[saucam]

What this changes

The dispatch queue becomes safe for long-running, interruptible work, and ready to run loop attempts (docs/loop-engineering-design.md §5–§6). It does this by extending the existing queue rather than adding a second one.

• Stale results can't land. Every claim and reclaim of a task bumps its generation. A worker's completion only applies if it carries the generation it started under. Before this, a worker replaced after a lease expired could still complete the task it had lost, because completion updated by id alone. That fix applies to all dispatch work, not just loops.
• Parked tasks (held). An attempt waiting on a person (an approval outside its profile) can be held, so its lease doesn't expire underneath it. A hold lapses after dispatch.holdMaxMs (default 2 hours), and any restart settles it. Only attempts can be held, and only by the daemon that owns them.
• Attempt tasks. A new attempt kind runs on a loop's behalf. It is never retried by the queue (the loop decides), emits no fleet events (no conductor turns), and doesn't tear down its worker. Dispatcher.cancel stops one in any state.
• Fleet views unchanged. Attempts are kept off the conductor's task list and the fleet board. Loop runs get their own board rows in a later slice. The web board knows the held status.

No loop uses this yet; the controller lands separately.

Review

Two independent audit rounds.

• Round 1 fixed: a web build break on the new status, holds that could tie up worker capacity forever, holds allowed on any task kind, unscoped unhold, wrong outcomes on unhold after a restart, a destroy on the continue path, a watcher leak, and attempts appearing in conductor views.
• Round 2: nothing blocking. Its two small items are fixed: unhold reports an explicit outcome, and holdMaxMs is configurable.

Full suite: 3800 pass / 0 fail. Web typecheck and fleet tests pass.

For agents: implementation

• store.ts:
  • New dispatch_tasks columns run_id, attempt_id, generation INTEGER NOT NULL DEFAULT 0 and held_until, plus the idx_dispatch_run index.
  • The generation bumps on dispatchClaimNext and dispatchReclaimStale.
  • Complete, fail, mark-running and hold are guarded by generation = ? AND status IN ('claimed','running'); touch takes {id, generation}.
  • Hold, unhold, cancel and settleHeld are scoped by owner_daemon. Prior-boot holds and expired holds settle as reclaimed.
  • The conductor/board queries filter kind != 'attempt'.
• dispatch.ts:
  • Generation threading, with dispatch.stale_result audit.
  • Optional host hooks: spawnAttemptWorker, continueAttempt, onAttemptSettled, onAttemptWaiting, onAttemptOrphanWorker.
  • hold, unhold (returns UnholdOutcome) and cancel.
  • The late-start fresh flag.
• config.ts: dispatch.holdMaxMs, also in the settings manifest.
• Protocol FleetTaskWire: the attempt kind, held status, runId/attemptId.
• Web: fleet-lanes.ts (held maps to awaiting, with an assertNever), attention.ts, and SessionListPane.
• Tests: src/tests/dispatch-generations.test.ts, 40+ cases.

🤖 Generated with Claude Code