atris 3.74.28 → 3.75.0

package/lib/fleet.js

@@ -33,7 +33,7 @@ const {
   buildOneLapValidatorPrompt,
   parseOneLapValidatorVerdict,
 } = require('./one-lap-validator');
-const { listWorktrees, defaultMainlineBase, gitFailureDetail, gitNetworkEnvironment } = require('../commands/worktree');
+const { listWorktrees, defaultMainlineBase, gitFailureDetail, gitNetworkEnvironment, lowDiskRefusal } = require('../commands/worktree');
 const { isConductorStatusLine } = require('./conductor-artifacts');
 const { matchLessons } = require('./lesson-preflight');
 const { sleepSync } = require('./sleep-sync');
@@ -44,7 +44,7 @@ const { buildVerifiedScoutPack, appendVerifiedScoutPack } = require('./dispatch-
 const { runPrepPass, withPrepBrief, prepRecordFields } = require('./roster-prep');
 const { mapNotesPath } = require('./map-refs');
 const { SHARED_BRIEF_RULES } = require('./brief-rules');
-const { PROOF_NOT_SAVED } = require('./release-kind');
+const { PROOF_NOT_SAVED, COULD_NOT_START } = require('./release-kind');
 const {
   applySecretGrantEnvironment,
   buildGatewaySupervisorScript,
@@ -53,18 +53,27 @@ const {
 } = require('./secret-gateway');
 const { appendEngineLiveLogChunk, createEngineLiveLog, engineTerminalReason } = require('./engine-job-lifecycle');
 const { recordEngineResource } = require('./engine-resource');
+const {
+  taskTagTokens,
+  isDecisionHoldTag,
+  isDecisionTask,
+  DECISION_REFUSE_REASON,
+} = require('./task-decision');
 
 // Lanes a fleet may never staff on its own: the human keeps irreversible
 // calls. Mirrors the autoland denied lanes.
 const DENIED_TAGS = ['billing', 'money', 'payments', 'deploy', 'security', 'customer', 'external', 'feedback'];
 
-// The protected lane a task sits in (a denied tag on the task or its todo
-// tags), or null. The ship gate and the dispatch flight both ask this, so they
-// cannot disagree about which work a person must land.
+// The protected lane a task sits in, or null. This is the one place that
+// decides protection: staffing (isSafeLane), the ship gate, the dispatch flight
+// and the builder prompt all ask it, so a task one of them holds back as
+// protected is never one that another would merge. A task's tags are its tag,
+// its tags list, the tags `atris task tag` adds later and hashtags in its
+// title (all through taskTagTokens), plus the todo tags it was imported with.
 function protectedLaneOfTask(task) {
   if (!task || typeof task !== 'object') return null;
   const todoTags = task.metadata && Array.isArray(task.metadata.todo_tags) ? task.metadata.todo_tags : [];
-  const tags = [task.tag, ...todoTags].filter(Boolean).map((tag) => String(tag).toLowerCase());
+  const tags = [...taskTagTokens(task), ...todoTags.filter(Boolean).map((tag) => String(tag).trim().toLowerCase())];
   return tags.find((tag) => DENIED_TAGS.includes(tag)) || null;
 }
 
