@agent-relay/factory 0.1.72 → 0.1.74

package/dist/orchestrator/factory.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { dirname, isAbsolute, resolve } from 'node:path';
@@ -36,6 +37,8 @@ import { createFactoryCloudEventV1, factoryCloudReleaseReasonV1, } from '../obse
 import { telemetryErrorClass } from '../observability/error-class.js';
 import { derivedReadinessReconcileState, publicHealthFromHeartbeat, readinessReconcileInFlightMs, } from './public-health.js';
 import { factorySweepSkipReasonCounts } from './sweep-skip-reason.js';
+import { factoryDispatchFailureReasonCodeForErrorClass, factoryDispatchFailureReasonCounts, } from './dispatch-failure-reason.js';
+import { isAgentAlreadyGoneOnRelease } from './release-error.js';
 import { boundedRunCostTotal, CostLedger } from '../cost/ledger.js';
 import { createTicketDispatchDelivery } from '../delivery/ticket-dispatch.js';
 import { canonicalTrajectorySessionRef, renderTrajectoryPointer, stripTrajectoryPointers, } from '../trajectory.js';
@@ -143,6 +146,12 @@ const CLARIFICATION_ESCALATION_LEASE_MS = 2 * 60_000;
 const CLARIFICATION_ESCALATION_RETRY_MS = 5_000;
 const CLARIFICATION_STALE_WARN_MS = 7 * 24 * 60 * 60_000;
 const STOP_TEARDOWN_TIMEOUT_MS = 2_500;
+// A rejected post-spawn dispatch normally gets a final opportunity to undo an
+// external claim before shutdown relinquishes its lifecycle lease. Provider
+// writes are not guaranteed to settle, so that opportunity must stay inside a
+// bounded shutdown budget; a successor can recover from the retained durable
+// lifecycle after this process releases its local agents.
+const STOP_REJECTED_DISPATCH_DRAIN_TIMEOUT_MS = 2_500;
 const DISPATCH_LIFECYCLE_LEASE_MS = 5 * 60_000;
 const DISPATCH_LIFECYCLE_RENEW_MS = 60_000;
 const DISPATCH_LIFECYCLE_RETRY_MS = 1_000;
@@ -347,6 +356,16 @@ class ReadinessReconcileTimeoutError extends Error {
         this.name = 'ReadinessReconcileTimeoutError';
     }
 }
+class PostSpawnDispatchWaitRejectedError extends Error {
+    issueKey;
+    compensationError;
+    constructor(issueKey, compensationError) {
+        super(`Post-spawn dispatch waits were rejected for ${issueKey}`);
+        this.issueKey = issueKey;
+        this.compensationError = compensationError;
+        this.name = 'PostSpawnDispatchWaitRejectedError';
+    }
+}
 const realClock = {
     now: () => Date.now(),
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -354,6 +373,26 @@ const realClock = {
 export function createFactory(config, ports) {
     return new FactoryLoop(FactoryConfigSchema.parse(config), ports);
 }
+/**
+ * The discovery pass a tree read was issued by, carried per async call (#363
+ * review, CodeRabbit).
+ *
+ * `#discoverySweepEpoch` says a sweep is in flight; it cannot say the read in
+ * hand belongs to it. In live mode an event drain reaches the very same
+ * enumeration helpers — `#handlePrChange` -> `#advanceMergedPrToDone` ->
+ * `#findMergeAdvanceIssueForPr` -> `#githubIssuePaths()` is the concrete path —
+ * so a drain's full-root walk would land in a concurrent sweep's ratio while
+ * measuring a different instant. That is enough to hide a mount that went
+ * silent mid-sweep.
+ *
+ * A drain does not inherit this store: its continuation begins at the
+ * subscription callback, outside the `run()` below. Threading an epoch argument
+ * through `#ingestGithubIssues` / `#handleGithubIssueChange` /
+ * `#findGithubIssueMirror` / `#loadLinearMirrorCandidates` would express the
+ * same fact and put a parameter on every hot path that must never be passed
+ * wrong.
+ */
+const discoveryEnumerationPass = new AsyncLocalStorage();
 export class FactoryLoop {
     #config;
     #mount;
@@ -553,18 +592,30 @@ export class FactoryLoop {
     #readinessReconcileLastError;
     #readinessReconcileLastErrorClass;
     /**
-     * The last *completed* sweep's arithmetic (#355).
+     * The last *enumerating* sweep's arithmetic (#355).
      *
-     * Held as one record rather than four fields so it can only ever be replaced
+     * Held as one record rather than three fields so it can only ever be replaced
      * whole: publishing a `dispatched` from one pass beside a `candidates` from
      * another would be worse than publishing neither, since the whole use of
      * these numbers is comparing them to each other.
      *
-     * `undefined` until a sweep completes, and never initialised to zeroes —
+     * `undefined` until a sweep enumerates, and never initialised to zeroes —
      * "this daemon has not finished a sweep" and "a sweep finished and found
      * nothing" are the two readings #355 has to tell apart.
      */
     #readinessReconcileLastSweep;
+    /**
+     * Whether the MOST RECENT pass deferred, tracked apart from the counts above
+     * (#358 review, CodeRabbit — Major, and right).
+     *
+     * A deferred pass enumerates nothing and settles in milliseconds, so folding
+     * it into the snapshot overwrote the last real sweep's numbers with zeroes.
+     * On a container where another process holds the lease for any length of time
+     * — the #347/#349 condition — every pass would publish `candidates: 0` and the
+     * last actual enumeration would be unrecoverable, destroying the measurement
+     * this whole change exists to provide.
+     */
+    #readinessReconcileLastSweepDeferred;
     #liveEventQueue = [];
     #liveEventDrainScheduled = false;
     #liveEventDrainActive = false;
@@ -577,6 +628,29 @@ export class FactoryLoop {
     #previewSweepTimer;
     #previewSweepInFlight;
     #completionInFlight = new Set();
+    #issueWritebackInFlight = new Map();
+    // A fast completion can make terminal issue state visible while dispatch is
+    // still performing its post-spawn readiness read. Completion publishes its
+    // provider receipt, then waits for that read to classify the state as owned
+    // or foreign before it releases agents under a terminal success reason.
+    #postSpawnIssueObservations = new Map();
+    // The post-spawn ready read and following dispatch claim form one local
+    // write boundary. A completion arriving first makes dispatch wait and
+    // re-read; one arriving after claim entry waits for the claim to finish.
+    #postSpawnDispatchClaimFences = new Map();
+    // Shutdown must not lose a local placement merely because a rejected
+    // provider claim unwinds before #releaseInFlightAgents snapshots the batch.
+    // The capture set makes both interleavings explicit: the dispatch catch may
+    // remove a record only after shutdown has copied its agents, otherwise the
+    // release sweep removes it after the copy is safe.
+    #shutdownReleaseCapturedDispatches = new Set();
+    #postSpawnDispatchesRejectedDuringStop = new Set();
+    // A rejected provider claim is unsafe to release until its conditional
+    // rollback succeeds or a newer provider status supersedes it. This runtime
+    // set closes the race before the durable dispatchClaim flag is persisted.
+    #uncompensatedDispatchClaims = new Set();
+    #pendingDispatchClaims = new Set();
+    #dispatchClaimSettlementsInFlight = new Set();
     #agentExitsInFlight = new Map();
     #reconciledAgentExitsActive = 0;
     #reconciledAgentExitWaiters = [];
@@ -665,6 +739,10 @@ export class FactoryLoop {
     #discoveryOverloadError;
     /** Relayfile operations this sweep has been shed on. */
     #discoverySweepOverloads = 0;
+    /** Tree reads this sweep issued that the backend served (#351 follow-up). */
+    #discoverySweepTreeReads = 0;
+    /** How many of those were served with zero entries. */
+    #discoverySweepEmptyTreeReads = 0;
     /**
      * The longest `Retry-After` any operation in this sweep advertised.
      *
@@ -971,6 +1049,15 @@ export class FactoryLoop {
         }
     }
     async #start(opts) {
+        // These sets coordinate one stop snapshot with dispatches unwinding during
+        // that same stop. They are not durable lifecycle state: retaining their
+        // keys across a later start would make the next stop mistake a fresh
+        // dispatch for one already captured by the previous shutdown.
+        this.#shutdownReleaseCapturedDispatches.clear();
+        this.#postSpawnDispatchesRejectedDuringStop.clear();
+        this.#uncompensatedDispatchClaims.clear();
+        this.#pendingDispatchClaims.clear();
+        this.#dispatchClaimSettlementsInFlight.clear();
         this.#stopping = false;
         this.#startMode = opts.mode ?? 'live';
         const issueSource = await this.#issueSource();
@@ -1085,15 +1172,32 @@ export class FactoryLoop {
     async stop() {
         this.#started = false;
         this.#stopping = true;
+        // These waits are armed before every planned spawn returns. Resolve them
+        // before the first shutdown await: a fast first agent may be completing
+        // while a later spawn is hung, and #drainAgentExitsInFlight would otherwise
+        // wait forever on a resolver stranded inside that dispatch stack.
+        const postSpawnWaitKeys = new Set([
+            ...this.#postSpawnIssueObservations.keys(),
+            ...this.#postSpawnDispatchClaimFences.keys(),
+        ]);
+        const rejectedClaimDispatches = new Set();
+        for (const [key, fence] of this.#postSpawnDispatchClaimFences) {
+            if (!fence.claimStarted)
+                continue;
+            const dispatchKeyPrefix = `${key}:live:`;
+            for (const [dispatchKey, dispatch] of this.#dispatchInFlight) {
+                if (dispatchKey.startsWith(dispatchKeyPrefix))
+                    rejectedClaimDispatches.add(dispatch);
+            }
+        }
+        for (const key of postSpawnWaitKeys)
+            this.#settlePostSpawnDispatchWaits(key, false, 'stop');
         if (this.#babysitterResourceDeliveryRetryTimer)
             clearTimeout(this.#babysitterResourceDeliveryRetryTimer);
         this.#babysitterResourceDeliveryRetryTimer = undefined;
         if (this.#babysitterResourceSubscriptionRenewTimer)
             clearTimeout(this.#babysitterResourceSubscriptionRenewTimer);
         this.#babysitterResourceSubscriptionRenewTimer = undefined;
-        if (this.#dispatchLifecycleRenewTimer)
-            clearInterval(this.#dispatchLifecycleRenewTimer);
-        this.#dispatchLifecycleRenewTimer = undefined;
         if (this.#heldAgentDeadlineTimer)
             clearTimeout(this.#heldAgentDeadlineTimer);
         this.#heldAgentDeadlineTimer = undefined;
@@ -1126,12 +1230,25 @@ export class FactoryLoop {
         await this.#previewSweepInFlight;
         this.#stoppingHeartbeatRefreshActive = await this.#stopLiveHeartbeat('stopping');
         try {
+            // Only dispatches that had entered the provider-claim boundary can leave
+            // an external claim behind. Drain those rejected promises before
+            // relinquishing their lifecycle leases or tearing down the fleet/mount.
+            // A pre-claim spawn hang is deliberately absent from this set, so it
+            // cannot hold shutdown open.
+            await this.#drainRejectedClaimDispatchesForStop(rejectedClaimDispatches);
+            await this.#persistOutstandingClaimCancellationBlocks();
+            // Keep renewing ownership through the potentially slow provider drain
+            // and cancellation-fence handoff. Stopping renewal earlier can let the
+            // lease expire before the fence is saved, allowing a successor to reap
+            // agents while the old provider write can still land.
             // Relinquish durable ownership before waiting on mount-backed lifecycle
             // drives. A slow Relayfile scan must not consume the shutdown deadline
             // while every issue remains fenced to a publisher that is already
-            // stopping. The owner/epoch fence makes any late completion from those
-            // drives harmless; a second sweep below catches claims racing this one.
