?? key, claim.lease.epoch);
+            this.#dispatchLifecycleEpochs.set(key, claim.lease.epoch);
             this.#hydrateCostLedger(claim.lifecycle);
             this.#scheduleDispatchLifecycleRenewal();
             lifecycle = claim.lifecycle;
@@ -5838,7 +6010,7 @@ export class FactoryLoop {
                 state: 'pending',
                 updatedAtMs: this.#clock.now(),
             };
-            this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+            this.#dispatchClaimStatuses.set(dispatchLifecycleKey(record.issue), record.dispatchClaim);
         }
         await this.#writeInFlightRegistry();
         if (!record.dryRun) {
@@ -5964,7 +6136,7 @@ export class FactoryLoop {
     async #finishDurableRelease(record, releaseReason) {
         const batch = await this.#batch();
         const reason = releaseReason ?? (this.#config.terminalState === 'human-review' ? 'issue-human-review' : 'issue-done');
-        const releaseKey = issueKey(record.issue);
+        const releaseKey = dispatchLifecycleKey(record.issue);
         // Terminal writeback has already been acknowledged before this method is
         // entered. Remove externally reachable routes first so a stuck agent
         // release cannot leave a preview live after Human Review or Done.
@@ -6040,7 +6212,7 @@ export class FactoryLoop {
     async #assertIssueDispatchLifecycleOwner(issue) {
         if (!this.#usesDurableDispatchLifecycle())
             return true;
-        const key = issueKey(issue);
+        const key = dispatchLifecycleKey(issue);
         const epoch = this.#dispatchLifecycleEpochs.get(key);
         if (epoch === undefined)
             return false;
@@ -6179,7 +6351,7 @@ export class FactoryLoop {
             state: 'verified',
             updatedAtMs: this.#clock.now(),
         };
-        this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+        this.#dispatchClaimStatuses.set(dispatchLifecycleKey(record.issue), record.dispatchClaim);
         await this.#writeDispatchClaimRegistry(record.issue);
         return implementingStateId;
     }
@@ -6208,7 +6380,7 @@ export class FactoryLoop {
                     ...(deadLettered ? { deadLettered: true } : {}),
                     updatedAtMs: this.#clock.now(),
                 };
-                this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+                this.#dispatchClaimStatuses.set(dispatchLifecycleKey(record.issue), record.dispatchClaim);
                 await this.#writeDispatchClaimRegistry(record.issue);
                 if (deadLettered) {
                     this.#increment('dispatchWritebackDeadLetters');
@@ -6437,7 +6609,16 @@ export class FactoryLoop {
                 !labels.every((label) => typeof label === 'string')) {
                 return undefined;
             }
-            if (state !== 'open' || !labels.some((label) => label.trim().toLowerCase() === requiredLabel)) {
+            // Retain Factory's own lifecycle rows even when they lack the scope
+            // label. The index carries no title, so a title-scoped issue cannot be
+            // recognised here — and dropping it means its file is never read and the
+            // orphan-recovery sweep never sees it. `factory:in-progress` is a label
+            // only Factory applies, so a row carrying it is by definition
+            // Factory-touched and worth reading; `isInFactoryScope` downstream
+            // remains the authority on whether anything may be done with it.
+            const rowLabels = labels.map((label) => label.trim().toLowerCase());
+            if (state !== 'open' ||
+                !(rowLabels.includes(requiredLabel) || rowLabels.includes('factory:in-progress'))) {
                 continue;
             }
             paths.push(`${GITHUB_ISSUE_ROOT}/${owner}__${repo}/issues/by-id/${number}.json`);
@@ -7034,24 +7215,48 @@ export class FactoryLoop {
                 await this.#state.recordDispatchAttempt(this.#workspaceId, key, dispatchState);
                 this.#increment('dispatchTerminalReopened');
             }
-            for (const [key, lifecycle] of await this.#state.listDispatchLifecycles(this.#workspaceId)) {
-                if (lifecycle.issue.key !== issue.key || !isTerminalDispatchLifecycle(lifecycle))
+            // Match on the work unit, not the surface key: a completed Linear mirror
+            // persists `AR-448` while the GitHub-native arrival of the same issue is
+            // `448`, and comparing surface keys would leave that terminal row in
+            // place to refuse the reopened work forever.