@@ -126,7 +135,8 @@ function shellQuote(value) {
 
 // The bounded prompt every engine gets: isolated worktree, MAP first, the
 // task's own check, one landing order per mode. Yolo: the engine lands it
-// itself with worktree ship. Otherwise: commit only, the conductor lands it.
+// itself with worktree ship, unless the task is in a protected lane. Otherwise:
+// commit only, the conductor lands it.
 function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
   const ref = task.display_id || task.id || 'TASK';
   const title = String(task.title || '').trim();
@@ -134,11 +144,27 @@ function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
   const done = titleDone || String((task.metadata && task.metadata.done_looks_like) || '').trim();
   const check = taskDispatchCheck(task, worktreePath || process.cwd());
   const shipMessage = title.split(/[.:](?:\s|$)/)[0].replace(/"/g, "'").slice(0, 90) || ref;
-  const commitRule = yolo
-    ? `Land it yourself. Commit on the current branch with a plain-English message, then run: atris worktree ship --message "${shipMessage} (${ref})" --verify ${shellQuote(check)} --merge, and report the PR URL. That ship command is the only push allowed. If it reports a conflict or a failed check, stop and report; never resolve conflicts yourself.`
-    : 'Commit on the current branch with a clear message. Do not push and do not create branches; the conductor lands your commit.';
+  // A protected-lane task is never shipped by its builder, yolo or not. The
+  // builder commits and stops, and the dispatch flight ships that commit once,
+  // without --merge, so a pull request opens and a person lands it. A builder
+  // that shipped too would open the pull request before the flight's own
+  // check, and if the flight's check or ship then failed, the claim would be
+  // released with that pull request open and unrecorded. Yolo still gives the
+  // builder its network for running checks.
+  const lane = yolo ? protectedLaneOfTask(task) : null;
+  let commitRule;
+  if (lane) {
+    commitRule = `This task is in the protected ${lane} lane, so a person lands it, not you. Commit on the current branch with a plain-English message. Do not push, do not run \`atris worktree ship\`, and do not create branches; the conductor ships your commit for a person to review.`;
+  } else if (yolo) {
+    commitRule = `Land it yourself. Commit on the current branch with a plain-English message, then run: atris worktree ship --message "${shipMessage} (${ref})" --verify ${shellQuote(check)} --merge, and report the PR URL. That ship command is the only push allowed. If it reports a conflict or a failed check, stop and report; never resolve conflicts yourself.`;
+  } else {
+    commitRule = 'Commit on the current branch with a clear message. Do not push and do not create branches; the conductor lands your commit.';
+  }
+  // The guard refuses a checkout that has edits in it, so it can only pass at
+  // the start. A builder that re-ran it in its review step, after its edits,
+  // took the failure as a stop order and left finished work uncommitted.
   const lines = [
-    'First, run `atris worktree guard`; if it fails, stop immediately, report back, and do not edit anything. Do this before any file edit.',
+    'Before your first edit, run `atris worktree guard` once; if it fails then, stop immediately, report back, and do not edit anything. It checks for a clean start, so it fails once edits exist: never run it again after editing.',
     '',
     ATRIS_BUILD_PROCESS_PREAMBLE,
     '',
@@ -162,7 +188,7 @@ function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
     `- ${commitRule}`,
     ...METHOD_KERNEL.map((rule) => `- ${rule}`),
     '',
-    `Final report (plain text): files changed, check command + result, commit sha${yolo ? ', PR URL' : ''} (or say what failed and why).`
+    `Final report (plain text): files changed, check command + result, commit sha${yolo && !lane ? ', PR URL' : ''} (or say what failed and why).`
   );
   const lessonFiles = [
     ...(Array.isArray(task.files) ? task.files : []),
@@ -926,10 +952,18 @@ async function dispatchEntryWithRestaff({
   defaultPin = null,
   job = 'build',
   prepAsk = undefined,
+  beforeEngine = null,
 }) {
   const attempts = [];
-  const result = await dispatchEntryAttempts({ entry, engine, root, dispatch, installedEngines, restaffState, scoutAsk, clock, defaultPin, attempts, job, prepAsk });
-  return { ...result, attempts };
+  try {
+    const result = await dispatchEntryAttempts({ entry, engine, root, dispatch, installedEngines, restaffState, scoutAsk, clock, defaultPin, attempts, job, prepAsk, beforeEngine });
+    return { ...result, attempts };
+  } catch (err) {
+    // One job's attempt blowing up (a retry brief that cannot be written, a store that throws) is that job's
+    // trouble. It comes back as a job whose attempt failed, for the flight to let its claim go where it failed,
+    // and the run goes on to its cleanup instead of ending with the other jobs' claims still held.
+    return { not_started: 'dispatch', detail: String(err && err.message || err), attempts };
+  }
 }
 
 // One prep pass per prep job per task: a backup whose line asks for the same
@@ -968,6 +1002,10 @@ async function dispatchEntryAttempts({
   attempts = [],
   job = 'build',
   prepAsk = undefined,
+  // Called right before an engine is asked, every time one is: the assigned engine, a retry on another engine
+  // after a dead one, a handover to the next worker (all after any scout, prep, and brief), so the flight can
+  // check it still holds the claim and mark it started. If it throws, that engine is not asked.
+  beforeEngine = null,
 }) {
   const basePrompt = entry.prompt || buildFleetPrompt(entry.task, { worktreePath: entry.worktreePath, yolo: entry.yolo });
   const prepFor = prepPassCache({ entry, root, clock, prepAsk, job });
@@ -989,16 +1027,39 @@ async function dispatchEntryAttempts({
     // A worker whose roster line asks for prep gets its brief first.
     const prep = ranWith.prep ? await prepFor(ranWith.prep, scouted) : null;
     const prompt = withPrepBrief(scouted, prep);
-    const brief = captureDispatchBrief({
-      root,
-      task: entry.task,
-      engine: engineName,
-      worktreePath: entry.worktreePath,
-      prompt,
-      missionId: entry.mission_id || entry.missionId || '',
-      author: entry.author || '',
-      yolo: entry.yolo,
-    });
+    let brief;
+    try {
+      brief = captureDispatchBrief({
+        root,
+        task: entry.task,
+        engine: engineName,
+        worktreePath: entry.worktreePath,
+        prompt,
+        missionId: entry.mission_id || entry.missionId || '',
+        author: entry.author || '',
+        yolo: entry.yolo,
+      });
+    } catch (err) {
+      // Before any engine has run, a brief that cannot be written means the job never started: hand that
+      // back, so the flight pauses it and lets the claim go as one that could not start. After an engine has
+      // run, it fails the flight as it always did.
+      if (attempts.length) throw err;
+      return { not_started: 'brief_capture', detail: String(err && err.message || err) };
+    }
+    // An engine is about to be asked, the assigned one or a later one (a retry, a handover), and each start gets
+    // the same check on the claim as it stands now: a claim can be lost between one attempt and the next. A scout
+    // or prep pass before this point never counts as the build starting. A mark that cannot be saved means the
+    // start did not happen, so the job is handed back as not started and the engine is not asked. A mark refused
+    // because the flight no longer holds the claim (claimLost, see markClaimStarted) is handed back as such: the
+    // job is someone else's now. The mark of an attempt already made stands (marking twice adds nothing).
+    if (beforeEngine) {
+      try {
+        beforeEngine(entry);
+      } catch (err) {
+        if (err && err.claimLost) return { not_started: 'claim_lost', detail: String(err.message || err), ...(err.unnamed ? { unnamed: true } : {}) };
+        return { not_started: 'prepare', detail: String(err && err.message || err) };
+      }
+    }
     const startedMs = clock();
     let runResult;
     try {
@@ -1019,6 +1080,8 @@ async function dispatchEntryAttempts({
   };
 