-            await this.#releaseOwnedDispatchLifecycleLeases();
+            // stopping. Preserve leases for provider claims whose bounded drain
+            // expired: the original caller still needs its epoch to persist a late
+            // conclusive settlement. A second sweep below catches claims racing this
+            // one.
+            await this.#releaseOwnedDispatchLifecycleLeases((key) => this.#pendingDispatchClaims.has(key) || this.#dispatchClaimSettlementsInFlight.has(key));
             await Promise.allSettled([...this.#dispatchLifecycleDrives]);
             // Fence every source of new clarification work before touching the fleet.
             // A wake already past the fence is allowed to unwind, and is awaited
@@ -1154,13 +1271,18 @@ export class FactoryLoop {
             // non-durable (local/internal) records; terminal completion performs the
             // normal remote release before clearing the lifecycle.
             await this.#releaseInFlightAgents('factory-stopped', { preserveDurable: true });
-            await this.#releaseOwnedDispatchLifecycleLeases();
+            if (this.#dispatchLifecycleRenewTimer)
+                clearInterval(this.#dispatchLifecycleRenewTimer);
+            this.#dispatchLifecycleRenewTimer = undefined;
+            await this.#releaseOwnedDispatchLifecycleLeases((key) => this.#pendingDispatchClaims.has(key) || this.#dispatchClaimSettlementsInFlight.has(key));
             if (this.#livePollTimer)
                 clearTimeout(this.#livePollTimer);
             this.#livePollTimer = undefined;
             this.#livePollInFlight = false;
             this.#liveEventQueue.length = 0;
             this.#completionInFlight.clear();
+            this.#postSpawnIssueObservations.clear();
+            this.#postSpawnDispatchClaimFences.clear();
             this.#babysitterSpawned.clear();
             this.#babysitterPr.clear();
             this.#babysitterIssueRefs.clear();
@@ -1207,10 +1329,13 @@ export class FactoryLoop {
             await this.#fleet.dispose();
         }
         finally {
+            if (this.#dispatchLifecycleRenewTimer)
+                clearInterval(this.#dispatchLifecycleRenewTimer);
+            this.#dispatchLifecycleRenewTimer = undefined;
             this.#stoppingHeartbeatRefreshActive = false;
         }
     }
-    async #releaseOwnedDispatchLifecycleLeases() {
+    async #releaseOwnedDispatchLifecycleLeases(preserve = () => false) {
         // The epoch cache is an execution optimization, not the durable ownership
         // authority. Error/fence paths may evict a cached epoch while its persisted
         // lease is still ours, so enumerate state before shutdown relinquishment.
@@ -1221,6 +1346,8 @@ export class FactoryLoop {
             }
         }
         for (const [key, epoch] of owned) {
+            if (preserve(key))
+                continue;
             await this.#state.releaseDispatchLifecycleLease(this.#workspaceId, key, this.#dispatchLifecycleOwner, epoch);
             if (this.#dispatchLifecycleEpochs.get(key) === epoch) {
                 this.#dispatchLifecycleEpochs.delete(key);
@@ -1244,6 +1371,215 @@ export class FactoryLoop {
             await Promise.allSettled([...this.#clarificationQuestionDeliveryInFlight.values()]);
         }
     }
+    async #drainRejectedClaimDispatchesForStop(dispatches) {
+        if (dispatches.size === 0)
+            return;
+        let timer;
+        const drained = Promise.allSettled([...dispatches]).then(() => true);
+        // A durable fleet can recover ownership after this process exits. Local
+        // and other non-durable fleets cannot: releasing their placements before
+        // the provider claim has compensated would leave no successor able to
+        // finish the lifecycle, and a late write could strand the issue in its
+        // claimed state. Keep draining those fleets without the shutdown escape
+        // hatch.
+        if (this.#fleet.durableOwnership !== true) {
+            await drained;
+            return;
+        }
+        const timedOut = new Promise((resolve) => {
+            timer = setTimeout(() => resolve(false), STOP_REJECTED_DISPATCH_DRAIN_TIMEOUT_MS);
+            timer.unref?.();
+        });
+        const completed = await Promise.race([drained, timedOut]);
+        if (timer)
+            clearTimeout(timer);
+        if (completed)
+            return;
+        this.#increment('postSpawnDispatchClaimDrainTimeouts');
+        this.#logger.warn?.('[factory] rejected post-spawn dispatch compensation timed out; continuing shutdown', {
+            dispatches: dispatches.size,
+            timeoutMs: STOP_REJECTED_DISPATCH_DRAIN_TIMEOUT_MS,
+        });
+    }
+    async #persistOutstandingClaimCancellationBlocks() {
+        const batch = await this.#batch();
+        for (const record of batch.inFlight) {
+            const key = dispatchLifecycleKey(record.issue);
+            if (!this.#pendingDispatchClaims.has(key))
+                continue;
+            // The bounded durable drain expired before the provider operation could
+            // report whether rollback was safe. Persist the provisional release
+            // fence while this publisher still owns the lifecycle lease, so a
+            // successor cannot mistake the unresolved claim for abandonable work.
+            const persisted = await this.#retainUncompensatedDispatchClaim(record, new Error('Rejected dispatch claim compensation did not settle before shutdown'), { preferExistingError: true, pending: true });
+            if (!persisted) {
+                const durable = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
+                if (durable?.dispatchClaim?.cancellationPending !== true) {
+                    throw new Error(`Unable to persist unresolved dispatch-claim fence for ${record.issue.key}; refusing shutdown handoff`);
+                }
+            }
+        }
+    }
+    async #awaitRejectedClaimCompensation(settled) {
+        let timer;
+        const timedOut = new Promise((resolve) => {
+            timer = setTimeout(() => resolve(false), STOP_REJECTED_DISPATCH_DRAIN_TIMEOUT_MS);
+            timer.unref?.();
+        });
+        const compensated = await Promise.race([settled, timedOut]);
+        if (timer)
+            clearTimeout(timer);
+        return compensated;
+    }
+    /**
+     * Re-adopt this publisher's own lease epoch after a refused lifecycle write.
+     *
+     * `#saveDispatchLifecycle` cannot tell "the store rejected our fence" from
+     * "the store declined this row's contents", so it evicts the cached epoch for
+     * both. Only the first is a loss of ownership. Re-read the durable row and
+     * take the epoch back when the lease is still ours and still live; a row that
+     * is gone, terminal, expired, or owned by someone else keeps the eviction,
+     * because for those the eviction was correct.
+     */
+    async #recoverDispatchLifecycleLeaseEpoch(key) {
+        if (this.#dispatchLifecycleEpochs.has(key))
+            return true;
+        const lifecycle = await this.#state.getDispatchLifecycle(this.#workspaceId, key);
+        const lease = lifecycle?.lease;
+        if (!lifecycle || !lease || isTerminalDispatchLifecycle(lifecycle))
+            return false;
+        if (lease.owner !== this.#dispatchLifecycleOwner)
+            return false;
+        if (lease.leaseUntilMs <= this.#clock.now())
+            return false;
+        this.#dispatchLifecycleEpochs.set(key, lease.epoch);
+        this.#increment('dispatchLifecycleLeaseEpochsRecovered');
+        return true;
+    }
+    /**
+     * Persist a dispatch-claim fence without letting a refused write disarm the
+     * lease the next one needs.
+     *
+     * The shutdown handoff deliberately probes with a provisional
+     * `cancellationPending` fence, and a store may refuse that row on its
+     * contents while this process still holds the lease. Losing the epoch there
+     * would make every later write for this lifecycle short-circuit on
+     * `epoch === undefined` — including the conclusive compensated settlement
+     * that clears the block and frees the agents and the batch slot. That turns
+     * one refused probe into a lifecycle retained until restart, so bracket the
+     * write with epoch recovery instead.
+     */
+    async #persistDispatchClaimFence(record) {
+        const key = dispatchLifecycleKey(record.issue);
+        await this.#recoverDispatchLifecycleLeaseEpoch(key);
+        const saved = await this.#saveDispatchLifecycle(record, 'running');
+        if (!saved)
+            await this.#recoverDispatchLifecycleLeaseEpoch(key);
+        return saved;
+    }
+    async #retainUncompensatedDispatchClaim(record, error, opts = {}) {
+        const key = dispatchLifecycleKey(record.issue);
+        const alreadyBlocked = record.dispatchClaim?.cancellationBlocked === true;
+        const errorMessage = describeError(error).errorMessage;
+        this.#uncompensatedDispatchClaims.add(key);
+        const { cancellationPending: _pending, ...existingClaim } = record.dispatchClaim ?? { state: 'degraded' };
+        record.dispatchClaim = {
+            ...existingClaim,
+            state: 'degraded',
+            cancellationBlocked: true,
+            ...(opts.pending ? { cancellationPending: true } : {}),
+            write: 'rejected dispatch claim rollback',
+            error: opts.preferExistingError ? record.dispatchClaim?.error ?? errorMessage : errorMessage,
+            deadLettered: true,
+            updatedAtMs: this.#clock.now(),
+        };
+        this.#dispatchClaimStatuses.set(key, record.dispatchClaim);
+        if (!alreadyBlocked) {
+            this.#increment('postSpawnDispatchClaimRecoveryRetentions');
+            this.#logger.warn?.('[factory] retaining dispatch lifecycle because rejected claim compensation is unproven', {
+                issue: record.issue.key,
+            });
+        }
+        if (this.#usesDurableDispatchLifecycle()) {
+            return await this.#persistDispatchClaimFence(record);
+        }
+        else {
+            await this.#writeDispatchClaimRegistry(record.issue);
+            return true;
+        }
+    }
+    async #clearDispatchCancellationBlock(record) {
+        const key = dispatchLifecycleKey(record.issue);
+        if (record.dispatchClaim?.cancellationBlocked !== true) {
+            this.#uncompensatedDispatchClaims.delete(key);
+            return true;
+        }
+        const previousClaim = record.dispatchClaim;
+        const { cancellationBlocked: _blocked, cancellationPending: _pending, ...claim } = previousClaim;
+        record.dispatchClaim = claim;
+        this.#dispatchClaimStatuses.set(key, claim);
+        try {
+            const persisted = this.#usesDurableDispatchLifecycle()
+                ? await this.#persistDispatchClaimFence(record)
+                : await this.#writeDispatchClaimRegistry(record.issue).then(() => true);
+            if (!persisted) {
+                record.dispatchClaim = previousClaim;
+                this.#dispatchClaimStatuses.set(key, previousClaim);
+                return false;
+            }
+            this.#uncompensatedDispatchClaims.delete(key);
+            return true;
+        }
+        catch (error) {
+            record.dispatchClaim = previousClaim;
+            this.#dispatchClaimStatuses.set(key, previousClaim);
+            throw error;
+        }
+    }
+    async #dispatchClaimBlocksAbandonment(record) {
+        const key = dispatchLifecycleKey(record.issue);
+        if (!this.#uncompensatedDispatchClaims.has(key) && record.dispatchClaim?.cancellationBlocked !== true) {
+            return false;
+        }
+        // A provider request that was still unresolved at handoff can land after
+        // any current-state read. No observation is proof of supersession until
+        // the original caller records that the operation conclusively settled.