+            const reopenedIdentity = safeDispatchLifecycleKey(issueRefForState(issue));
+            for (const [lifecycleKey, lifecycle] of await this.#state.listDispatchLifecycles(this.#workspaceId)) {
+                if (!isTerminalDispatchLifecycle(lifecycle))
                     continue;
-                await this.#state.clearDispatchLifecycle(this.#workspaceId, key);
-                this.#dispatchLifecycleEpochs.delete(key);
+                const matches = reopenedIdentity !== undefined &&
+                    safeDispatchLifecycleKey(lifecycle.issue) === reopenedIdentity;
+                if (!matches && lifecycle.issue.key !== issue.key)
+                    continue;
+                await this.#state.clearDispatchLifecycle(this.#workspaceId, lifecycleKey);
+                this.#dispatchLifecycleEpochs.delete(lifecycleKey);
             }
         }
         await this.#state.recordCanonicalState(this.#workspaceId, key, issue.stateId);
     }
     async #writeLoopHeartbeat(path, registryPath, status, iteration, maxIterations) {
         const updatedAtMs = this.#clock.now();
+        this.#heartbeatStartedAtMs ??= updatedAtMs;
         const heartbeat = {
             pid: process.pid,
             status,
+            source: maxIterations === 0 ? 'live-timer' : 'bounded-loop',
             iteration,
             maxIterations,
+            startedAt: new Date(this.#heartbeatStartedAtMs).toISOString(),
+            startedAtMs: this.#heartbeatStartedAtMs,
+            progressContract: 'discovery-sweep-v1',
             updatedAt: new Date(updatedAtMs).toISOString(),
             updatedAtMs,
+            ...(this.#lastProgressAtMs !== undefined
+                ? {
+                    progress: {
+                        sequence: this.#progressSequence,
+                        operation: 'discovery-sweep',
+                        updatedAt: new Date(this.#lastProgressAtMs).toISOString(),
+                        updatedAtMs: this.#lastProgressAtMs,
+                    },
+                }
+                : {}),
             registryPath,
             eventListener: this.#eventListenerStatus(),
             readinessReconcile: this.#readinessReconcileStatus(),
@@ -7081,8 +7286,10 @@ export class FactoryLoop {
                 error: describeError(error).errorMessage,
             });
         }
-        await mkdir(dirname(path), { recursive: true });
-        await writeFile(path, `${JSON.stringify(heartbeat, null, 2)}\n`, 'utf8');
+        // Atomic publish (#323): `/healthz` and the crash reaper read this file
+        // while it is being rewritten, and a torn read reaches them as a missing
+        // heartbeat, i.e. as a dead daemon.