   const first = await runOnce(engine);
+  // No engine was asked, so there is no engine health to record and no one to hand the job to.
+  if (first.not_started) return first;
   if (!first.max_seconds && entry.maxSeconds) first.max_seconds = entry.maxSeconds;
   const deadEngine = detectDeadEngineDispatch(first);
   recordDispatchEngineHealth(first, deadEngine, root);
@@ -1043,6 +1106,9 @@ async function dispatchEntryAttempts({
 
   restaffState.used = true;
   const fallbackResult = await runOnce(fallback);
+  // The start check refused the retry (the claim is not this run's any more): no engine was asked, so the job is
+  // handed back as not started, and there is no engine health to record.
+  if (fallbackResult.not_started) return fallbackResult;
   recordDispatchEngineHealth(fallbackResult, detectDeadEngineDispatch(fallbackResult), root);
   return {
     ...fallbackResult,
@@ -1103,6 +1169,9 @@ async function handOverStalledDispatch({ entry, engine, first, root, runOnce, jo
       prep: next.roster_prep || '',
     };
     const result = await runOnce(next.id, pin);
+    // The start check refused this handover (see dispatchEntryAttempts): no engine was asked, so the job is
+    // handed back as not started and no one else is tried.
+    if (result.not_started) return result;
     const dead = detectDeadEngineDispatch(result);
     recordDispatchEngineHealth(result, dead, root);
     last = result;
@@ -1358,20 +1427,6 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
 // ---------------------------------------------------------------------------
 // T2: staffing
 
-const {
-  taskTagTokens,
-  isDecisionHoldTag,
-  isDecisionTask,
-  DECISION_REFUSE_REASON,
-} = require('./task-decision');
-
-function taskTags(task) {
-  // Tags added after creation live in metadata.tags (`atris task tag`); a
-  // fleet that only read task.tags/title hashtags would ignore an owner-hold
-  // flag stamped on a live task and keep restaffing it (CLI-879).
-  return taskTagTokens(task);
-}
-
 // A task flagged for a human decision is never fleet-staffable, whatever its
 // lane. Mirrors the sweep's needs-human hold so both loops agree. Also honors
 // the clearer `decision` tag so policy questions stay off autonomous lanes.
@@ -1379,10 +1434,10 @@ function isHumanHoldTag(tag) {
   return isDecisionHoldTag(tag);
 }
 
+// The fleet may staff a task only when no person has to decide it and it sits
+// in no protected lane. Protection is protectedLaneOfTask's call alone.
 function isSafeLane(task) {
-  if (isDecisionTask(task)) return false;
-  const tags = taskTags(task);
-  return !tags.some((t) => DENIED_TAGS.includes(t));
+  return !isDecisionTask(task) && !protectedLaneOfTask(task);
 }
 
 // Rough file-surface guess from a task's text: paths and bare `commands/x.js`
@@ -1689,6 +1744,10 @@ module.exports = {
   shipPullRequest,
   DEAD_ENGINE_OUTPUT_PATTERNS,
   releasePausedClaimsWithoutWork,
+  dispatchEntryWithRestaff,
+  flightExitCode,
+  markClaimStarted,
+  releaseOwnClaim,
   reviewOnlyEngineEnvironment,
   runInReapedProcessGroup,
   shipWithRetry,
@@ -1713,12 +1772,10 @@ module.exports = {
   assertIsolatedWorktree,
   buildEngineCommand,
   isSafeLane,
-  taskTags,
   nextInstalledFleetEngine,
   rankFleetEnginesDetailed,
   dispatchToEngine,
   recordDispatchOutcome,
-  taskTags,
   isHumanHoldTag,
   isDecisionTask,
   DECISION_REFUSE_REASON,
@@ -3208,6 +3265,9 @@ async function runFleetFlight({
   scoutAsk = null,
   clock = Date.now,
   prepAsk = undefined,
+  // The disk check before anything is claimed (see lowDiskRefusal). Tests inject both.
+  freeSpace = undefined,
+  spaceGuard = undefined,
 } = {}) {
   const cli = ownCli || defaultOwnCli(root);
   const landTarget = resolveDispatchLandTarget(root, checkoutBase);
@@ -3257,6 +3317,12 @@ async function runFleetFlight({
     return flight;
   }
 
+  // One look at the disk before anything is claimed or written to any job, with worktree start's own
+  // check and reaping. Under its floor every start would refuse anyway, and each refused start used to
+  // let a claim go that the rating then scored as a drop.
+  const lowDisk = lowDiskRefusal({ root, agent: 'fleet', task: 'flight', freeSpace, spaceGuard });
+  if (lowDisk) return stopForLowDisk(flight, lowDisk, staffed.map((s) => ({ task: s.task.display_id, engine: s.engine })), log);
+
   const liveLogPath = startLiveFlight(root, receiptPath, flight);
 
