The failed-repo retry loop logged a failed pass at warn and slept until the next interval. Nothing else observed it, so a dead retry subsystem left every failed repository permanently unhealed while health stayed green -- the reliability feature turning a loud small failure into a silent large one. Only our own failures reach that path: processDid already converts remote errors, rate limits and bad commits into per-repo backoff, and returns only on local_failure, OutOfMemory or ArchiveAppendFailed. Upstream returns those out of RunFailedRepoRetry into an errgroup, which cancels the steady-state consumer. Stream now latches terminal_error, counts a new retry_terminal_failures_total, and sets the shutdown flag main already waits on. The test arms a real metadata read fault under a seeded failed repo and asserts run() returns with both flags set and the counter at one. Under the old behavior that call never returns at all. zig build test (299), ReleaseSafe, http-metrics-contract, retry-config-contract. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>