+        if (record.dispatchClaim?.cancellationPending === true)
+            return true;
+        try {
+            const issue = await this.#readIssue(record.issue.path);
+            if (!issue)
+                return true;
+            if (isGithubIssue(issue)) {
+                if (!this.#githubWriteback.getIssueStatus)
+                    return true;
+                const status = await this.#githubWriteback.getIssueStatus(issue, {
+                    requireFresh: true,
+                    freshAfterMs: record.dispatchClaim?.claimStartedAtMs,
+                });
+                if (!status || status === 'in-progress')
+                    return true;
+            }
+            else {
+                if (!this.#linear.getIssueStateId)
+                    return true;
+                const implementingStateId = this.#states.idFor(issue.team, 'agentImplementing');
+                const currentStateId = await this.#linear.getIssueStateId(issue);
+                if (!implementingStateId || !currentStateId || currentStateId === implementingStateId)
+                    return true;
+            }
+            if (!await this.#clearDispatchCancellationBlock(record))
+                return true;
+            return false;
+        }
+        catch (error) {
+            this.#logger.warn?.('[factory] unable to verify whether a blocked dispatch claim was superseded', {
+                issue: record.issue.key,
+                error: describeError(error).errorMessage,
+            });
+            return true;
+        }
+    }
     async #boundedStopTeardown(label, teardown) {
         let timer;
         const action = Promise.resolve()
@@ -1331,9 +1667,11 @@ export class FactoryLoop {
                 // cold container it is the first — and for the next interval, only —
                 // sweep whose counts exist. Leaving it unrecorded would make a daemon
                 // that has completed a full pass still read as "never ran" (#355).
-                this.#recordReadinessSweepOutcome(await this.runOnce());
+                const report = await this.runOnce();
                 this.#readinessReconcileLastDurationMs = this.#elapsedSince(backfillStartedAtMs);
-                this.#readinessReconcileLastCompletedAtMs = this.#clock.now();
+                const completedAtMs = this.#clock.now();
+                this.#readinessReconcileLastCompletedAtMs = completedAtMs;
+                this.#recordReadinessSweepOutcome(report, completedAtMs);
             }
             catch (error) {
                 this.#readinessReconcileLastDurationMs = this.#elapsedSince(backfillStartedAtMs);
@@ -1559,20 +1897,28 @@ export class FactoryLoop {
             const report = await this.#runOnceWithReadinessDeadline();
             this.#readinessReconcileConsecutiveFailures = 0;
             this.#readinessReconcileLastDurationMs = this.#elapsedSince(startedAtMs);
-            this.#readinessReconcileLastCompletedAtMs = this.#clock.now();
+            const completedAtMs = this.#clock.now();
+            this.#readinessReconcileLastCompletedAtMs = completedAtMs;
             this.#readinessReconcileLastError = undefined;
             this.#readinessReconcileLastErrorClass = undefined;
             // The three integers below have gone to stdout since this loop existed,
             // and stdout does not reach the deployed container's operator (#355).
             // Publishing them is what lets a reader tell a sweep that saw eligible
             // work and rejected it from one that never pulled it at all.
-            this.#recordReadinessSweepOutcome(report);
+            this.#recordReadinessSweepOutcome(report, completedAtMs);
             this.#logger.info?.('[factory] periodic readiness reconciliation completed', {
                 durationMs: this.#readinessReconcileLastDurationMs,
                 candidates: report.pulled.length,
                 dispatched: report.dispatched.length,
                 skipped: report.skipped.length,
-                skipReasons: this.#readinessReconcileLastSweep?.skipReasons,
+                // THIS pass's breakdown, never the retained snapshot (#359 review,
+                // codex P2). Logging the retained one beside a deferred pass's zeroes
+                // produced a line that contradicted its own arithmetic —
+                // `skipped: 0` next to a non-empty breakdown — and this log is what a
+                // local operator reads.
+                skipReasons: factorySweepSkipReasonCounts(report.skipped),
+                dispatchFailures: report.skipped.filter((entry) => entry.code === 'dispatch-failed').length,
+                dispatchFailureReasons: factoryDispatchFailureReasonCounts(report.skipped),
                 discoveryDeferred: report.discoveryDeferred,
             });
         }
@@ -1596,6 +1942,10 @@ export class FactoryLoop {
             this.#readinessReconcileLastDurationMs = this.#elapsedSince(startedAtMs);
             this.#readinessReconcileLastFailureAtMs = this.#clock.now();
             this.#readinessReconcileLastError = errorMessage;
+            // This failure is now the latest settled pass. A deferral marker left by
+            // an older pass would falsely describe this one as lease contention when
+            // the timestamps/error below prove that it acquired the lease and failed.
+            this.#readinessReconcileLastSweepDeferred = undefined;
             // The class, unlike the message, is publishable: #295 puts it on the
             // unauthenticated health surface through the same allowlist.
             this.#readinessReconcileLastErrorClass = telemetryErrorClass(error);
@@ -2341,6 +2691,8 @@ export class FactoryLoop {
         this.#discoverySweepLeaseLost = false;
         this.#discoveryOverloadError = undefined;
         this.#discoverySweepOverloads = 0;
+        this.#discoverySweepTreeReads = 0;
+        this.#discoverySweepEmptyTreeReads = 0;
         this.#discoverySweepRetryAfterSeconds = undefined;
         this.#discoverySweepProgress = false;
         this.#startDiscoverySweepRenewal(claim.lease.epoch);
@@ -2421,6 +2773,8 @@ export class FactoryLoop {
             this.#discoverySweepStartedAtMs = undefined;
             this.#discoveryOverloadError = undefined;
             this.#discoverySweepOverloads = 0;
+            this.#discoverySweepTreeReads = 0;
+            this.#discoverySweepEmptyTreeReads = 0;
             this.#discoverySweepRetryAfterSeconds = undefined;
             this.#discoverySweepProgress = false;
             // This sweep is over either way (committed, deferred, or lease lost) —
@@ -2539,13 +2893,19 @@ export class FactoryLoop {
             this.#dependencyGithubPathsByIdentity = undefined;
             this.#dependencyLinearTreeLoaded = false;
             const issueSource = await this.#issueSource();
+            // The sweep's own discovery pass, and the only region whose full-root
+            // walks may enter the tree-read ratio (#363 review). Everything reached
+            // from here inherits the marker; a concurrently running drain does not.
+            const enumerate = (fn) => this.#discoverySweepEpoch === undefined
+                ? fn()
+                : discoveryEnumerationPass.run({ epoch: this.#discoverySweepEpoch }, fn);
             if (issueSource === 'linear') {
-                await this.#ingestGithubIssues({ dryRun });
+                await enumerate(() => this.#ingestGithubIssues({ dryRun }));
             }
             else {
                 await this.#ensureGithubIngestionReady();
             }
-            const paths = await this.#readyIssuePaths();
+            const paths = await enumerate(() => this.#readyIssuePaths());
             const orphanRecovery = issueSource === 'github'
                 ? await this.#githubOrphanRecoveryContext(dryRun)
                 : undefined;
@@ -2703,6 +3063,10 @@ export class FactoryLoop {
                     continue;
                 }
                 const recoveredIdentity = recoveredOrphan ? githubIssueRefIdentity(issueRef(issue)) : undefined;
+                // Reset per work unit, and advanced by assignment immediately before
+                // each stage rather than inferred in the catch: the whole value of the
+                // `unclassified-*` codes is that they name the stage honestly (#355).
+                let attemptPhase = 'gate';
                 try {
                     if (recoveredOrphan) {
                         const dispatchBlock = await this.#dispatchBlockReason(issue);
@@ -2723,8 +3087,10 @@ export class FactoryLoop {
                         });
                         continue;
                     }
+                    attemptPhase = 'triage';
                     const decision = await this.triageIssue(issue);
                     triaged.push(decision);
+                    attemptPhase = 'dispatch';
                     const result = await this.dispatch(decision, { dryRun });
                     // A completed dispatch — even one that parks or escalates the issue —
                     // proves the pipeline still works, so the fuse below starts over.
@@ -2825,6 +3191,11 @@ export class FactoryLoop {
                         issue: issueRef(issue),
                         reason: perItemDispatchSkipReason(error),
                         code: 'dispatch-failed',
+                        // The publishable half of the same classification. `reason` is the
+                        // operator's sentence and stays off the health surface; this token
+                        // is what tells a reader watching `dispatch-failed: 5` which of
+                        // five very different bugs they are looking at (#355).
+                        failureCode: perItemDispatchFailureCode(error, attemptPhase),
                     });
                     continue;
                 }
@@ -2839,6 +3210,10 @@ export class FactoryLoop {
                 dispatched,
                 skipped,
                 dryRun,
+                // Read before `#runOnceWithDiscoveryFence`'s finally resets them: this
+                // is still inside that try, so the counts are this sweep's own.
+                treeReads: this.#discoverySweepTreeReads,
+                emptyTreeReads: this.#discoverySweepEmptyTreeReads,
                 slackDegraded: this.#slackDegraded,
                 ...(orphanRecoveryDegraded ? { orphanRecoveryDegraded } : {}),
             };
@@ -3744,6 +4119,10 @@ export class FactoryLoop {
     // that expects a specific PR to appear, or an escalation/comment-replay
     // scan that must not miss a marker or reply that landed after the cache
     // was populated. Those callers must omit `cache` and pay for a fresh list.
+    //
+    // `enumeration` marks the call sites that ARE the readiness sweep's
+    // discovery pass — a full-root walk looking for candidate work. Only those
+    // feed the tree-read pair below, and only while a sweep holds the lease.
     async #listRelayfileTree(prefix, phase, opts = {}) {
         if (this.#discoverySweepLeaseLost) {
             throw new Error('discovery sweep lease was lost; refusing another tree request');
@@ -3762,6 +4141,46 @@ export class FactoryLoop {
             logStart: true,
             logComplete: true,
         });
+        // #351 follow-up: tree reads the backend SERVED, and how many of them it
+        // answered with nothing.
+        //
+        // The per-call deadline made a hung dependency loud. This is its
+        // companion: a mount that starts returning empty trees instead of hanging
+        // raises no timeout, no failure and no `lastError`, and produces a sweep
+        // that completes `healthy` having dispatched nothing.
+        //
+        // BOTH numbers, because one is not a signal. A healthy sweep lists two
+        // path forms per repo and only one of them exists, so an empty read is
+        // ordinary and a bare count of them fires constantly. What separates the
+        // fault is the RATIO: `emptyTreeReads === treeReads` means the mount
+        // served nothing at all, which `candidates: 0` cannot distinguish from a
+        // workspace that simply has no ready work.
+        //
+        // SCOPED TWICE, and both guards are load-bearing (#363 review, codex P2).
+        // The ratio is only readable if every read in it came from the same
+        // question. In live mode a Slack identity lookup, a PR-confirmation poll
+        // or a comment-replay scan can run concurrently with `runOnce()` — each is
+        // a `listTree`, none is discovery, and one populated result among them
+        // makes `emptyTreeReads < treeReads` on an all-empty sweep, silently
+        // erasing exactly the signal this pair exists to raise. `enumeration`
+        // keeps the numerator and denominator to the discovery pass; the epoch
+        // check keeps a discovery walk issued outside any sweep — startup
+        // backfill, most obviously — out of a sweep's totals.
+        // `enumeration` says this is a full-root discovery walk rather than a point
+        // lookup; the context says THIS sweep's discovery pass is what issued it.
+        // Both, because either alone admits a read the ratio cannot use. Compared
+        // by value rather than presence: an absent store and an absent epoch are
+        // both `undefined` and must not read as a match.
+        const issuingPass = discoveryEnumerationPass.getStore();
+        if (opts.enumeration &&
+            issuingPass !== undefined &&
+            issuingPass.epoch === this.#discoverySweepEpoch) {
+            this.#discoverySweepTreeReads += 1;
+            if (paths.length === 0) {
+                this.#increment('relayfileEmptyTreeReads');
+                this.#discoverySweepEmptyTreeReads += 1;
+            }
+        }
         if (opts.cache)
             await this.#rememberDiscoveryTree(prefix, paths);
         return paths;
@@ -4277,6 +4696,66 @@ export class FactoryLoop {
         if (!dryRun)
             await this.#ensureGithubAgentQuestionWatch(record, liveIssue);
         const spawnedForReaperHandoff = [];
+        // These waits belong to the durable work unit, not the ingestion surface.
