v0.4.3

• factory watch files engine/runtime failures only into [watch].engine_repo (default mikeroySoft/factory) from every install, never into the repository it runs in (#311: 46 engine bugs filed into rocm-cli, rocm-app, district and gpuflo between Oct 16 and 19 that those repos could not fix). Before filing it lists the engine repo's open bug issues; when another install already filed the fingerprint it comments its newest evidence there, at most once per 24 h per install, and adds itself to the issue's Observed by list. Unit fingerprints no longer include the install's unit name. Only the opening install closes a filing, and not while another install commented within 24 h. The runtime reader adds failures: the failure-severity entries of errors (runtime_events.FAILURES: journal-writer defects only) with an evidence pointer (byte offset, execution_id, OS error); every other code, including any future one, is coverage and never filed. STEADY_CODES is gone. Runtime filings quote the offending journal line, the conflicting execution's rows, or the broken reader's stderr. Triage bypasses the model for watch filings written by its own account (routed from another install), and with [install].dispatch_env set it refuses to post (identity_mismatch) unless gh authenticates as the dispatcher: on Oct 18 a pass whose unit lacked GH_CONFIG_DIR triaged #264–#297 and escalated #238 as the owner account. The dashboard's "Run LLM triage" decision runs triage with dispatch_env applied, so it posts as the dispatcher instead of being refused.
• Runtime projection no longer reports filesystem/resources lock_unavailable for a lock file that does not exist (#315): ticket cleanup unlinks .factory/locks/N.lock after landing while the journal still names it, and merge.lock does not exist before the first merge, so every live journal tripped the error and factory watch filed it. The resource still reports state unknown; other stat failures still report lock_unavailable.
• factory stats on the runner (#313): per-ticket GitHub reads (issue, PR comments, timeline) run 8 at a time with stats: N/M tickets progress on stderr (--quiet hides it), instead of ~430 serial gh calls and minutes of silence. Every mode reads the dispatcher's root (host [repo."owner/name"].path for --repo owner/name or the checkout's repository), so --by-worker/--by-brief from a dev checkout no longer print empty rows; a root without .factory/events.jsonl fails naming that path. --escapes fetches a fix commit missing from the clone (git fetch origin <sha>) and otherwise skips it with a warning and a Skipped fixes: N footer instead of crashing (skipped per JSON row). OMP workers' token usage is now recorded from their session transcript when the log reports none, shown per row and summed in a Worker tokens: footer (n/a (not reported) where missing). Dollar columns are dropped when no ticket has a cost, with one Prices: none configured note; the README documents [prices."<model>"] keys, units and an example.
• Triage posts at most one comment per issue state (#288): a needs-triage issue whose last comment is its own triage comment and whose updatedAt is within a minute of it (no comment, body or title edit, or label change since) is skipped without asking the model, journaled as not_admitted/unchanged_since_triage. A failed label swap after the comment used to leave needs-triage and repost every pass; a new comment or any label change, including putting needs-triage back, still gets a fresh triage.
• Managers can RESOLVE a no-change escalation when evidence shows the requested outcome is already on main or the ticket is a duplicate. Factory records the evidence before closing the issue as completed and removing ready-for-human; it closes an empty open agent PR too, but refuses if that PR contains commits.
• Watch-filed runtime failures bypass model triage for a fixed agent investigation, and factory watch closes open filings after their fingerprint has been absent for 24 hours.
• Watch-filed runtime failures bypass model triage for a fixed agent investigation, and factory watch closes open, unassigned filings whose newest evidence is at least 24 hours old.
• Watch-filed runtime failures bypass model triage for a fixed agent investigation, and factory watch closes open, unassigned filings still at needs-triage or ready-for-agent whose newest evidence is at least 24 hours old; filings a fix or a human already closed are journaled and no longer re-checked.
• Accepted-priority scheduling (#102): factory dispatch admits frontier tickets by policy instead of issue-list order (factory/schedule.py). Existing eligibility (open, ready-for-agent, not an initiative, unassigned, no open Blocked by), capacity and locks come first; a ticket whose Plan binding admission would refuse (ambiguous or malformed, or linked without a baseline) is held with that reason and never ranked. At most one experiment-labelled ticket (new label, created by factory init) is active at a time and production delivery has the remaining capacity. Priority is read only from the ticket's pinned Plan baseline (the accepted scope binding): NOW > NEXT > THEN > LATER, then unknown priority, oldest ticket first within a class; after three consecutive explicit-priority claims the oldest eligible unknown-priority ticket is admitted. Triage briefs, manager recommendations and experiment results never set priority. Each pass with eligible work logs selected/deferred/held with a reason per ticket and journals a scheduling row; claimed rows gain priority, priority_source and experiment. --dry-run logs the plan and writes nothing; --ticket N is unchanged.