+        await writeJsonFileAtomically(path, heartbeat);
         await this.#writeInFlightRegistry(registryPath, path);
         const batch = this.#batchView;
         await this.#report({
@@ -7369,7 +7576,7 @@ export class FactoryLoop {
                 this.#logger.warn?.(`[factory] failed to release ${agentName} during ${context}`, error);
                 if (record) {
                     const lifecycle = await this.#state
-                        .getDispatchLifecycle(this.#workspaceId, issueKey(record.issue))
+                        .getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue))
                         .catch(() => undefined);
                     if (lifecycle) {
                         await this.#reportLifecycle(lifecycle, 'factory.failure', {
@@ -7544,7 +7751,7 @@ export class FactoryLoop {
                 }
             }
             const fleetTracked = this.#fleet.trackedAgents?.().get(agentName);
-            const dispatchClaim = this.#dispatchClaimStatuses.get(issueKey(issue));
+            const dispatchClaim = this.#dispatchClaimStatuses.get(dispatchLifecycleKey(issue));
             agents.push({
                 name: agentName,
                 role: tracked.spec.role,
@@ -7568,7 +7775,7 @@ export class FactoryLoop {
                 if (record.dryRun)
                     continue;
                 if (record.dispatchClaim) {
-                    this.#dispatchClaimStatuses.set(issueKey(record.issue), record.dispatchClaim);
+                    this.#dispatchClaimStatuses.set(dispatchLifecycleKey(record.issue), record.dispatchClaim);
                 }
                 for (const [agentName, tracked] of record.agents) {
                     await appendAgent(record.issue, agentName, tracked, record);
@@ -7585,8 +7792,10 @@ export class FactoryLoop {
             updatedAtMs,
             agents,
         };
-        await mkdir(dirname(path), { recursive: true });
-        await writeFile(path, `${JSON.stringify(registry, null, 2)}\n`, 'utf8');
+        // Atomic publish (#323): the crash reaper reads this file in the same
+        // sweep as the heartbeat, so leaving it torn keeps the reaper racy even
+        // with an atomic heartbeat.
+        await writeJsonFileAtomically(path, registry);
     }
     async #spawnAgent(record, spec, dryRun) {
         const batch = await this.#batch();
@@ -7697,7 +7906,7 @@ export class FactoryLoop {
      * durable row, which is authoritative when another owner terminalized it.
      */
     async #dispatchLifecycleStillOwned(record) {
-        const key = issueKey(record.issue);
+        const key = dispatchLifecycleKey(record.issue);
         if (this.#abandonedDispatchReasons.has(key))
             return false;
         if (!this.#usesDurableDispatchLifecycle())
@@ -7814,7 +8023,7 @@ export class FactoryLoop {
         if (tracingReconciledExit)
             this.#logger.info?.('[factory] reconciled agent exit telemetry completed', { issue: record.issue.key, name });
         if (this.#usesDurableDispatchLifecycle()) {
-            const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+            const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue));
             if (lifecycle?.phase === 'parking') {
                 this.#increment('clarificationParkingExitsSuppressed');
                 return;
@@ -8004,7 +8213,7 @@ export class FactoryLoop {
             // that exited immediately consume a batch slot forever while Factory
             // continuously recreated it. One successful recovery is enough; a
             // subsequent no-PR implementer exit is terminal and frees the slot.
-            const recoveryLifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+            const recoveryLifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue));
             const recoveryRunIdentity = recoveryLifecycle?.runId
                 ?? tracked.spec.branch
                 ?? batch.invocationIdFor(record.issue, tracked.spec);
@@ -8210,7 +8419,7 @@ export class FactoryLoop {
         if (!matchesCurrentConvention && !matchesAuthorizedLegacyBranch) {
             throw new Error(`Refusing to publish ${record.issue.key}: branch ${expectedHeadRef} belongs to a different issue`);
         }
-        const durable = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+        const durable = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue));
         const cached = this.#publishedPullRequests.get(key);
         if (cached) {
             if (cached.headRef !== expectedHeadRef) {
@@ -8868,7 +9077,7 @@ export class FactoryLoop {
         }
     }
     #scheduleAbandonedDispatchRetry(record, reason) {
-        const key = issueKey(record.issue);
+        const key = dispatchLifecycleKey(record.issue);
         if (this.#stopping || this.#dispatchLifecycleRetryTimers.has(key))
             return;
         const timer = setTimeout(() => {
@@ -8900,7 +9109,7 @@ export class FactoryLoop {
                     ? githubIssuePathParts(record.issue.path)?.owner
                     : undefined;
                 const repo = normalizeGithubRepo(implementer.spec.repo, this.#config.repos.org ?? sourceOwner);
-                const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+                const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue));
                 if (publishedPullRequests(lifecycle).some((receipt) => receipt.repo.toLowerCase() === repo.toLowerCase()))
                     return true;
                 return Boolean(await this.#openPullRequestByHead(repo, implementer.spec.branch));
@@ -10468,10 +10677,7 @@ export class FactoryLoop {
             return false;
         }
         const clarifiedIssue = issueWithGithubClarification(issue, text);
-        const decision = await this.#triage.triage(clarifiedIssue, {
-            config: this.#config,
-            repoMap: repoMapFromConfig(this.#config),
-        });
+        const decision = await this.#triageWithOrigin(clarifiedIssue);
         const escalationReason = triageEscalationReason(decision);
         if (escalationReason) {
             if (hasDispatchableRoute(decision)) {
@@ -10922,7 +11128,7 @@ export class FactoryLoop {
         for (const record of records) {
             if (!await this.#assertIssueDispatchLifecycleOwner(record.issue))
                 continue;
-            const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+            const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue));
             // Babysitter sessions are independently durable and restore only after
             // their mounted PR metadata passes the open/draft/issue-identity guard.