+        // Completion and lifecycle ownership use the same identity (#211); using
+        // issueKey here would make every GitHub-native dispatch miss its own fence.
+        const postSpawnKey = dispatchLifecycleKey(record.issue);
+        let resolvePostSpawnIssueObservation;
+        let postSpawnIssueObservationDidSettle = false;
+        const postSpawnIssueObservationSettled = new Promise((resolve) => {
+            resolvePostSpawnIssueObservation = resolve;
+        });
+        let postSpawnIssueObservation;
+        postSpawnIssueObservation = {
+            settled: postSpawnIssueObservationSettled,
+            settle: (accepted) => {
+                if (postSpawnIssueObservationDidSettle)
+                    return;
+                postSpawnIssueObservationDidSettle = true;
+                resolvePostSpawnIssueObservation(accepted);
+                if (this.#postSpawnIssueObservations.get(postSpawnKey) === postSpawnIssueObservation) {
+                    this.#postSpawnIssueObservations.delete(postSpawnKey);
+                }
+            },
+        };
+        this.#postSpawnIssueObservations.set(postSpawnKey, postSpawnIssueObservation);
+        let resolvePostSpawnDispatchClaim;
+        let postSpawnDispatchClaimSettled = false;
+        const postSpawnDispatchClaim = new Promise((resolve) => {
+            resolvePostSpawnDispatchClaim = resolve;
+        });
+        let resolveRejectedClaimCompensation;
+        let rejectedClaimCompensationSettled = false;
+        const rejectedClaimCompensation = new Promise((resolve) => {
+            resolveRejectedClaimCompensation = resolve;
+        });
+        let postSpawnDispatchClaimFence;
+        postSpawnDispatchClaimFence = {
+            completionAtWriteBoundary: false,
+            claimStarted: false,
+            settled: postSpawnDispatchClaim,
+            rejectionSettled: rejectedClaimCompensation,
+            settle: (accepted) => {
+                if (postSpawnDispatchClaimSettled)
+                    return;
+                postSpawnDispatchClaimSettled = true;
+                postSpawnDispatchClaimFence.accepted = accepted;
+                resolvePostSpawnDispatchClaim(accepted);
+                if (this.#postSpawnDispatchClaimFences.get(postSpawnKey) === postSpawnDispatchClaimFence) {
+                    this.#postSpawnDispatchClaimFences.delete(postSpawnKey);
+                }
+            },
+            settleRejection: (compensated) => {
+                if (rejectedClaimCompensationSettled)
+                    return;
+                rejectedClaimCompensationSettled = true;
+                resolveRejectedClaimCompensation(compensated);
+            },
+        };
+        this.#postSpawnDispatchClaimFences.set(postSpawnKey, postSpawnDispatchClaimFence);
+        const settlePostSpawnIssueObservation = postSpawnIssueObservation.settle;
+        const settlePostSpawnDispatchClaim = postSpawnDispatchClaimFence.settle;
+        let rejectDispatchClaim;
         try {
             if (!dryRun) {
                 const issue = await this.#readIssue(dispatchDecision.issue.path);
@@ -4301,47 +4780,92 @@ export class FactoryLoop {
                 agents.push({ name: spawned.name, role: spec.role });
             }
             if (!dryRun) {
+                const claimStartedAtMs = this.#clock.now();
                 record.dispatchClaim = {
                     state: 'pending',
-                    updatedAtMs: this.#clock.now(),
+                    claimStartedAtMs,
+                    updatedAtMs: claimStartedAtMs,
                 };
                 this.#dispatchClaimStatuses.set(dispatchLifecycleKey(record.issue), record.dispatchClaim);
             }
             await this.#writeInFlightRegistry();
             const comment = dispatchComment(dispatchDecision, agents);
             let implementingStateId;
+            const rejectDispatchClaimIfCancelled = async () => {
+                if (postSpawnDispatchClaimFence.accepted !== false)
+                    return;
+                if (rejectDispatchClaim)
+                    await rejectDispatchClaim();
+                throw new PostSpawnDispatchWaitRejectedError(dispatchDecision.issue.key);
+            };
             if (!dryRun) {
-                const issue = await this.#readIssue(dispatchDecision.issue.path);
-                if (!issue || !this.#isIssueReady(issue)) {
-                    // The agents spawned a few lines above can reach terminal before we
-                    // get here. Their completion writeback parks the issue — Linear
-                    // `humanReview`, or the GitHub human-review label — and stamps
-                    // *this same record's* lifecycle on the way past. Re-reading the
-                    // issue then shows "not ready", but the writer was us.
-                    //
-                    // Treating that as a foreign change is not a cosmetic misreport: the
-                    // catch below classifies LiveDispatchStateChangedError as terminal
-                    // and calls #releaseAndTerminateAgents, so a dispatch whose agents
-                    // finished quickly tore down its own completed work and reported
-                    // RETRYABLE to its supervisor (factory#319).
+                let issue = await this.#readIssue(dispatchDecision.issue.path);
+                if (postSpawnDispatchClaimFence.completionAtWriteBoundary) {
+                    // Completion reached its terminal provider-write boundary before
+                    // dispatch entered the claim boundary. Always re-read after its
+                    // receipt, even when the first snapshot was ready: the terminal
+                    // write may have started immediately after that snapshot.
+                    const issueWriteback = this.#issueWritebackInFlight.get(postSpawnKey);
+                    if (issueWriteback)
+                        await issueWriteback;
+                    issue = await this.#readIssue(dispatchDecision.issue.path);
+                }
+                else if ((!issue || !this.#isIssueReady(issue)) && record.issueWritebackConfirmedAtMs === undefined) {
+                    // A very fast agent can finish while its own dispatch is still
+                    // performing this post-spawn read. Do not guess authorship from the
+                    // first visible state: an idempotent provider mutation cannot tell us
+                    // whether Factory or another actor won the race. Instead, wait for
+                    // this record's concurrent completion writeback to settle, then use
+                    // only its provider-confirmed outcome (factory#319).
                     //
-                    // Only THIS dispatch's own confirmed issue writeback may excuse the
-                    // change. Lifecycle phases are not enough: `publishing` is entered
-                    // before the PR is published and `parking` before anything touches
-                    // the issue, so a phase records local progress, not authorship — and
-                    // a foreign park landing during those awaits would be misread as
-                    // ours (codex review on #321). Losing the row to another owner is a
-                    // different condition and is still caught where it always was, by
-                    // #saveDispatchLifecycle returning false.
+                    // The completion promise settles as soon as terminal issue writeback
+                    // succeeds or fails, before Slack/release cleanup. If there is no
+                    // completion in flight, this is an ordinary foreign state change and
+                    // the existing abort remains immediate.
+                    const issueWriteback = this.#issueWritebackInFlight.get(postSpawnKey);
+                    if (issueWriteback) {
+                        await issueWriteback;
+                        issue = await this.#readIssue(dispatchDecision.issue.path);
+                    }
+                }
+                if (!issue || !this.#isIssueReady(issue)) {
+                    // Only a terminal writeback applied and confirmed by the completion
+                    // already in flight for this exact record may excuse the change. The
+                    // marker is stamped after provider acknowledgement/readback, never at
+                    // the earlier locally-visible write boundary. A confirmed no-op does
+                    // not establish authorship: another actor may have parked the issue
+                    // before our adapter's first provider read.
                     if (record.issueWritebackConfirmedAtMs === undefined) {
                         throw new LiveDispatchStateChangedError(dispatchDecision.issue.key);
                     }
                     // The claim is moot and would be wrong to write: it would drag an
                     // issue our own lifecycle has already parked back to `implementing`.
                 }
+                else if (this.#stopping) {
+                    // Shutdown snapshots the post-spawn fence maps once and settles only
+                    // what it finds there. A dispatch that armed its fence after that
+                    // snapshot — it can still be inside the preview render, the
+                    // `dispatching` save or the question-watch setup when `stop()`
+                    // begins — would otherwise enter the claim boundary below against a
+                    // fleet already being disposed and leases already relinquished,
+                    // leaving a claimed issue with no lifecycle to recover it. Reject
+                    // here instead. No claim has started, so there is nothing to
+                    // compensate, and this stays synchronous so the completion-race
+                    // invariant documented below is untouched (#346 review, cubic).
+                    this.#increment('postSpawnDispatchClaimsRefusedDuringStop');
+                    postSpawnDispatchClaimFence.settle(false);
+                    throw new PostSpawnDispatchWaitRejectedError(dispatchDecision.issue.key);
+                }
                 else {
-                    implementingStateId = await this.#applyDispatchClaim(record, issue, comment);
-                    record.issueWritebackConfirmedAtMs = this.#clock.now();
+                    // This assignment is synchronous with the preceding completion flag
+                    // check. Completion either arrived first (the branch above) or will
+                    // now observe claimStarted and wait; no await-sized gap remains.
+                    postSpawnDispatchClaimFence.claimStarted = true;
+                    const appliedClaim = await this.#applyDispatchClaim(record, issue, comment, postSpawnDispatchClaimFence);
+                    implementingStateId = appliedClaim.implementingStateId;
+                    rejectDispatchClaim = appliedClaim.reject;
+                    await rejectDispatchClaimIfCancelled();
+                    record.issueWritebackConfirmedAtMs ??= this.#clock.now();
                     this.#emit('writeback-verified', { issue: dispatchDecision.issue, path: issue.path });
                 }
             }
@@ -4356,19 +4880,110 @@ export class FactoryLoop {
                 dryRun,
             };
             record.result = result;
-            if (!await this.#saveDispatchLifecycle(record, 'running'))
+            const runningSaved = await this.#saveDispatchLifecycle(record, 'running');
+            await rejectDispatchClaimIfCancelled();
+            if (!runningSaved) {
+                settlePostSpawnDispatchClaim(true);
+                settlePostSpawnIssueObservation(true);
                 return result;
-            this.#increment('dispatched');
-            this.#emit('dispatched', { issue: dispatchDecision.issue, result });
+            }
             if (!dryRun && this.#config.hooks?.onTicketDispatch) {
                 await this.#notifyTicketDispatch(dispatchDecision, liveIssue, record, result);
+                await rejectDispatchClaimIfCancelled();
             }
             if (!dryRun) {
                 await this.#ensureSlackDispatchThread(record, result, liveIssue);
+                await rejectDispatchClaimIfCancelled();
             }
+            // Accept without an intervening await only after every durable
+            // publication and post-dispatch side effect has completed. Stop or held
+            // abandonment can therefore reject any still-publishing dispatch.
+            settlePostSpawnDispatchClaim(true);
+            settlePostSpawnIssueObservation(true);
+            this.#increment('dispatched');
+            this.#emit('dispatched', { issue: dispatchDecision.issue, result });
             return result;
         }
-        catch (error) {
+        catch (caughtError) {
+            // Stop/deadline may reject the fence while any awaited provider or
+            // lifecycle operation is still in flight. If that operation then fails,
+            // its raw error must not fall into ordinary dispatch cleanup: shutdown
+            // still owns the already-spawned placements and needs them retained
+            // until its release snapshot. If the claim receipt is already available,
+            // conditionally reject it before releasing those placements. Without a
+            // receipt the provider outcome is ambiguous, so preserve the original
+            // failure as the compensation detail after the claim boundary began.
+            let error = caughtError;
+            if (postSpawnDispatchClaimFence.accepted === false
+                && !(caughtError instanceof PostSpawnDispatchWaitRejectedError)) {
+                if (rejectDispatchClaim) {
+                    try {
+                        await this.#rejectDispatchClaimAfterOperationError(dispatchDecision.issue.key, caughtError, rejectDispatchClaim);
+                    }
+                    catch (rejectionError) {
+                        error = rejectionError;
+                    }
+                }
+                else {
+                    error = new PostSpawnDispatchWaitRejectedError(dispatchDecision.issue.key, postSpawnDispatchClaimFence.claimStarted ? caughtError : undefined);
+                }
+            }
+            settlePostSpawnDispatchClaim(false);
+            if (error instanceof PostSpawnDispatchWaitRejectedError) {
+                settlePostSpawnIssueObservation(false);
+                const compensated = error.compensationError === undefined;
+                // The original provider call has conclusively returned. Stop the
+                // timeout handoff from writing a provisional pending fence, but keep a
+                // separate lease fence until the definitive result is durable. Without
+                // that second set, shutdown can relinquish this epoch in the await
+                // below and make the late save fail after the provider compensated.