   // Claim + cut a worktree per assignment, then dispatch all in parallel.
@@ -3291,8 +3357,25 @@ async function runFleetFlight({
   // jobs this flight claimed are in them, so a listed job it refused cannot be mistaken for one.
   const claimedRefs = new Map();
   const claimedActors = new Map();
+  // The claim this flight made on each job, remembered from the claim write itself (see claimJob).
+  const claims = claimLedger();
+  // A claim let go before the engine ran is recorded in this process, on the claim this flight made, as one
+  // that could not start. Any other claim the flight lets go (the engine was asked) is an ordinary release.
+  const letGoUnstarted = ({ ref, actor, reason }) => releaseOwnClaim({ taskDb: leaseDb, db: leaseConnection, root, ref, actor, reason, claimEventId: claims.eventId(ref), neverStarted: true });
+  const letGoAsked = ({ ref, actor, reason }) => releaseOwnClaim({ taskDb: leaseDb, db: leaseConnection, root, ref, actor, reason, claimEventId: claims.eventId(ref) });
+  // The start-failure releases the store failed, for the closing pass to try again (see releaseUnstartedDispatchClaim).
+  const releaseFailures = new Map();
+  // Right before the assigned engine is asked, the claim is marked started.
+  const markStarted = (entry) => markClaimStarted({
+    taskDb: leaseDb,
+    db: leaseConnection,
+    claims,
+    ref: claimedRefs.get(String(entry.task.display_id)) || entry.task.display_id,
+    actor: claimedActors.get(String(entry.task.display_id)) || `fleet-${entry.engine}`,
+    task: entry.task.display_id,
+  });
   const leaseTimer = setInterval(() => {
-    for (const [id, holder] of leased) leaseDb.renewLease(leaseConnection, { id, holder, pid: process.pid });
+    for (const [id, holder] of leased) leaseDb.renewLease(leaseConnection, { id, holder, pid: process.pid, claimEventId: claims.eventId(id) });
   }, 5 * 60000);
   leaseTimer.unref();
   try {
@@ -3308,7 +3391,7 @@ async function runFleetFlight({
     // The row the list named is the row this claims, leases, proves and lets go of: named once,
     // by its row id, at every step (see jobRef).
     const rowRef = jobRef(entry.task, entry.task.display_id);
-    const claimed = cli(['task', 'claim', rowRef, '--as', `fleet-${entry.engine}`, '--lease-minutes', '60', '--lease-pid', String(process.pid)]);
+    const claimed = claimJob({ cli, taskDb: leaseDb, db: leaseConnection, root, ref: rowRef, actor: `fleet-${entry.engine}` });
     if (!claimed || claimed.status !== 0) {
       const detail = String(claimed && (claimed.stderr || claimed.stdout) || 'claim failed').trim().slice(0, 300);
       flight.paused.push({ task: entry.task.display_id, engine: entry.engine, stage: 'claim', detail });
@@ -3319,20 +3402,67 @@ async function runFleetFlight({
     const holder = `fleet-${entry.engine}`;
     claimedRefs.set(String(entry.task.display_id), rowRef);
     claimedActors.set(String(entry.task.display_id), holder);
-    const leaseSet = leaseDb.setLease(leaseConnection, { id: leaseId, holder });
-    if (!leaseSet && (!ownCli || leaseDb.getTask(leaseConnection, leaseId))) throw new Error('could not set claim lease');
-    if (leaseSet) leased.set(leaseId, holder);
-    const started = cli(['worktree', 'start', '--agent', entry.engine, '--task', `fleet-${String(entry.task.display_id).toLowerCase()}`, ...startBaseArgs]);
-    const wt = (started.stdout.match(/next: cd (.+)/) || [])[1];
-    if (!wt) {
-      flight.paused.push({ task: entry.task.display_id, stage: 'worktree_start', detail: started.stderr.slice(0, 200) });
-      continue;
+    claims.remember(rowRef, claimed.eventId);
+    // From here until the engine is asked, a job that cannot start is let go where it fails, as one that could
+    // not start, so a failure later in the flight cannot leave its claim to run out as a miss.
+    const cannotStart = (stage, detail) => {
+      const released = releaseUnstartedDispatchClaim(cli, { taskId: entry.task.display_id, ref: rowRef, actor: holder, detail, stage, release: letGoUnstarted, failures: releaseFailures, log });
+      flight.paused.push({ task: entry.task.display_id, engine: entry.engine, stage, detail, claim_released: released.released });
+    };
+    try {
+      const leaseSet = leaseDb.setLease(leaseConnection, { id: leaseId, holder, claimEventId: claims.eventId(leaseId) });
+      if (!leaseSet && (!ownCli || leaseDb.getTask(leaseConnection, leaseId))) throw new Error('could not set claim lease');
+      if (leaseSet) leased.set(leaseId, holder);
+      const started = cli(['worktree', 'start', '--agent', entry.engine, '--task', `fleet-${String(entry.task.display_id).toLowerCase()}`, ...startBaseArgs]);
+      const wt = (started.stdout.match(/next: cd (.+)/) || [])[1];
+      if (!wt) {
+        cannotStart('worktree_start', started.stderr.slice(0, 200));
+        continue;
+      }
+      prepared.push({ ...entry, worktreePath: wt.trim() });
+      log(`    ${entry.engine.padEnd(8)} building ${entry.task.display_id} in ${path.basename(wt.trim())}`);
+    } catch (err) {
+      cannotStart('prepare', String(err && err.message || err).slice(0, 200));
+      log(`    ${entry.engine.padEnd(8)} ✗ ${entry.task.display_id} prepare failed`);
     }
-    prepared.push({ ...entry, worktreePath: wt.trim() });
-    log(`    ${entry.engine.padEnd(8)} building ${entry.task.display_id} in ${path.basename(wt.trim())}`);
   }
 