             // Fold those validated receipts back into the lifecycle on takeover.
@@ -11575,7 +11781,7 @@ export class FactoryLoop {
         });
     }
     async #suspendBabysitterWakeForHuman(state) {
-        const key = issueKey(state.issue);
+        const key = dispatchLifecycleKey(state.issue);
         const [lifecycle, clarification] = await Promise.all([
             this.#usesDurableDispatchLifecycle()
                 ? this.#state.getDispatchLifecycle(this.#workspaceId, key)
@@ -12082,6 +12288,49 @@ export class FactoryLoop {
     async #advanceMergedPrToDone(snapshot, repo, record) {
         const mergedPullRequest = { repo, number: snapshot.number, url: snapshot.url };
         if (record) {
+            // An in-flight record's association comes from Factory's own dispatch,
+            // not from the PR's prose, so closure here does NOT require a closing
+            // keyword — requiring one would strand every ordinary dispatch whose PR
+            // links its issue with a bare `Linear: AR-411`.
+            //
+            // What it does honour is an explicit disclaimer: a merged PR that says in
+            // its own body that it does not fix this issue is taken at its word. That
+            // is the exact shape of #313 (`Diagnostic for #155`).
+            //
+            // Ownership does NOT exempt a PR from this. Ownership settles which issue
+            // the PR belongs to; it says nothing about whether the merge completed
+            // that issue. Skipping the check for owned PRs would mean the same merged
+            // body is refused before ownership is established and accepted after.
+            if (prBodyDisclaimsClosing({ headRef: snapshot.headRef, body: snapshot.body, repo }, record.issue.key)) {
+                this.#increment('mergedPrClosureRefused');
+                this.#logger.warn?.('[factory] merged PR disclaims completing the issue it references', {
+                    issue: record.issue.key,
+                    prNumber: snapshot.number,
+                    repo,
+                });
+                return;
+            }
+            // The protected-label gate has to cover the tracked paths too, or an
+            // incident issue that Factory itself dispatched is still auto-closed by
+            // its own merge and `neverAutoCloseLabels` guarantees nothing.
+            const tracked = await this.#readIssue(record.issue.path);
+            const trackedBlockingLabel = tracked ? this.#neverAutoCloseLabel(tracked) : undefined;
+            if (tracked && trackedBlockingLabel) {
+                await this.#declineMergeClosure(tracked, snapshot, repo, `it carries the \`${trackedBlockingLabel}\` label, which Factory never auto-closes`, 'label');
+                return;
+            }
+            if (!tracked) {
+                // Proceed rather than block. The disclaimer check above already ran on
+                // the merged body; wedging every completion behind a transient mount
+                // read would strand dispatches far more often than it would protect an
+                // incident, and stranded dispatches are what generate incidents here.
