[factory] Canary: prove cloud dispatch end to end — regression test for describeControlPlaneError redaction

[khaliqgant]

This is a dispatch canary. Its purpose is to prove the cloud Factory dispatches end to end after the 2026-08-16→23 outage. The deliverable is deliberately small and self-contained; treat the dispatch as the point, not the scope.

Why now

The outage root cause was that the mandatory factory status preflight registered the boot's fleet agent and disposed it before messaging.events.connect(), planting an identity that never entered presence. The live daemon then could not reclaim its own name, latched after MAX_REGISTRATION_ATTEMPTS, opened the fleet control-plane breaker, and dispatch was gated before placement.

Fixed in #343 (b7c68462, shipped in 0.1.70). The live cutover at 2026-08-23T20:24:05Z is now healthy on every surface that was previously red:

subsystem	during outage	now
fleetControlPlane	open, lastError: FactoryAgentRegistrationError	closed
consecutiveFailures	2	0
readinessReconcile	failing in ~1ms	healthy
eventListener	—	subscribed
fleet agent presence	never online, created == last_seen	factory-cloud-b712dab5 online

Every gate is clear and the daemon is sweeping on schedule. What is not yet proven is an actual dispatch — no new factory/* branch has appeared, and "ungated" is not the same claim as "working". A green subsystem that never does the work is exactly the kind of false-healthy signal this outage was made of.

Deliverable

Add a regression test asserting that describeControlPlaneError cannot leak transport text.

It is exported from src/fleet/control-plane-circuit.ts and reduces any cause to Name (CODE), appending the code only when it matches /^[A-Z0-9_]{1,80}$/u. Both the fleet control-plane circuit and the fleet connect status publish through it, and both values reach factory status and the authenticated /evidence.

Assert:

1. an Error carrying a URL, bearer token, or connection string in its message reduces to the class name alone — none of that text survives;
2. a well-formed code is appended;
3. a malformed code (lowercase, punctuation, or over-length) is dropped rather than passed through.

Keep it to that one function. Do not refactor it, and do not touch #subscribeEvents or the fleet connect status — PR #341 owns that file's connect path and a second editor there will collide.

Definition of done

• The test exists and fails if the redaction is removed — show that, do not assert it.
• Per-job green via gh run view <id> --json jobs. Note issue flake: shared timing substrate in src/orchestrator/factory.test.ts fails 3 different tests nondeterministically #342 is a known flaky timing substrate in src/orchestrator/factory.test.ts; a red there is likely unrelated to this change.
• A PR opened against main. mergePolicy is never, so do not merge it — the human owns that gate.

Safety

Public repo: no customer names, no credentials, no exploit paths in the PR, commits, or comments. If a real token appears anywhere in your working output, stop and flag it for rotation rather than committing.