+                this.#dispatchClaimSettlementsInFlight.add(postSpawnKey);
+                this.#pendingDispatchClaims.delete(postSpawnKey);
+                let settlementPersisted = false;
+                try {
+                    settlementPersisted = compensated
+                        ? await this.#clearDispatchCancellationBlock(record)
+                        : await this.#retainUncompensatedDispatchClaim(record, error.compensationError);
+                    if (!settlementPersisted) {
+                        throw new Error(`Unable to persist settled dispatch-claim compensation for ${decision.issue.key}`);
+                    }
+                    postSpawnDispatchClaimFence.settleRejection(compensated);
+                    if (error.compensationError !== undefined) {
+                        this.#increment('postSpawnDispatchClaimCompensationFailures');
+                        this.#logger.error?.('[factory] rejected dispatch claim could not be safely compensated', {
+                            issue: decision.issue.key,
+                            error: describeError(error.compensationError).errorMessage,
+                        });
+                    }
+                    // External stop/abandonment owns agent and durable-lifecycle cleanup.
+                    // Remove only the process-local slot here; running the ordinary
+                    // dispatch-failure path would race or duplicate that cleanup. During
+                    // stop, however, retain local placements until the shutdown release
+                    // sweep has captured them. If it already has, removal is safe now.
+                    if (!compensated) {
+                        // The provider still exposes a claim this lifecycle authored. Keep
+                        // the process-local slot and durable row recoverable; releasing its
+                        // agents would leave the claimed issue with no successor lifecycle.
+                    }
+                    else if (this.#stopping) {
+                        this.#postSpawnDispatchesRejectedDuringStop.add(postSpawnKey);
+                        if (this.#shutdownReleaseCapturedDispatches.has(postSpawnKey)) {
+                            batch.abandon(decision.issue);
+                            this.#postSpawnDispatchesRejectedDuringStop.delete(postSpawnKey);
+                        }
+                    }
+                    else {
+                        batch.abandon(decision.issue);
+                    }
+                }
+                finally {
+                    if (!settlementPersisted)
+                        this.#pendingDispatchClaims.add(postSpawnKey);
+                    this.#dispatchClaimSettlementsInFlight.delete(postSpawnKey);
+                }
+                throw error;
+            }
+            settlePostSpawnIssueObservation(!(error instanceof LiveDispatchStateChangedError));
             // A spawn can fail after the broker accepted it but before its ack
             // reached Factory. Include every planned worktree agent, not only the
             // acknowledged spawns, so cleanup never races a name-only survivor.
@@ -4488,6 +5103,9 @@ export class FactoryLoop {
             })) ?? [],
             counters: { ...this.#counters },
             fleetControlPlane: this.#fleetControlPlane.status(),
+            // Optional on the port: a backend with no socket omits it, and an absent
+            // value stays absent rather than being invented as healthy.
+            ...(this.#fleet.fleetConnectStatus ? { fleetConnect: this.#fleet.fleetConnectStatus() } : {}),
             slackDegraded: this.#slackDegraded,
             slackDegradedReason: this.#slackDegradedReason,
             eventListener: this.#eventListenerStatus(),
@@ -4519,16 +5137,39 @@ export class FactoryLoop {
      *
      * Only successful passes reach here: a pass that threw has no report, and
      * inventing zeroes for it would publish "found nothing" for a sweep that
-     * never got to look. The previous pass's numbers stay put instead, dated by
-     * `lastCompletedAtMs`, which is the honest reading.
+     * never got to look. The previous enumerating pass's numbers stay put
+     * instead, dated by `lastEnumeratedAtMs`, which is the honest reading.
+     *
+     * A deferred pass gets the same treatment for the same reason. It settles
+     * successfully, and `lastCompletedAtMs` moves — deliberately, because the
+     * #295/#296 stall derivation reads that timestamp against `lastStartedAtMs`,
+     * and freezing it would report a functioning daemon as a hung one after ten
+     * intervals of deferring correctly to another owner. But it enumerated
+     * nothing, so its zeroes are not a measurement of anything and must not
+     * replace one. Only the marker is recorded.
      */
-    #recordReadinessSweepOutcome(report) {
+    #recordReadinessSweepOutcome(report, completedAtMs) {
+        if (report.discoveryDeferred) {
+            this.#readinessReconcileLastSweepDeferred = report.discoveryDeferred;
+            return;
+        }
+        this.#readinessReconcileLastSweepDeferred = undefined;
         this.#readinessReconcileLastSweep = {
             candidates: report.pulled.length,
+            treeReads: report.treeReads ?? 0,
+            emptyTreeReads: report.emptyTreeReads ?? 0,
             dispatched: report.dispatched.length,
             skipped: report.skipped.length,
             skipReasons: factorySweepSkipReasonCounts(report.skipped),
-            ...(report.discoveryDeferred ? { discoveryDeferred: report.discoveryDeferred } : {}),
+            // Counted from the same entries `skipReasons` counts, so the parts sum to
+            // `skipReasons['dispatch-failed']` by construction rather than by a
+            // second traversal agreeing with the first.
+            dispatchFailures: report.skipped.filter((entry) => entry.code === 'dispatch-failed').length,
+            dispatchFailureReasons: factoryDispatchFailureReasonCounts(report.skipped),
+            // The caller's completion stamp, not a fresh clock read: on a pass that
+            // enumerated, `lastEnumeratedAtMs` and `lastCompletedAtMs` describe the
+            // same instant and must not drift apart by a tick.
+            enumeratedAtMs: completedAtMs,
         };
     }
     #readinessReconcileStatus() {
@@ -4611,16 +5252,33 @@ export class FactoryLoop {
             ...(this.#readinessReconcileLastSweep
                 ? {
                     candidates: this.#readinessReconcileLastSweep.candidates,
+                    // Unconditional for the same reason `dispatchFailures` is: these
+                    // are only meaningful as a pair, and only a published zero lets a
+                    // reader see that `emptyTreeReads < treeReads` — i.e. that the
+                    // mount served real content and a zero `candidates` beside it means
+                    // an empty workspace, not a silent mount (#351 follow-up).
+                    treeReads: this.#readinessReconcileLastSweep.treeReads,
+                    emptyTreeReads: this.#readinessReconcileLastSweep.emptyTreeReads,
                     dispatched: this.#readinessReconcileLastSweep.dispatched,
                     skipped: this.#readinessReconcileLastSweep.skipped,
                     ...(Object.keys(this.#readinessReconcileLastSweep.skipReasons).length > 0
                         ? { skipReasons: { ...this.#readinessReconcileLastSweep.skipReasons } }
                         : {}),
-                    ...(this.#readinessReconcileLastSweep.discoveryDeferred
-                        ? { discoveryDeferred: this.#readinessReconcileLastSweep.discoveryDeferred }
+                    // Unconditional, unlike the breakdown below it: a zero here is the
+                    // fact "this sweep attempted dispatches and none of them failed",
+                    // which no other field on this surface can express.
+                    dispatchFailures: this.#readinessReconcileLastSweep.dispatchFailures,
+                    ...(Object.keys(this.#readinessReconcileLastSweep.dispatchFailureReasons).length > 0
+                        ? { dispatchFailureReasons: { ...this.#readinessReconcileLastSweep.dispatchFailureReasons } }
                         : {}),
+                    lastEnumeratedAtMs: this.#readinessReconcileLastSweep.enumeratedAtMs,
                 }
                 : {}),
+            // Independent of the trio: a daemon whose FIRST pass deferred has no
+            // counts to publish and still needs to say why.
+            ...(this.#readinessReconcileLastSweepDeferred
+                ? { discoveryDeferred: this.#readinessReconcileLastSweepDeferred }
+                : {}),
             ...(this.#readinessReconcileLastError ? { lastError: this.#readinessReconcileLastError } : {}),
             ...(this.#readinessReconcileLastErrorClass
                 ? { lastErrorClass: this.#readinessReconcileLastErrorClass }
@@ -6187,9 +6845,11 @@ export class FactoryLoop {
         const comment = dispatchComment(record.decision, agents);
         let implementingStateId;
         if (!record.dryRun) {
+            const claimStartedAtMs = this.#clock.now();
             record.dispatchClaim = {
                 state: 'pending',
-                updatedAtMs: this.#clock.now(),
+                claimStartedAtMs,
+                updatedAtMs: claimStartedAtMs,
             };
             this.#dispatchClaimStatuses.set(dispatchLifecycleKey(record.issue), record.dispatchClaim);
         }
@@ -6199,7 +6859,7 @@ export class FactoryLoop {
             if (!issue)
                 throw new Error(`Unable to recover durable dispatch ${record.issue.key}: issue is no longer readable`);
             await this.#ensureGithubAgentQuestionWatch(record, issue);
-            implementingStateId = await this.#applyDispatchClaim(record, issue, comment);
+            implementingStateId = (await this.#applyDispatchClaim(record, issue, comment)).implementingStateId;
         }
         const recoveredPreviews = uniquePreviewReferences([
             ...dispatchSpecs(record.decision).map((spec) => spec.preview),
@@ -6508,33 +7168,161 @@ export class FactoryLoop {
         }
         await this.#linear.postComment(issue, body);
     }
-    async #applyDispatchClaim(record, issue, comment) {
+    async #applyDispatchClaim(record, issue, comment, claimFence) {
+        const claimWasRejected = () => claimFence?.accepted === false;
+        // stop() can reject this fence after the post-spawn readiness read but
+        // before this method starts. Never begin a provider claim in that state;
+        // shutdown intentionally does not drain dispatches that never crossed the
+        // claim boundary.
+        if (claimWasRejected()) {
+            throw new PostSpawnDispatchWaitRejectedError(record.issue.key);
+        }
         let implementingStateId;
+        let rejectClaim;
         if (isGithubIssue(issue)) {
+            const statusClaim = {
+                value: { result: undefined },
+            };
             await this.#retryDispatchWriteback(record, issue, 'GitHub label factory:in-progress', async () => {
-                await this.#githubWriteback.setStatus(issue, 'in-progress');
+                statusClaim.value = this.#githubWriteback.claimStatus
+                    ? await this.#githubWriteback.claimStatus(issue, 'in-progress')
+                    : { result: await this.#githubWriteback.setStatus(issue, 'in-progress') };
             });
+            rejectClaim = async () => await this.#rejectGithubDispatchClaim(record, issue, statusClaim.value);
+            if (claimWasRejected()) {
+                await rejectClaim();
+            }
             const commentApplied = this.#githubWriteback.hasCommentMarker
                 ? async () => this.#githubWriteback.hasCommentMarker(issue, comment)
                 : undefined;
-            await this.#retryDispatchWriteback(record, issue, 'GitHub dispatch comment', async () => this.#githubWriteback.postComment(issue, comment), commentApplied);
+            try {
+                await this.#retryDispatchWriteback(record, issue, 'GitHub dispatch comment', async () => {
+                    if (claimWasRejected())
+                        await rejectClaim();
+                    await this.#githubWriteback.postComment(issue, comment);
+                }, commentApplied);
+            }
+            catch (error) {
+                if (claimWasRejected() && !(error instanceof PostSpawnDispatchWaitRejectedError)) {
+                    await this.#rejectDispatchClaimAfterOperationError(record.issue.key, error, rejectClaim);
+                }
+                throw error;
+            }
+            if (claimWasRejected())
+                await rejectClaim();
         }
         else {
             implementingStateId = this.#states.idFor(issue.team, 'agentImplementing');
+            const readyStateId = issue.stateId;
+            let claimToken;
             await this.#retryDispatchWriteback(record, issue, `Linear state ${implementingStateId}`, async () => {
-                await this.#linear.setState(issue, implementingStateId);
-            });
-            await this.#retryDispatchWriteback(record, issue, 'Linear dispatch comment', async () => {
-                await this.#linear.postComment(issue, comment);
+                claimToken = (await this.#linear.setState(issue, implementingStateId))?.claimToken;
             });
+            rejectClaim = async () => await this.#rejectLinearDispatchClaim(record, issue, implementingStateId, readyStateId, claimToken);
+            if (claimWasRejected()) {
+                await rejectClaim();
+            }
+            try {
+                await this.#retryDispatchWriteback(record, issue, 'Linear dispatch comment', async () => {
+                    if (claimWasRejected())
+                        await rejectClaim();
+                    await this.#linear.postComment(issue, comment);
+                });
+            }
+            catch (error) {
+                if (claimWasRejected() && !(error instanceof PostSpawnDispatchWaitRejectedError)) {
+                    await this.#rejectDispatchClaimAfterOperationError(record.issue.key, error, rejectClaim);
+                }
+                throw error;
+            }
+            if (claimWasRejected())
+                await rejectClaim();
         }
         record.dispatchClaim = {
             state: 'verified',
+            // Cancellation can still arrive after this returns — while the running
+            // lifecycle save, the dispatch hook or the Slack publication is pending.