+                this.#logger.warn?.('[factory] could not read issue to apply the never-auto-close label gate', {
+                    issue: record.issue.key,
+                    prNumber: snapshot.number,
+                    repo,
+                });
+                this.#increment('mergedPrLabelGateUnverified');
+            }
             await this.#completeIssue(record, {
                 targetState: 'done',
                 runMergeGate: false,
@@ -12100,11 +12349,24 @@ export class FactoryLoop {
             this.#increment('mergedPrAdvanceDuplicatesSuppressed');
             return;
         }
+        // A merged PR that merely *references* this issue has no authority to
+        // complete it, and an incident issue is never closed by a merge at all.
+        // Both refusals comment instead of closing, so the decision is auditable
+        // rather than silent. #313.
+        const authority = prClosureAuthority({ headRef: snapshot.headRef, body: snapshot.body, repo }, issue.key);
+        const blockingLabel = this.#neverAutoCloseLabel(issue);
+        if (!authority.authorised || blockingLabel) {
+            const reason = blockingLabel
+                ? `it carries the \`${blockingLabel}\` label, which Factory never auto-closes`
+                : authority.evidence;
+            await this.#declineMergeClosure(issue, snapshot, repo, reason, blockingLabel ? 'label' : 'authority');
+            return;
+        }
         this.#postMergeDoneAdvances.add(advanceKey);
         try {
             const githubIssue = isGithubIssue(issue);
             if (githubIssue) {
-                await this.#githubWriteback.closeIssue(issue, `Factory observed pull request #${snapshot.number} merge and completed this issue.`);
+                await this.#githubWriteback.closeIssue(issue, `Factory observed pull request #${snapshot.number} merge and completed this issue.\n\nClosing authority: ${authority.evidence}.`);
             }
             else {
                 const doneStateId = this.#states.idFor(issue.team, 'done');
@@ -12119,6 +12381,7 @@ export class FactoryLoop {
                 issue: issue.key,
                 prNumber: snapshot.number,
                 url: snapshot.url,
+                closureAuthority: authority.source,
             });
             if (this.#slack && this.#config.slack && !await this.#shouldSkipSlackWriteback('merge-done-thread')) {
                 try {
@@ -12145,6 +12408,61 @@ export class FactoryLoop {
             this.#error(error, issueRef(issue));
         }
     }
+    /** The configured label, if any, that bars this issue from ever auto-closing. */
+    #neverAutoCloseLabel(issue) {
+        const blocked = this.#config.safety.neverAutoCloseLabels;
+        if (!blocked || blocked.length === 0)
+            return undefined;
+        const carried = new Set((issue.labels ?? []).map((label) => label.trim().toLowerCase()));
+        return blocked.find((label) => carried.has(label));
+    }
+    /**
+     * Leave the issue open and say why. A refusal has to be *louder* than a
+     * closure, not quieter: the failure this replaces marked a live outage
+     * COMPLETED and dropped it out of every open-issue view.
+     */
+    async #declineMergeClosure(issue, snapshot, repo, reason, kind) {
+        this.#increment(kind === 'label' ? 'mergedPrClosureBlockedByLabel' : 'mergedPrClosureRefused');
+        this.#logger.warn?.('[factory] declined to close issue on merged PR', {
+            issue: issue.key,
+            prNumber: snapshot.number,
+            repo,
+            reason,
+            kind,
+        });
+        const marker = `factory-merge-close-declined:${repo}#${snapshot.number}`;
+        const body = [
+            `Factory observed pull request ${repo}#${snapshot.number} merge, and did **not** close this issue.`,
+            '',
+            `Reason: ${reason}.`,
+            '',
+            'A merged pull request closes an issue only when it carries a GitHub closing keyword'
+                + ' (`closes`/`fixes`/`resolves`) for it, or when its head is that issue\'s own'
+                + ' implementation branch. A bare reference is an association, not a completion.',
+            '',
+            'If this pull request really did complete the issue, close it by hand.',
+            '',
+            `<!-- ${marker} -->`,
+        ].join('\n');
+        try {
+            // A Linear-backed candidate reaches this path too, and a refusal that is
+            // invisible on the system of record is barely better than the silent
+            // closure it replaces.