-  const results = await Promise.all(prepared.map((entry) =>
+  // A job that never reached its engine (its brief could not be written, or its start could not be marked)
+  // pauses and its claim goes back as one that could not start, here, where it failed, while the flight's
+  // other jobs go on. The jobs that did start carry on.
+  const letGoNotStarted = (entry, result) => {
+    const taskLabel = entry.task.display_id;
+    const stage = result.not_started;
+    const ref = claimedRefs.get(String(taskLabel)) || taskLabel;
+    if (stage === 'claim_lost') {
+      // The job is another run's now (see markClaimStarted). The flight lets go of nothing, writes nothing to it, and
+      // stops renewing a lease on it.
+      leased.delete(ref);
+      flight.paused.push({ task: taskLabel, engine: entry.engine, stage, detail: result.unnamed ? UNNAMED_CLAIM_DETAIL : LOST_CLAIM_DETAIL, worktree: entry.worktreePath, claim_released: false });
+      log(result.unnamed ? unnamedClaimLine(taskLabel) : claimLostLine(taskLabel));
+      return;
+    }
+    // Nothing in here may end the run: the other jobs still have their cleanup to come.
+    let detail = result.detail;
+    let released = false;
+    try {
+      ({ released, detail } = releaseUnstartedDispatchClaim(cli, {
+        taskId: taskLabel,
+        ref,
+        actor: claimedActors.get(String(taskLabel)) || `fleet-${entry.engine}`,
+        detail: result.detail,
+        stage,
+        release: letGoUnstarted,
+        failures: releaseFailures,
+        log,
+      }));
+    } catch (err) {
+      detail = `${String(result.detail || '').slice(0, 120)}. claim release failed: ${String(err && err.message || err).slice(0, 80)}`;
+    }
+    flight.paused.push({ task: taskLabel, engine: entry.engine, stage, detail, worktree: entry.worktreePath, claim_released: released });
+    log(`    ${entry.engine.padEnd(8)} ✗ ${taskLabel} ${NOT_STARTED_WORDS[stage] || 'prepare'} failed`);
+  };
+  const settled = await Promise.all(prepared.map((entry) =>
     dispatchEntryWithRestaff({
       entry,
       engine: entry.engine,
@@ -3344,8 +3474,13 @@ async function runFleetFlight({
       clock,
       defaultPin: fleetPrepPin(entry.engine, root),
       prepAsk,
-    }).then((result) => ({ entry, result }))
+      beforeEngine: markStarted,
+    }).then((result) => {
+      if (result.not_started) letGoNotStarted(entry, result);
+      return { entry, result };
+    })
   ));
+  const results = settled.filter(({ result }) => !result.not_started);
   flight.results = results.map(({ entry, result }) => {
     const row = { task: entry.task.display_id, engine: result.engine || entry.engine, exitCode: result.exitCode };
     if (result.brief_id) row.brief_id = result.brief_id;
@@ -3438,6 +3573,8 @@ async function runFleetFlight({
     refByTask: claimedRefs,
     baseRef: landTarget,
     log,
+    release: letGoAsked,
+    failures: releaseFailures,
   });
 
   recordFlightRosterRuns(root, flight, results, { job: 'build', source: 'fleet' });
@@ -3452,7 +3589,7 @@ async function runFleetFlight({
     clearInterval(leaseTimer);
     for (const [id, holder] of leased) {
       const row = leaseDb.getTask(leaseConnection, id);
-      if (row && row.status !== 'claimed') leaseDb.clearLease(leaseConnection, { id, holder });
+      if (row && row.status !== 'claimed') leaseDb.clearLease(leaseConnection, { id, holder, claimEventId: claims.eventId(id) });
     }
   }
 }
@@ -3472,7 +3609,7 @@ function releaseReason(lead, detail) {
 }
 
 // Pauses where the engine never got to finish its turn.
-const ENGINE_DID_NOT_FINISH = new Set(['worktree_start', 'remote_quarantine', 'prepare', 'build']);
+const ENGINE_DID_NOT_FINISH = new Set(['worktree_start', 'remote_quarantine', 'prepare', 'brief_capture', 'build']);
 
 // The word a flight uses to name a job to the task command at every step: its row id when the
 // task command (or the task list) gave one, else the display id the flight has. The display id a
@@ -3496,17 +3633,225 @@ function jobOutsideWorkspace(taskDb, task, workspace) {
 
 const namesAnotherWorkspace = (displayId) => `${displayId} names a job in another workspace`;
 
