feat: fence stale dispatch results with generations, and prepare the queue for loop attempts

packages/protocol/src/types.ts

@@ -2346,9 +2346,14 @@ export interface CollaborationPanelsResultMsg {
  */
 export interface FleetTaskWire {
   id: string;
-  kind: "send" | "spawn";
+  /** `attempt` = one attempt of a loop run (docs/loop-engineering-design.md §5). */
+  kind: "send" | "spawn" | "attempt";
   shape: "ship" | "scout";
-  status: "queued" | "claimed" | "running" | "done" | "failed" | "blocked";
+  /**
+   * `held` is non-terminal: the task is parked on something outside its worker
+   * (an approval a loop's profile does not cover) and is never reclaimed.
+   */
+  status: "queued" | "claimed" | "running" | "held" | "done" | "failed" | "blocked";
   attempts: number;
   /** Epoch ms. */
   createdAt: number;
@@ -2363,6 +2368,9 @@ export interface FleetTaskWire {
   createdBy: string;
   /** Dispatch group (fan-out barrier); absent = a standalone task. */
   groupId?: string;
+  /** attempt: the loop run and attempt this task executes. Absent on send/spawn. */
+  runId?: string;
+  attemptId?: string;
   /**
    * RESERVED and never populated in P5. The daemon has no dependency model —
    * the conductor sequences in prose. Present so typed fan-in/join edges are a
@@ -2384,7 +2392,7 @@ export interface FleetEventWire {
 
 /** Fleet-wide rollup, normalized across backends so one number spans vendors. */
 export interface FleetUsage {
-  /** Tasks not yet terminal (queued + claimed + running). */
+  /** Tasks not yet terminal (queued + claimed + running + held). */
   activeTasks: number;
   /** Tasks in `blocked` — the anti-spin failure cap tripped; needs a human. */
   blockedTasks: number;

src/config.ts

@@ -608,6 +608,12 @@ const DispatchSchema = z
     workerToolBudget: z.number().int().min(1).default(50),
     /** Base retry backoff (ms) for retryable failures — doubles per attempt, capped at leaseMs. */
     retryBaseMs: z.number().int().min(0).default(15_000),
+    /**
+     * Longest a loop attempt may stay `held` on an approval (ms). A held attempt
+     * keeps its worker session and occupies a `maxConcurrentWorkers` slot, so
+     * past this the hold lapses and the attempt settles as reclaimed.
+     */
+    holdMaxMs: z.number().int().min(60_000).default(2 * 60 * 60_000),
   })
   .default({
     enabled: true,
@@ -617,6 +623,7 @@ const DispatchSchema = z
     maxConcurrentWorkers: 2,
     workerToolBudget: 50,
     retryBaseMs: 15_000,
+    holdMaxMs: 2 * 60 * 60_000,
   });
 
 /**
@@ -1348,6 +1355,8 @@ export interface CodeoidConfig {
     maxConcurrentWorkers: number;
     workerToolBudget: number;
     retryBaseMs: number;
+    /** Longest a loop attempt may stay held (ms). Optional for hand-built configs; default 2h. */
+    holdMaxMs?: number;
   };
   /**
    * Collaborative-session bounds (see CollaborationSchema). Optional in the