+            if (!isGithubIssue(issue)) {
+                await this.#linear.postComment(issue, body);
+                return;
+            }
+            // Merge events can redeliver. Skip a repeat only on a positive
+            // confirmation that the note already landed; an unavailable check must
+            // not be read as "already commented".
+            if (await this.#githubWriteback.hasCommentMarker?.(issue, marker))
+                return;
+            await this.#githubWriteback.postComment(issue, body);
+        }
+        catch (error) {
+            this.#error(error, issueRef(issue));
+        }
+    }
     async #findMergeAdvanceIssueForPr(snapshot, eventRepo) {
         // An issue is "upstream" of a merge if it sits in the agent-implementing or
         // human-review role for its team. UUIDs are globally unique, so the reverse
@@ -12226,7 +12544,7 @@ export class FactoryLoop {
     // after opening its PR (an event, not a poll).
     async #ensureBabysitterForIssue(record) {
         if (this.#usesDurableDispatchLifecycle()) {
-            const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+            const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue));
             const receipts = lifecycle?.pullRequests ?? (lifecycle?.pullRequest ? [lifecycle.pullRequest] : []);
             if (receipts.length > 0) {
                 for (const receipt of receipts) {
@@ -12456,7 +12774,7 @@ export class FactoryLoop {
     }
     async #retireSupersededBabysitters(record, prRef) {
         const wanted = githubPrIdentity(prRef.repo, prRef.prNumber);
-        const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+        const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue));
         const trackedAgents = new Map([
             ...(lifecycle?.agents ?? [])
                 .filter((agent) => agent.releasedAtMs === undefined)
@@ -12499,7 +12817,7 @@ export class FactoryLoop {
             });
         }
         if (superseded.length > 0) {
-            const latest = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+            const latest = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue));
             if (latest && !await this.#saveDispatchLifecycle(record, latest.phase)) {
                 throw new Error(`Failed to persist superseded babysitter cleanup for ${record.issue.key}`);
             }
@@ -12508,7 +12826,7 @@ export class FactoryLoop {
     }
     async #retireBabysittersOutsideCurrentRoutes(record) {
         const wantedRepos = new Set(record.decision.implementers.map((implementer) => implementer.repo.toLowerCase()));
-        const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+        const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue));
         const trackedAgents = new Map([
             ...(lifecycle?.agents ?? [])
                 .filter((agent) => agent.releasedAtMs === undefined)
@@ -12550,7 +12868,7 @@ export class FactoryLoop {
             });
         }
         if (unrouted.length > 0) {
-            const latest = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue));
+            const latest = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue));
             if (latest && !await this.#saveDispatchLifecycle(record, latest.phase)) {
                 throw new Error(`Failed to persist unrouted babysitter cleanup for ${record.issue.key}`);
             }
@@ -12563,7 +12881,7 @@ export class FactoryLoop {
     // guards on the PR's OWN webhook-fed meta (still open, not a draft, not already
     // merged) before flipping the issue to Human Review. No `gh` call.