+            // The rejection fence rebuilds the claim from this record, so a verified
+            // state that drops the claim-start stamp leaves `cancellationBlocked`
+            // with no watermark for `getIssueStatus(..., { requireFresh: true })`.
+            // A private repository has no unauthenticated fallback to fall back on,
+            // so that lifecycle, its agents and its batch slot would then be retained
+            // for good, even once a human superseded the claim (#346 review, codex).
+            ...(record.dispatchClaim?.claimStartedAtMs === undefined
+                ? {}
+                : { claimStartedAtMs: record.dispatchClaim.claimStartedAtMs }),
             updatedAtMs: this.#clock.now(),
         };
         this.#dispatchClaimStatuses.set(dispatchLifecycleKey(record.issue), record.dispatchClaim);
         await this.#writeDispatchClaimRegistry(record.issue);
-        return implementingStateId;
+        if (claimWasRejected())
+            await rejectClaim?.();
+        return {
+            ...(implementingStateId ? { implementingStateId } : {}),
+            reject: rejectClaim,
+        };
+    }
+    async #rejectGithubDispatchClaim(record, issue, claim) {
+        let compensationError;
+        if (claim.result !== 'already-matched') {
+            try {
+                const claimToken = claim.claimToken;
+                if (!claimToken) {
+                    throw new Error('GitHub rejected dispatch claim has no immutable ownership token');
+                }
+                const rollbackStatusClaim = this.#githubWriteback.rollbackStatusClaim?.bind(this.#githubWriteback);
+                if (!rollbackStatusClaim) {
+                    throw new Error('GitHub writeback cannot conditionally roll back a rejected dispatch claim');
+                }
+                let outcome = 'unproven';
+                await this.#retryDispatchWriteback(record, issue, 'GitHub rejected dispatch claim rollback', async () => {
+                    outcome = await rollbackStatusClaim(issue, 'in-progress', claimToken);
+                    if (outcome === 'unproven') {
+                        throw new Error('GitHub rejected dispatch claim rollback could not prove ownership');
+                    }
+                });
+            }
+            catch (error) {
+                compensationError = error;
+            }
+        }
+        throw new PostSpawnDispatchWaitRejectedError(record.issue.key, compensationError);
+    }
+    async #rejectDispatchClaimAfterOperationError(issueKey, operationError, rejectClaim) {
+        try {
+            await rejectClaim();
+        }
+        catch (rejectionError) {
+            if (rejectionError instanceof PostSpawnDispatchWaitRejectedError) {
+                if (rejectionError.compensationError === undefined)
+                    throw rejectionError;
+                throw new PostSpawnDispatchWaitRejectedError(issueKey, new AggregateError([operationError, rejectionError.compensationError], 'Cancelled dispatch operation failed and its claim could not be safely compensated'));
+            }
+            throw new PostSpawnDispatchWaitRejectedError(issueKey, new AggregateError([operationError, rejectionError], 'Cancelled dispatch operation failed and its claim rejection threw unexpectedly'));
+        }
+        throw new PostSpawnDispatchWaitRejectedError(issueKey);
+    }
+    async #rejectLinearDispatchClaim(record, issue, implementingStateId, readyStateId, claimToken) {
+        let compensationError;
+        try {
+            const compareAndSetState = this.#linear.compareAndSetState?.bind(this.#linear);
+            if (!compareAndSetState) {
+                throw new Error('Linear writeback cannot conditionally roll back a rejected dispatch claim');
+            }
+            if (!claimToken) {
+                throw new Error('Linear rejected dispatch claim has no immutable ownership token');
+            }
+            await this.#retryDispatchWriteback(record, issue, `Linear rejected dispatch claim rollback to ${readyStateId}`, async () => {
+                const outcome = await compareAndSetState(issue, implementingStateId, claimToken, readyStateId);
+                if (outcome === 'unproven') {
+                    throw new Error('Linear rejected dispatch claim rollback could not prove an atomic provider transition');
+                }
+            });
+        }
+        catch (error) {
+            compensationError = error;
+        }
+        throw new PostSpawnDispatchWaitRejectedError(record.issue.key, compensationError);
     }
     async #retryDispatchWriteback(record, issue, write, apply, isApplied) {
         let lastError;
@@ -6549,11 +7337,23 @@ export class FactoryLoop {
                 return;
             }
             catch (error) {
+                // Claim rejection is terminal for this dispatch. In particular, do not
+                // turn a cancellation discovered between comment attempts into another
+                // provider retry that can publish after shutdown began.
+                if (error instanceof PostSpawnDispatchWaitRejectedError) {
+                    if (lastError !== undefined && error.compensationError !== undefined) {
+                        throw new PostSpawnDispatchWaitRejectedError(record.issue.key, new AggregateError([lastError, error.compensationError], 'Dispatch writeback failed before cancellation and its claim could not be safely compensated'));
+                    }
+                    throw error;
+                }
                 lastError = error;
                 const deadLettered = attempt === DISPATCH_WRITEBACK_MAX_ATTEMPTS;
                 this.#increment('dispatchWritebackFailures');
                 record.dispatchClaim = {
                     state: 'degraded',
+                    ...(record.dispatchClaim?.claimStartedAtMs === undefined
+                        ? {}
+                        : { claimStartedAtMs: record.dispatchClaim.claimStartedAtMs }),
                     write,
                     attempts: attempt,
                     maxAttempts: DISPATCH_WRITEBACK_MAX_ATTEMPTS,
@@ -6656,7 +7456,7 @@ export class FactoryLoop {
         const candidates = [];
         let scanned = 0;
         let lastProgressAtMs = startedAtMs;
-        for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'GitHub mirror candidate loading', { cache: true })) {
+        for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'GitHub mirror candidate loading', { cache: true, enumeration: true })) {
             await this.#refreshLiveHeartbeatIfDue();
             if (!isLinearIssueMirrorCandidatePath(path)) {
                 continue;
@@ -6706,7 +7506,7 @@ export class FactoryLoop {
                 else {
                     pathBatches = [];
                     for (const root of roots) {
-                        pathBatches.push(await this.#listRelayfileTree(root, 'GitHub issue ingestion', { cache: true }));
+                        pathBatches.push(await this.#listRelayfileTree(root, 'GitHub issue ingestion', { cache: true, enumeration: true }));
                     }
                     this.#increment('githubIssueIndexFallbacks');
                 }
@@ -7184,6 +7984,10 @@ export class FactoryLoop {
                 // The pass-scoped flag also lets every later blocked issue reuse the
                 // resulting dependency index instead of rescanning the full tree.
                 this.#dependencyLinearTreeLoaded = true;
+                // Cached like the enumeration walks, but deliberately NOT `enumeration`:
+                // this is a lookup for named blocker identities, not the sweep asking
+                // what work exists, and mixing a lookup's result into the ratio is the
+                // masking the pair's scoping exists to prevent (#363 review).
                 for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'dependency blocker discovery', { cache: true })) {
                     if (isIssueFilePath(path))
                         await this.#readIssue(path);
@@ -7453,6 +8257,9 @@ export class FactoryLoop {
             readinessReconcile: this.#readinessReconcileStatus(),
             dispatchCapacity: this.#dispatchCapacityStatus(),
             fleetControlPlane: this.#fleetControlPlane.status(),
+            // Optional on the port: a backend with no socket omits it, and an absent
+            // value stays absent rather than being invented as healthy.
+            ...(this.#fleet.fleetConnectStatus ? { fleetConnect: this.#fleet.fleetConnectStatus() } : {}),
         };
         // The deployed container serves `/healthz` straight out of this file and
         // has no redaction logic of its own, so publish the already-safe view here
@@ -7631,14 +8438,14 @@ export class FactoryLoop {
         }
         const pathsByKey = new Map();
         const canonicalPathsByKey = new Map();
-        for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'Linear ready issue canonical discovery', { cache: true })) {
+        for (const path of await this.#listRelayfileTree(ISSUE_ROOT, 'Linear ready issue canonical discovery', { cache: true, enumeration: true })) {
             if (isIssueFilePath(path)) {
                 const key = keyFromPath(path);
                 canonicalPathsByKey.set(key, path);
                 pathsByKey.set(key, path);
             }
         }
-        for (const path of await this.#listRelayfileTree(linearByStatePath('ready-for-agent'), 'Linear ready issue alias discovery', { cache: true })) {
+        for (const path of await this.#listRelayfileTree(linearByStatePath('ready-for-agent'), 'Linear ready issue alias discovery', { cache: true, enumeration: true })) {
             if (isIssueAliasFilePath(path)) {
                 const canonicalPath = canonicalPathsByKey.get(keyFromPath(path));
                 if (canonicalPath) {
@@ -7692,10 +8499,20 @@ export class FactoryLoop {
     }
     async #releaseInFlightAgents(reason, opts = {}) {
         const agents = new Map();
-        for (const record of (await this.#batch()).inFlight) {
+        const blockedDispatches = new Set();
+        const batch = await this.#batch();
+        const records = [...batch.inFlight];
+        for (const record of records) {
+            const key = dispatchLifecycleKey(record.issue);
             if (record.dryRun) {
+                this.#shutdownReleaseCapturedDispatches.add(key);
+                continue;
+            }
+            if (this.#uncompensatedDispatchClaims.has(key) || record.dispatchClaim?.cancellationBlocked === true) {
+                blockedDispatches.add(key);
                 continue;
             }
+            this.#shutdownReleaseCapturedDispatches.add(key);
             if (opts.preserveDurable && [...record.agents.values()].some((tracked) => tracked.result?.locality === 'remote')) {
                 continue;
             }
@@ -7704,7 +8521,15 @@ export class FactoryLoop {
             }
         }
         await this.#releaseAndTerminateAgents([...agents], reason, 'stop');
-        await this.#writeInFlightRegistry(undefined, undefined, true);
+        for (const record of records) {
+            const key = dispatchLifecycleKey(record.issue);
+            if (blockedDispatches.has(key))
+                continue;
+            if (!this.#postSpawnDispatchesRejectedDuringStop.delete(key))
+                continue;
+            batch.abandon(record.issue);
+        }
+        await this.#writeInFlightRegistry(undefined, undefined, true, blockedDispatches);
     }
     async #releaseAndTerminateAgents(agents, reason, context) {
         const failed = [];
@@ -7763,17 +8588,40 @@ export class FactoryLoop {
                     await this.#reportAgent(record, tracked, 'agent.released', { releaseReason: reason });
             }
             catch (error) {
-                failed.push(agentName);
-                this.#logger.warn?.(`[factory] failed to release ${agentName} during ${context}`, error);
-                if (record) {
-                    const lifecycle = await this.#state
-                        .getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue))
-                        .catch(() => undefined);
-                    if (lifecycle) {
-                        await this.#reportLifecycle(lifecycle, 'factory.failure', {
-                            level: 'error',
-                            errorCode: 'release_failed',
-                        });
+                if (isAgentAlreadyGoneOnRelease(error)) {
+                    // Do the same bookkeeping the success path does — the agent IS
+                    // gone. Skipping this would leave `batch.recordRelease` unset and
+                    // the next retry attempt would think the invocation is still
+                    // dispatchable.