+// What a flight does when the disk is under worktree start's floor. It has claimed nothing and written
+// nothing to any job, so it says why in one plain line (the free space and the floor, in worktree start's
+// own words) and hands back a failed flight that names the refusal. flightExitCode turns that into the
+// exit code worktree start itself gives. jobs are the rows the flight would have worked on.
+function stopForLowDisk(flight, refusal, jobs, log) {
+  log(`  refusing: ${refusal.message}`);
+  flight.refusal = { reason: 'low_disk', detail: refusal.message, free_bytes: refusal.free, needs_bytes: refusal.needs };
+  flight.paused = jobs.map((job) => ({ ...job, stage: 'low_disk', detail: refusal.message }));
+  flight.status = 'failed';
+  flight.finished_at = new Date().toISOString();
+  return flight;
+}
+
+// The exit code for a finished flight: 2 when it stopped on a low disk, as worktree start does, else 1
+// when any job paused, else 0.
+function flightExitCode(flight) {
+  if (flight && flight.refusal && flight.refusal.reason === 'low_disk') return 2;
+  return flight && flight.paused && flight.paused.length > 0 ? 1 : 0;
+}
+
+// The two files people read, drawn again from the saved state the way the task command does after
+// every release and every claim: the task list file, and atris/TODO.md of the flight's own workspace.
+// The write is already saved, so a file that cannot be written does not undo it, and one failing does
+// not stop the other. The task command is loaded only here: this file is read on every start, and only
+// the paths that write to a job need it.
+function redrawTaskFiles({ taskDb, db, root }) {
+  for (const [what, refresh] of [
+    ['task list file', () => require('../commands/task').writeDefaultProjection(taskDb, db, { root })],
+    ['TODO.md', () => require('../commands/task').autoRenderTodoFromDb(taskDb.workspaceRoot(root))],
+  ]) {
+    try { refresh(); } catch (err) {
+      if (process.env.ATRIS_DEBUG) process.stderr.write(`${what} refresh failed: ${String(err?.message ?? err).replace(/[\r\n]+/g, ' ')}\n`);
+    }
+  }
+}
+
+// Which claim this flight made on each job, by the row id it claimed. A mark or a release checks the job is
+// still held under that claim before it writes anything: another run can take a job over under the same
+// builder name (a lease that ran out, then a second flight), and a late release from this flight must not
+// land on, or stamp, a claim that belongs to someone else. The name of the claim comes from the claim write
+// itself (see claimJob) and is remembered the moment it is made; it is never looked up afterwards, because
+// a look-up cannot tell this flight's claim from one made just after it. A job claimed through the task
+// command (a stand-in task plane, a job shown with no row id) has no name to remember.
+function claimLedger() {
+  const made = new Map();
+  return {
+    remember(ref, eventId) {
+      if (ref && eventId) made.set(String(ref), String(eventId));
+    },
+    // The event that is this flight's claim on the job, or '' when none was remembered.
+    eventId(ref) {
+      return made.get(String(ref)) || '';
+    },
+  };
+}
+
+// True when the task store holds a row under this name. It decides whether a flight may act on a job without a
+// claim to name, so a store that cannot be read counts as holding it: doubt means it may not.
+function storeHoldsJob(taskDb, db, ref) {
+  if (!ref) return false;
+  try {
+    return Boolean(taskDb.getTask(db, ref));
+  } catch {
+    return true;
+  }
+}
+
+// How a flight claims a job. A job the task store holds a row for is claimed in the flight's own process,
+// through the store it already holds for leases, and the claim's name (its claimed event) comes from the claim
+// write itself: claimTask saves the row and the event in one transaction and answers with the event, so there is
+// no moment in which the flight has claimed a job but cannot say which claim is its own. What the task command
+// did besides the write stays: the check on the actor's name, the plain failure text, the two files people
+// read drawn again (see redrawTaskFiles), and the clearing of the claims that have run out, which every task
+// command begins with, so a job whose old claim is dead is cleared and claimed in one go. A job the store holds
+// no row for (a stand-in task plane, a job shown with no row id) has no claim to name and is claimed through the
+// task command, as it always was.
+//
+// It answers like the task command (status 0, or status 1 and why), with eventId when it claimed in process. A
+// claim that landed but came back with no name is refused: the flight cannot tell later whether the job is
+// still its own, so it builds nothing on it and leaves it alone.
+function claimJob({ cli, taskDb, db, root, ref, actor, minutes = 60 }) {
+  if (!storeHoldsJob(taskDb, db, ref)) {
+    return cli(['task', 'claim', ref, '--as', actor, '--lease-minutes', String(minutes), '--lease-pid', String(process.pid)]);
+  }
+  const check = require('./review-integrity').validateActor(actor, { root });
+  if (!check.ok) {
+    return {
+      status: 1,
+      stdout: '',
+      stderr: check.reason === 'reserved_actor'
+        ? `atris task claim: reserved_actor: '${actor}' is a system actor and cannot be used with --as`
+        : `atris task claim: actor_not_on_roster: '${actor}' is not a workspace member or engine (actor validation is enforced)`,
+    };
+  }
+  // The step the task command takes first, with its reach (every claim in the store that has run out) and the
+  // history it writes (a claim_expired entry for each), because it is the command's own function. It never throws.
+  taskDb.sweepExpiredLeases();
+  let result;
+  try {
+    result = taskDb.claimTask(db, { id: ref, claimedBy: actor, leaseMinutes: minutes, leasePid: process.pid });
+  } catch (err) {
+    return { status: 1, stdout: '', stderr: `claim failed: ${String(err?.message ?? err).trim() || 'unknown'}` };
+  }
+  if (!result.claimed) {
+    return { status: 1, stdout: '', stderr: `claim failed: ${result.reason}${result.claimed_by ? ` (held by ${result.claimed_by})` : ''}` };
+  }
+  redrawTaskFiles({ taskDb, db, root });
+  const eventId = result.event && result.event.event_id;
+  if (!eventId) return { status: 1, stdout: '', stderr: UNNAMED_CLAIM_DETAIL, unnamed: true };
+  return { status: 0, stdout: `claimed ${ref} as ${actor}`, stderr: '', eventId };
+}
+
+// The one plain line for a job another run has claimed since this flight made its own claim.
+const claimTakenOverLine = (task) => `    left ${task} alone: another run claimed it after this one did`;
+
+// The one plain line for a job whose claim this flight no longer holds when it is about to ask the engine.
+const LOST_CLAIM_DETAIL = 'this run no longer holds the claim, so the engine was not started and the job was left alone';
+const claimLostLine = (task) => `    ${task}: ${LOST_CLAIM_DETAIL}`;
+
+// The one plain line for a job the flight has claimed but cannot name the claim of: it cannot tell whether the job
+// is still its own, so it writes nothing to it, releases nothing, and starts no engine on it.
+const UNNAMED_CLAIM_DETAIL = 'this run has no record of which claim is its own, so the job was left alone';