     async #maybeAdvanceToHumanReview(record, agentName) {
-        if (this.#completionInFlight.has(issueKey(record.issue))) {
+        if (this.#completionInFlight.has(dispatchLifecycleKey(record.issue))) {
             return;
         }
         const ownership = [...this.#babysitterPr.entries()].find(([key, ref]) => ref.agentName === agentName && issueKey(this.#babysitterIssueRefs.get(key) ?? record.issue) === issueKey(record.issue));
@@ -12696,7 +13014,7 @@ export class FactoryLoop {
         return false;
     }
     async #completeIssue(record, opts = {}) {
-        const completionKey = issueKey(record.issue);
+        const completionKey = dispatchLifecycleKey(record.issue);
         if (this.#completionInFlight.has(completionKey)) {
             return;
         }
@@ -12766,6 +13084,7 @@ export class FactoryLoop {
                     await this.#linear.setState(issue, targetState);
                     await this.#recordCanonicalIssueState({ ...record.issue, stateId: targetState });
                 }
+                record.issueWritebackConfirmedAtMs = this.#clock.now();
                 this.#emit('writeback-verified', { issue: record.issue, path: issue.path });
                 if (!humanReview)
                     await this.#markDependencyTerminalAndReconcile(issue);
@@ -12841,7 +13160,7 @@ export class FactoryLoop {
             // Cancellation must see the subscription identity so it can issue the
             // idempotent Relayfile DELETE before clearing the local owner maps.
             await this.#cancelBabysittersForIssue(record.issue);
-            const durable = await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(record.issue)).catch(() => undefined);
+            const durable = await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue)).catch(() => undefined);
             if (!this.#usesDurableDispatchLifecycle() || (durable && isTerminalDispatchLifecycle(durable))) {
                 for (const publishedKey of this.#publishedPullRequests.keys()) {
                     if (publishedKey.startsWith(`${completionKey}:`))
@@ -12938,7 +13257,7 @@ export class FactoryLoop {
     async #claimTicketDispatchNotification(record) {
         if (record.dryRun || !this.#usesDurableDispatchLifecycle())
             return true;
-        const key = issueKey(record.issue);
+        const key = dispatchLifecycleKey(record.issue);
         return this.#serializeDispatchLifecyclePersistence(key, async () => {
             const epoch = this.#dispatchLifecycleEpochs.get(key);
             if (epoch === undefined) {
@@ -13001,7 +13320,7 @@ export class FactoryLoop {
         void (async () => {
             try {
                 const lifecycle = issue
-                    ? await this.#state.getDispatchLifecycle(this.#workspaceId, issueKey(issue)).catch(() => undefined)
+                    ? await this.#state.getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(issue)).catch(() => undefined)
                     : undefined;
                 if (lifecycle) {
                     await this.#reportLifecycle(lifecycle, 'factory.failure', {
@@ -13269,7 +13588,7 @@ export class FactoryLoop {
     }
     async #slackPullRequestRefs(record, additional = []) {
         const lifecycle = await this.#state
-            .getDispatchLifecycle(this.#workspaceId, issueKey(record.issue))
+            .getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue))
             .catch(() => undefined);
         const lifecycleRefs = publishedPullRequests(lifecycle).map((receipt) => ({
             repo: receipt.repo,
@@ -13600,7 +13919,7 @@ export class FactoryLoop {
     async #ownsActiveSlackConversationIssue(issue) {
         if (!(await this.#batch()).getIssue(issue))
             return false;
-        const key = issueKey(issue);
+        const key = dispatchLifecycleKey(issue);
         const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
         if (!lifecycle)
             return true;
@@ -14960,7 +15279,7 @@ export class FactoryLoop {
             if (!waiting.dryRun && this.#usesDurableDispatchLifecycle()) {
                 try {
                     const claim = await this.#claimDispatchLifecycle(waiting.decision, false);
-                    const lifecycleKey = issueKey(waiting.issue);
+                    const lifecycleKey = dispatchLifecycleKey(waiting.issue);
                     const epoch = this.#dispatchLifecycleEpochs.get(lifecycleKey);
                     if (claim.lifecycle.phase === 'waiting-for-human' &&
                         (epoch === undefined || !await this.#state.promoteDispatchLifecycle(this.#workspaceId, lifecycleKey, this.#dispatchLifecycleOwner, epoch, this.#clock.now()))) {
@@ -15252,10 +15571,7 @@ export class FactoryLoop {
             return;
         }
         const clarifiedIssue = issueWithSlackClarification(issue, text);
-        const decision = await this.#triage.triage(clarifiedIssue, {
-            config: this.#config,
-            repoMap: repoMapFromConfig(this.#config),
-        });
+        const decision = await this.#triageWithOrigin(clarifiedIssue);
         const escalationReason = triageEscalationReason(decision);
         if (escalationReason) {
             if (hasDispatchableRoute(decision)) {
@@ -15819,7 +16135,54 @@ const issueRefFromPath = (path) => {
     const key = keyFromPath(path);
     return { uuid: uuidFromPath(path) ?? key, key, path };
 };
-const issueRef = (issue) => ({ uuid: issue.uuid, key: issue.key, path: issue.path });
+const issueRef = (issue) => {
+    const origin = mirrorWorkUnitOrigin(issue);
+    return { uuid: issue.uuid, key: issue.key, path: issue.path, ...(origin ? { origin } : {}) };
+};
+/**
+ * An `IssueRef` for a canonical-state record, carrying the mirror origin from
+ * whichever shape the caller had — a full `LinearIssue`, or an `IssueRef` that
+ * already resolved one.