+                    this.#increment('releaseAgentAlreadyGone');
+                    this.#logger.info?.(`[factory] release skipped: agent already gone during ${context}`, { agentName, reason });
+                    if (record && batch && context !== 'stop') {
+                        const releasedInvocationId = batch.recordRelease(record, agentName, this.#clock.now());
+                        if (releasedInvocationId) {
+                            this.#logger.debug?.('[factory] released agent invocation is no longer dispatchable', {
+                                issue: record.issue.key,
+                                agentName,
+                                reason,
+                                invocationId: releasedInvocationId,
+                            });
+                        }
+                    }
+                    if (record)
+                        await this.#reportAgent(record, tracked, 'agent.released', { releaseReason: reason });
+                }
+                else {
+                    failed.push(agentName);
+                    this.#logger.warn?.(`[factory] failed to release ${agentName} during ${context}`, error);
+                    if (record) {
+                        const lifecycle = await this.#state
+                            .getDispatchLifecycle(this.#workspaceId, dispatchLifecycleKey(record.issue))
+                            .catch(() => undefined);
+                        if (lifecycle) {
+                            await this.#reportLifecycle(lifecycle, 'factory.failure', {
+                                level: 'error',
+                                errorCode: 'release_failed',
+                            });
+                        }
                     }
                 }
             }
@@ -7923,7 +8771,7 @@ export class FactoryLoop {
             this.#increment('agentWorktreesCleaned');
         }
     }
-    async #writeInFlightRegistry(path = this.#config.loop.registryPath, heartbeatPath = this.#config.loop.heartbeatPath, empty = false) {
+    async #writeInFlightRegistry(path = this.#config.loop.registryPath, heartbeatPath = this.#config.loop.heartbeatPath, empty = false, retainIssueKeys) {
         const updatedAtMs = this.#clock.now();
         const agents = [];
         const seenAgents = new Set();
@@ -7961,10 +8809,12 @@ export class FactoryLoop {
                 } : {}),
             });
         };
-        if (!empty) {
+        if (!empty || retainIssueKeys?.size) {
             for (const record of (await this.#batch()).inFlight) {
                 if (record.dryRun)
                     continue;
+                if (empty && !retainIssueKeys?.has(dispatchLifecycleKey(record.issue)))
+                    continue;
                 if (record.dispatchClaim) {
                     this.#dispatchClaimStatuses.set(dispatchLifecycleKey(record.issue), record.dispatchClaim);
                 }
@@ -9179,10 +10029,59 @@ export class FactoryLoop {
     // the release-driven exit event so it cannot re-trigger a resume before the
     // record leaves the batch.
     async #abandonStuckDispatch(record, reason) {
-        const key = issueKey(record.issue);
+        const key = dispatchLifecycleKey(record.issue);
+        // Fence the periodic held sweep before any await below. A blocked claim is
+        // retried by the single keyed abandonment timer; letting the held sweep
+        // enter concurrently can release the same placements twice when provider
+        // supersession becomes visible.
+        this.#abandonedDispatchReasons.set(key, reason);
+        try {
+            await this.#abandonStuckDispatchFenced(record, reason, key);
+        }
+        catch (error) {
+            // The early fence above suppresses the periodic held sweep. Any
+            // exceptional exit must therefore install the keyed retry before
+            // propagating, or one transient persistence/read failure becomes a
+            // permanent absorbing state.
+            this.#increment('abandonedDispatchReleaseRetries');
+            this.#logger.warn?.('[factory] abandoned dispatch cleanup failed before retry was armed', {
+                issue: record.issue.key,
+                error: describeError(error).errorMessage,
+            });
+            this.#scheduleAbandonedDispatchRetry(record, reason);
+            throw error;
+        }
+    }
+    async #abandonStuckDispatchFenced(record, reason, key) {
+        const claimFence = this.#postSpawnDispatchClaimFences.get(key);
+        const rejectedClaimCompensation = claimFence?.claimStarted
+            ? claimFence.rejectionSettled
+            : undefined;
+        // A dispatch can be stuck inside a later spawn after an earlier agent has
+        // already started completion. Release both post-spawn waits before the
+        // first abandonment await so terminal processing cannot remain an
+        // absorbing promise after this lifecycle is reaped.
+        this.#settlePostSpawnDispatchWaits(key, false, 'abandonment');
+        if (rejectedClaimCompensation) {
+            const compensated = await this.#awaitRejectedClaimCompensation(rejectedClaimCompensation);
+            if (!compensated) {
+                if (!this.#pendingDispatchClaims.has(key)) {
+                    // The provider call settled while this bounded wait expired; its
+                    // caller is recording the definitive compensated/unproven result.
+                    this.#scheduleAbandonedDispatchRetry(record, reason);
+                    return;
+                }
+                await this.#retainUncompensatedDispatchClaim(record, new Error('Rejected dispatch claim compensation did not complete before abandonment'), { preferExistingError: true, pending: true });
+                this.#scheduleAbandonedDispatchRetry(record, reason);
+                return;
+            }
+        }
+        if (await this.#dispatchClaimBlocksAbandonment(record)) {
+            this.#scheduleAbandonedDispatchRetry(record, reason);
+            return;
+        }
         const heldPastDeadline = reason === HELD_PAST_DEADLINE_RELEASE_REASON;
         const agentReleaseReason = heldPastDeadline ? HELD_PAST_DEADLINE_RELEASE_REASON : 'issue-abandoned';
-        this.#abandonedDispatchReasons.set(key, reason);
         if (!await this.#saveDispatchLifecycle(record, 'abandoning', undefined, reason, new Set(), { cancellationReason: 'dispatch_failed' })) {
             this.#increment('abandonedDispatchReleaseRetries');
             // The generic durable retry can recover the in-memory reason in this
@@ -13210,6 +14109,22 @@ export class FactoryLoop {
             return;
         }
         this.#completionInFlight.add(completionKey);
+        const postSpawnIssueObservation = this.#postSpawnIssueObservations.get(completionKey);
+        const postSpawnDispatchClaimFence = this.#postSpawnDispatchClaimFences.get(completionKey);
+        let settleIssueWriteback;
+        const issueWritebackSettled = new Promise((resolve) => {
+            settleIssueWriteback = resolve;
+        });
+        let issueWritebackDidSettle = false;
+        const settleIssueWritebackOnce = () => {
+            if (issueWritebackDidSettle)
+                return;
+            issueWritebackDidSettle = true;
+            settleIssueWriteback();
+            if (this.#issueWritebackInFlight.get(completionKey) === issueWritebackSettled) {
+                this.#issueWritebackInFlight.delete(completionKey);
+            }
+        };
         let releaseReasonForRetry;
         try {
             if (!await this.#assertDispatchLifecycleOwner(record))
@@ -13259,13 +14174,59 @@ export class FactoryLoop {
             const humanReview = configuredHumanReview || (githubIssue && !githubMerged);
             const statusLabel = humanReview ? 'In Human Review' : 'Done';
             if (issue) {
+                if (postSpawnDispatchClaimFence) {
+                    // Publish boundary arrival before any await. Dispatch performs the
+                    // paired synchronous claimStarted assignment after its ready read,
+                    // so exactly one side wins: an earlier completion is awaited and
+                    // re-read; a claim already entering its provider write finishes
+                    // before this terminal write begins.
+                    postSpawnDispatchClaimFence.completionAtWriteBoundary = true;
+                    if (postSpawnDispatchClaimFence.claimStarted || postSpawnDispatchClaimFence.accepted !== undefined) {
+                        let claimAccepted = postSpawnDispatchClaimFence.accepted;
+                        if (claimAccepted === undefined) {
+                            // This counter makes the otherwise internal promise boundary
+                            // observable in deterministic race regressions and in incident
+                            // telemetry. External abandonment/stop settlement must release
+                            // every completion counted here.
+                            this.#increment('postSpawnDispatchClaimFenceWaits');
+                            claimAccepted = await postSpawnDispatchClaimFence.settled;
+                        }
+                        if (!claimAccepted)
+                            return;
+                    }
+                }
+                // Register only at the provider-write boundary. Work before this point
+                // (PR discovery/merge gating) has not changed the issue, so a foreign
+                // park during it must still abort immediately rather than waiting on a
+                // possibly long completion path.
+                this.#issueWritebackInFlight.set(completionKey, issueWritebackSettled);
                 if (githubIssue) {
                     if (humanReview) {
-                        await this.#githubWriteback.setStatus(issue, 'human-review');
+                        const statusWrite = await this.#githubWriteback.setStatus(issue, 'human-review');
+                        if (statusWrite === undefined)
+                            this.#recordMissingGithubWritebackReceipt('setStatus');
+                        // Only an explicit provider-proven transition establishes that
+                        // this dispatch owns the visible park. Legacy void adapters and
+                        // App acknowledgements remain deliberately untrusted.
+                        if (statusWrite === 'applied') {
+                            record.issueWritebackConfirmedAtMs ??= this.#clock.now();
+                        }
+                        // The lifecycle-state outcome is now known. Unblock the concurrent
+                        // post-spawn read before the separate completion comment write.
+                        settleIssueWritebackOnce();
                         await this.#githubWriteback.postComment(issue, `Factory agents completed; this issue is awaiting human review. The pull request remains open.\n\nMerge policy: ${this.#config.mergePolicy}`);
                     }
                     else {
-                        await this.#githubWriteback.closeIssue(issue, 'Factory observed the linked pull request merge and completed this issue.');
+                        const closeWrite = await this.#githubWriteback.closeIssue(issue, 'Factory observed the linked pull request merge and completed this issue.');
+                        if (closeWrite === undefined)
+                            this.#recordMissingGithubWritebackReceipt('closeIssue');
+                        // A provider-confirmed, actor-attributed close is the only safe
+                        // proof that this dispatch owns the visible terminal state. An
+                        // idempotent no-op, legacy void adapter, or App acknowledgement
+                        // may instead mean a third party won the close race.
+                        if (closeWrite === 'applied') {
+                            record.issueWritebackConfirmedAtMs ??= this.#clock.now();
+                        }
                     }
                 }
                 else {
@@ -13273,13 +14234,28 @@ export class FactoryLoop {
                         ? this.#states.idFor(issueTeam, 'humanReview')
                         : this.#states.idFor(issueTeam, 'done');
                     await this.#linear.setState(issue, targetState);
+                    record.issueWritebackConfirmedAtMs ??= this.#clock.now();
                     await this.#recordCanonicalIssueState({ ...record.issue, stateId: targetState });
                 }
-                record.issueWritebackConfirmedAtMs = this.#clock.now();
-                this.#emit('writeback-verified', { issue: record.issue, path: issue.path });
+                if (record.issueWritebackConfirmedAtMs !== undefined) {
+                    this.#emit('writeback-verified', { issue: record.issue, path: issue.path });
+                }
+                // Unblock a concurrent post-spawn read as soon as the issue writeback
+                // outcome is known. Completion still has dependency, Slack and release
+                // work to do; none determines whether the observed issue state is safe.