+const unnamedClaimLine = (task) => `    ${task}: ${UNNAMED_CLAIM_DETAIL}`;
+
+// What a flight calls the step a job failed at, in the one line it logs when it lets that job's claim go.
+const NOT_STARTED_WORDS = { brief_capture: 'brief capture', dispatch: 'attempt', prepare: 'prepare' };
+
+// Right before an engine is asked, the first or a later one (a retry, a handover), the flight marks the claim it
+// made as started (see markBuildStarted in task-db.js). That is what keeps the could-not-start kind honest: the
+// store and the rating take it only for a claim with no mark. A job the store does not hold under this holder (a
+// stand-in task plane) has no claim to mark and goes on. A mark refused for a claim the flight remembered means
+// the claim is not the flight's any more (it was let go, or taken over, even by a run of the same name): the
+// engine is not asked, and the error says so (claimLost) for the flight to stop on, writing nothing more. A job
+// the store holds that the flight has no name for the claim of stops the same way (claimLost and unnamed).
+// A mark that cannot be saved throws like any store trouble, and the engine is not asked either.
+function markClaimStarted({ taskDb, db, claims, ref, actor, task }) {
+  const claimEventId = claims.eventId(ref);
+  if (!claimEventId && storeHoldsJob(taskDb, db, ref)) {
+    // A job the store holds is claimed in process, so a flight with no name for its claim cannot say the job is
+    // still its own: the engine is not asked, and nothing is written.
+    const unnamed = new Error(`${task}: ${UNNAMED_CLAIM_DETAIL}`);
+    unnamed.claimLost = true;
+    unnamed.unnamed = true;
+    throw unnamed;
+  }
+  const result = taskDb.markBuildStarted(db, { id: ref, actor, claimEventId });
+  if (!result.marked && claimEventId) {
+    const lost = new Error(`the claim on ${task} is no longer this run's (${result.reason})`);
+    lost.claimLost = true;
+    throw lost;
+  }
+  return result;
+}
+
+// A flight lets go of a claim in its own process, on the exact claim it made, through the task store it already
+// holds for leases. ref is the row id the claim named and claimEventId the claim event the flight remembered
+// (see claimLedger): the store lets go only if the job is still held under that claim, in the same write, so a
+// job another run took over since, even under the same builder name and in the same millisecond, is never
+// released by a late call of this flight's. `atris task release` takes no kind and no claim, because any worker
+// holding a failed job could pass one to excuse its own miss; only the flights say these things, here.
+//
+// neverStarted asks for the could-not-start kind (lib/release-kind.js): the build machine could not start the
+// job, so it is nobody's miss. The store keeps that honest: it drops the kind from a claim marked started (see
+// markClaimStarted), and the release then goes through as an ordinary one, so a claim is never left held.
+//
+// It answers like the task command (status 0, or status 1 and why), with a word more: not_ours when the job is
+// not held under the flight's claim any more (nothing was written, nothing is retried, and the caller says so),
+// final when it is already let go or gone, retryable when the store failed (the closing pass tries once more),
+// unnamed when the store holds the job but the flight has no name for its claim (nothing is written and nothing
+// is retried: a release that names no claim could land on anyone's, so the job is left alone and the caller says
+// so). Null only when the store holds no row for the job (a job shown with no row id, a stand-in task plane): the
+// caller then lets it go through the task command, as a plain release, the way it always did.
+function releaseOwnClaim({ taskDb, db, root, ref, actor, reason, claimEventId = '', neverStarted = false }) {
+  if (!claimEventId) {
+    return storeHoldsJob(taskDb, db, ref) ? { status: 1, stdout: '', stderr: UNNAMED_CLAIM_DETAIL, unnamed: true } : null;
+  }
+  let result;
+  try {
+    result = taskDb.releaseTask(db, { id: ref, actor, reason, claimEventId, ...(neverStarted ? { kind: COULD_NOT_START } : {}) });
+  } catch (err) {
+    return { status: 1, stdout: '', stderr: String(err?.message ?? err).trim() || 'unknown', retryable: true };
+  }
+  if (!result.released) {
+    const stderr = `release failed: ${result.reason}${result.claimed_by ? ` (held by ${result.claimed_by})` : ''}`;
+    if (result.reason === 'claim_changed' || result.reason === 'held_by_other') return { status: 1, stdout: '', stderr, not_ours: true };
+    if (result.reason === 'not_found' || String(result.reason).startsWith('already_')) return { status: 1, stdout: '', stderr, final: true };
+    return { status: 1, stdout: '', stderr, retryable: true };
+  }
+  redrawTaskFiles({ taskDb, db, root });
+  return { status: 0, stdout: 'released', stderr: '' };
+}
+
 // A claim taken before the engine starts must not stay held if the flight
 // refuses or errors first. Release through the same task plane the claim used,
-// naming the job by ref: the row id the claim named.
-function releaseUnstartedDispatchClaim(cli, { taskId, ref = taskId, actor, detail, stage }) {
-  const released = cli(['task', 'release', ref, '--as', actor, '--reason', releaseReason(`paused at ${pausedStageLabel(stage)}`, detail)]);
+// naming the job by ref: the row id the claim named. release, when a flight gives
+// one, lets it go in process as a job that could not start (see releaseOwnClaim); it
+// answers null for a claim it cannot record, and the task plane lets that go. A
+// claim another run has taken over since is left alone, with one plain line. A
+// release the store failed (retryable) is noted in failures, by the job's name, for the
+// closing pass to try again.
+function releaseUnstartedDispatchClaim(cli, { taskId, ref = taskId, actor, detail, stage, release = null, failures = null, log = () => {} }) {
+  const reason = releaseReason(`paused at ${pausedStageLabel(stage)}`, detail);
+  const released = (release && release({ ref, actor, reason })) || cli(['task', 'release', ref, '--as', actor, '--reason', reason]);
   const releasedOk = Boolean(released && released.status === 0);
+  const notOurs = Boolean(released && released.not_ours);
+  const unnamed = Boolean(released && released.unnamed);
+  if (notOurs) log(claimTakenOverLine(taskId));
+  if (unnamed) log(unnamedClaimLine(taskId));
   const suffix = releasedOk
     ? 'claim released, safe to retry'
-    : `claim release failed: ${String(released && (released.stderr || released.stdout) || 'unknown').trim().slice(0, 80)}`;
+    : notOurs
+      ? 'claim left alone, another run claimed it after this one did'
+      : unnamed
+        ? 'claim left alone, this run has no record of which claim is its own'
+        : `claim release failed: ${String(released && (released.stderr || released.stdout) || 'unknown').trim().slice(0, 80)}`;
   const base = String(detail || '').trim().slice(0, 200);
-  return { released: releasedOk, detail: base ? `${base}. ${suffix}` : suffix };
+  const text = base ? `${base}. ${suffix}` : suffix;
+  if (failures && released && released.retryable) failures.set(String(taskId), { ref, actor, reason, base, detail: text, release });
+  return { released: releasedOk, detail: text };
 }
 