+ */
+const issueRefForState = (issue) => {
+    const origin = issue.origin ??
+        (issue.raw === undefined ? undefined : mirrorWorkUnitOrigin({ path: issue.path, raw: issue.raw }));
+    return { uuid: issue.uuid, key: issue.key, path: issue.path, ...(origin ? { origin } : {}) };
+};
+/** Work-unit key, or undefined for a row with no derivable provider identity. */
+const safeDispatchLifecycleKey = (issue) => {
+    try {
+        return dispatchLifecycleKey(issue);
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * Re-attaches the provider origin a triage engine did not carry through.
+ * Only fills a gap — an engine that already resolved an origin keeps it.
+ */
+const decisionWithMirrorOrigin = (decision, issue) => {
+    if (decision.issue.origin)
+        return decision;
+    const origin = mirrorWorkUnitOrigin(issue);
+    return origin ? { ...decision, issue: { ...decision.issue, origin } } : decision;
+};
+/**
+ * The claim/dedup/lifecycle authority key: the work unit, not the surface it
+ * arrived through.
+ *
+ * `issueKey()` composes the Relayfile sense path, so the same issue reaching
+ * Factory GitHub-native and through its own Linear mirror hashed to two keys
+ * and the lease never saw a conflict — both dispatched (#211, AR-448). Every
+ * durable lifecycle read and write goes through this instead.
+ *
+ * `issueKey()` deliberately stays as-is for the surface-scoped correlation
+ * maps — waiting clarifications, babysitter sessions, Slack threads, preview
+ * ownership — which are keyed by surface on disk and would be orphaned by a
+ * global redefinition.
+ */
+const dispatchLifecycleKey = (issue) => dispatchIssueIdentity(issue);
 // Preserve the historical Linear state namespace while keeping GitHub-native
 // issue numbers independent across repositories in the same workspace.
 const issueStateKey = (issue) => githubIssuePathParts(issue.path) ? issueKey(issue) : issue.key;
@@ -16992,9 +17355,10 @@ const issuePrMatchScore = (pr, issue, marker, opts = {}) => {
     return 0;
 };
 const hasTitlePrefix = (title, marker) => title === marker || title.startsWith(`${marker} `);
-const factoryBranchMatchesIssue = (headRef, issueKey) => /^\d+$/u.test(issueKey)
-    ? factoryBranchBelongsToIssue(headRef, issueKey)
-    : containsIssueKey(headRef, issueKey);
+// Single definition shared with closure authority, so the branch rule that
+// grants a score-30 association and the one that authorises a close can never
+// drift apart.
+const factoryBranchMatchesIssue = branchImplementsIssue;
 // Legacy Factory runs created GitHub-native branches as `<issue-number>-*`
 // before the current `factory/<issue>-*` convention. Keep this matcher out of
 // generic PR discovery: it is only enabled by orphan recovery, where the issue