+                settleIssueWritebackOnce();
+                // If completion raced dispatch's post-spawn read, let that read consume
+                // the receipt before claiming terminal success. An unproven provider
+                // transition is a foreign live-state change: dispatch owns the
+                // abandonment and must release agents with that reason, not issue-done.
+                if (postSpawnIssueObservation && !await postSpawnIssueObservation.settled)
+                    return;
                 if (!humanReview)
                     await this.#markDependencyTerminalAndReconcile(issue);
             }
+            else {
+                settleIssueWritebackOnce();
+            }
             if (!await this.#saveDispatchLifecycle(record, 'writeback-applied'))
                 return;
             if (issue && this.#slack && this.#config.slack && !await this.#shouldSkipSlackWriteback('completion-thread')) {
@@ -13344,6 +14320,10 @@ export class FactoryLoop {
                 this.#scheduleDispatchLifecycleRetry(record);
         }
         finally {
+            // Errors before or during provider confirmation leave the marker unset;
+            // the waiting dispatch will re-read and preserve the foreign-change
+            // abort. Always settle so a failed write cannot strand that dispatch.
+            settleIssueWritebackOnce();
             this.#completionInFlight.delete(completionKey);
             const stateKey = issueStateKey(record.issue);
             this.#probePrGhBackoffUntilMs.delete(stateKey);
@@ -13360,6 +14340,35 @@ export class FactoryLoop {
             }
         }
     }
+    #recordMissingGithubWritebackReceipt(method) {
+        const implementation = this.#githubWriteback.constructor.name || 'anonymous GithubWriteback';
+        this.#increment('githubWritebackReceiptMissing');
+        this.#logger.warn?.('[factory] GitHub writeback returned no ownership receipt', {
+            implementation,
+            method,
+        });
+    }
+    #settlePostSpawnDispatchWaits(key, accepted, source) {
+        const observation = this.#postSpawnIssueObservations.get(key);
+        const claimFence = this.#postSpawnDispatchClaimFences.get(key);
+        if (!observation && !claimFence)
+            return false;
+        // Capture both before either settlement deletes its own map entry.
+        if (!accepted && claimFence?.claimStarted) {
+            // The rejection handler clears this provisional block only after a
+            // conditional provider rollback succeeds. Until then, shutdown and held
+            // abandonment must not release the lifecycle's agents.
+            this.#uncompensatedDispatchClaims.add(key);
+            this.#pendingDispatchClaims.add(key);
+        }
+        observation?.settle(accepted);
+        claimFence?.settle(accepted);
+        if (source === 'abandonment')
+            this.#increment('postSpawnWaitsSettledByAbandonment');
+        if (source === 'stop')
+            this.#increment('postSpawnWaitsSettledByStop');
+        return true;
+    }
     #emit(event, payload) {
         for (const listener of this.#listeners.get(event) ?? []) {
             try {
@@ -16030,7 +17039,7 @@ const defaultGithubWriteback = (config, mount) => {
     if (!mount.githubWrite) {
         throw new Error('GitHub identity "app" requires a connected workspace GitHub App lifecycle write path; refusing to fall back to the local gh user');
     }
-    return new AppGithubWriteback(mount.githubWrite);
+    return new AppGithubWriteback(mount.githubWrite, mount.githubRead);
 };
 export function parseLinearIssue(path, content) {
     const parsed = parseJsonContent(content);
@@ -18271,21 +19280,28 @@ const githubIssueIndexRepoRoots = (path) => {
         `/github/repos/${owner}__${repo}/issues`,
     ];
 };
-const relayfileOverload = (error) => {
-    const flat = asRecord(error) ?? {};
+/** How far to follow wrapped provider failures without trusting an unbounded chain. */
+const RELAYFILE_OVERLOAD_CAUSE_DEPTH = 4;
+const relayfileOverload = (error, depth = 0) => {
+    if (depth > RELAYFILE_OVERLOAD_CAUSE_DEPTH)
+        return undefined;
+    const flat = asRecord(error);
+    if (!flat)
+        return undefined;
     const response = asRecord(flat.response) ?? {};
     const data = asRecord(flat.data) ?? asRecord(response.data) ?? {};
     const details = asRecord(flat.details) ?? asRecord(data.details) ?? {};
     const statusValue = flat.status ?? flat.statusCode ?? response.status ?? response.statusCode;
     const status = typeof statusValue === 'number' ? statusValue : Number(statusValue);
-    if (status !== 429)
-        return undefined;
-    const retryValue = flat.retryAfterSeconds ?? details.retryAfterSeconds ?? data.retryAfterSeconds;
-    const parsedRetry = typeof retryValue === 'number' ? retryValue : Number(retryValue);
-    const retryAfterSeconds = Number.isFinite(parsedRetry) && parsedRetry >= 0 ? parsedRetry : undefined;
-    const reason = stringValue(flat.reason) ?? stringValue(details.reason) ?? stringValue(data.reason) ??
-        stringValue(flat.code) ?? stringValue(data.code) ?? 'rate_limited';
-    return { status, reason, ...(retryAfterSeconds === undefined ? {} : { retryAfterSeconds }) };
+    if (status === 429) {
+        const retryValue = flat.retryAfterSeconds ?? details.retryAfterSeconds ?? data.retryAfterSeconds;
+        const parsedRetry = typeof retryValue === 'number' ? retryValue : Number(retryValue);
+        const retryAfterSeconds = Number.isFinite(parsedRetry) && parsedRetry >= 0 ? parsedRetry : undefined;
+        const reason = stringValue(flat.reason) ?? stringValue(details.reason) ?? stringValue(data.reason) ??
+            stringValue(flat.code) ?? stringValue(data.code) ?? 'rate_limited';
+        return { status, reason, ...(retryAfterSeconds === undefined ? {} : { retryAfterSeconds }) };
+    }
+    return relayfileOverload(flat.cause, depth + 1);
 };
 /**
  * relayfile's overload reason codes, allowlisted.
@@ -18804,13 +19820,14 @@ const PASS_FATAL_CAUSE_DEPTH = 4;
  * classification has to follow the cause chain rather than trust the outermost
  * type.
  */
-const wrapsErrorOfType = (error, type, depth = 0) => {
+const findWrappedErrorOfType = (error, type, depth = 0) => {
     if (depth > PASS_FATAL_CAUSE_DEPTH || !(error instanceof Error))
-        return false;
+        return undefined;
     if (error instanceof type)
-        return true;
-    return wrapsErrorOfType(error.cause, type, depth + 1);
+        return error;
+    return findWrappedErrorOfType(error.cause, type, depth + 1);
 };
+const wrapsErrorOfType = (error, type) => findWrappedErrorOfType(error, type) !== undefined;
 /**
  * How many *unclassified* per-item failures without an intervening successful
  * dispatch end the pass. Named per-item conditions (a lifecycle claim refusal,
@@ -18826,6 +19843,10 @@ const UNCLASSIFIED_DISPATCH_FAILURE_LIMIT = 5;
  */
 const isClassifiedPerItemDispatchFailure = (error) => error instanceof LiveDispatchStateChangedError ||
     error instanceof DispatchLifecycleClaimRefusedError ||
+    // An external stop/held-agent deadline rejected the post-spawn boundary
+    // while a provider claim was already in flight. That lifecycle's cleanup is
+    // owned by the rejecting path, so the late claim unwind is an expected skip.
+    error instanceof PostSpawnDispatchWaitRejectedError ||
     // #303: the never-placed deadline released this dispatch while its spawn was
     // still in flight. Named, expected and self-healing — the issue goes back to
     // the queue — and it recurs under exactly the slow-spawn conditions the
@@ -18850,7 +19871,8 @@ const isClassifiedPerItemDispatchFailure = (error) => error instanceof LiveDispa
  * of a missed one is leaked agents and duplicate workers on the next retry.
  */
 const mayHaveSpawnedBeforeFailing = (error) => !(error instanceof LiveDispatchStateChangedError) &&
-    !(error instanceof DispatchLifecycleClaimRefusedError);
+    !(error instanceof DispatchLifecycleClaimRefusedError) &&
+    !(error instanceof PostSpawnDispatchWaitRejectedError);
 /**
  * The run-report reason recorded for a work unit the pass could not dispatch.
  *
@@ -18868,6 +19890,8 @@ const perItemDispatchSkipReason = (error) => {
         return 'live state changed during dispatch';
     if (error instanceof LatePlacementReleasedError)
         return 'dispatch released while its agent was still spawning';
+    if (error instanceof PostSpawnDispatchWaitRejectedError)
+        return 'dispatch terminated during post-spawn claim';
     if (error instanceof DispatchLifecycleClaimRefusedError) {
         return error.refusal === 'terminal'
             ? 'dispatch lifecycle already terminal'
@@ -18875,6 +19899,54 @@ const perItemDispatchSkipReason = (error) => {
     }
     return `dispatch failed (${telemetryErrorClass(error)})`;
 };
+const UNCLASSIFIED_PHASE_CODES = {
+    gate: 'unclassified-gate',
+    triage: 'unclassified-triage',
+    dispatch: 'unclassified-dispatch',
+};
+/**
+ * Why a dispatch attempt failed, as a code from the published vocabulary (#355).
+ *
+ * The sibling of `perItemDispatchSkipReason`: that returns the operator's
+ * sentence, this returns the one token that may cross onto the unauthenticated
+ * health surface, and both are recorded at the skip site from the same thrown
+ * value. The token is never parsed back out of the sentence — a reworded
+ * message would silently empty a bucket, and this vocabulary is what an
+ * operator reads when the daemon's stdout does not reach them.
+ *
+ * Ordered most specific first. Every branch follows the bounded cause chain,
+ * because `contextualError` and the control-plane guard both rethrow wrapped.
+ * `relayfileOverload` is also the loop's shedding predicate, so widening it at
+ * the source keeps the health code, skip counter, fuse, and durable overload
+ * ratchet on one verdict instead of merely relabelling the published bucket.
+ */
+const perItemDispatchFailureCode = (error, phase) => {
+    if (relayfileOverload(error) !== undefined)
+        return 'relayfile-overloaded';
+    if (wrapsErrorOfType(error, LiveDispatchStateChangedError))
+        return 'live-state-changed';
+    if (wrapsErrorOfType(error, LatePlacementReleasedError))
+        return 'late-placement-released';
+    const refused = findWrappedErrorOfType(error, DispatchLifecycleClaimRefusedError);
+    if (refused)
+        return refused.refusal === 'terminal' ? 'lifecycle-terminal' : 'lifecycle-owned-elsewhere';
+    if (wrapsErrorOfType(error, FleetControlPlaneCircuitOpenError))
+        return 'control-plane-open';
+    // The class-name tail of the vocabulary; see its own doc comment for why
+    // these five are not `instanceof`. Walked down the cause chain like the
+    // branches above, because `contextualError` wraps in a plain `Error` and
+    // reading only the outermost name would miss every wrapped spawn failure.
+    // `telemetryErrorClass` is the same allowlist that guards every other
+    // identifier leaving this process, so a hostile `name` cannot invent a key
+    // here either — it collapses to `Error`, which the map does not hold.
+    for (let cursor = error, depth = 0; cursor instanceof Error && depth <= PASS_FATAL_CAUSE_DEPTH; depth += 1) {
+        const named = factoryDispatchFailureReasonCodeForErrorClass(telemetryErrorClass(cursor));
+        if (named)
+            return named;
+        cursor = cursor.cause;
+    }
+    return UNCLASSIFIED_PHASE_CODES[phase];
+};
 const triageEscalationQuestion = (decision, issue) => {
     const routedRepos = decision.routes.map((route) => route.repo).filter(Boolean);
     const subject = issue?.title?.trim() || decision.issue.key;