 // A pause with no work must not keep the task. On 2026-08-21, 49 bug tasks sat
@@ -3524,14 +3869,44 @@ function releaseUnstartedDispatchClaim(cli, { taskId, ref = taskId, actor, detai
 // refByTask names each claimed job by the row id the flight claimed it with, so the release
 // lands on that row even if the display id a person reads now means another job. A job with
 // no entry there is named by the display id in its pause row.
-function releasePausedClaimsWithoutWork(cli, { paused, worktreeByTask, actorByTask, refByTask = new Map(), baseRef = '', log = () => {}, keepClaimsWithWork = true }) {
+//
+// release, when a flight gives one, lets a claim go in the flight's own process, on the exact claim it
+// made (see releaseOwnClaim); a job it answers null for is let go through the task command. A job another
+// run has claimed since is left alone, with one plain line, and its row says the claim was not released.
+// A release the store failed is tried once more, and a claim that still cannot be let go says so in one
+// plain line.
+//
+// failures holds the start-failure releases that failed at the point of failure (see
+// releaseUnstartedDispatchClaim): a row that says its claim was not released, with an entry there, gets its
+// release tried again here, the way it was first tried.
+function releasePausedClaimsWithoutWork(cli, { paused, worktreeByTask, actorByTask, refByTask = new Map(), baseRef = '', log = () => {}, keepClaimsWithWork = true, release = null, failures = null }) {
+  const letGo = (how, { ref, actor, reason }) => (how && how({ ref, actor, reason })) || cli(['task', 'release', ref, '--as', actor, '--reason', reason]);
+  const saysNo = (taskId, released) => log(`    could not release the claim on ${taskId}: ${String(released && (released.stderr || released.stdout) || 'unknown').replace(/\s+/g, ' ').trim().slice(0, 80)}. it stays until its lease runs out, unless the task record is repaired first.`);
   for (const row of paused || []) {
     // No claim (the job was never found, was refused as another workspace's, or the claim
-    // failed), work already landed, or work waiting on a pull request for a person (the flight
-    // let that claim go itself when saving its proof failed).
-    if (row.stage === 'claim' || row.stage === 'task_lookup' || row.stage === 'other_workspace' || row.landed === true || row.held_for_review === true) continue;
-    if (row.claim_released !== undefined) continue;
+    // failed), a claim the flight lost before its engine ran (it is the other run's now), work
+    // already landed, or work waiting on a pull request for a person (the flight let that claim go
+    // itself when saving its proof failed).
+    if (row.stage === 'claim' || row.stage === 'task_lookup' || row.stage === 'other_workspace' || row.stage === 'claim_lost' || row.landed === true || row.held_for_review === true) continue;
     const taskId = String(row.task || '');
+    const failed = row.claim_released === false && failures ? failures.get(taskId) : null;
+    if (failed) {
+      failures.delete(taskId);
+      const released = letGo(failed.release, failed);
+      if (released && released.status === 0) {
+        row.claim_released = true;
+        if (row.detail === failed.detail) row.detail = failed.base ? `${failed.base}. claim released, safe to retry` : 'claim released, safe to retry';
+        log(`    released claim on ${taskId} on a second try`);
+      } else if (released && released.not_ours) {
+        log(claimTakenOverLine(taskId));
+      } else if (released && released.unnamed) {
+        log(unnamedClaimLine(taskId));
+      } else if (!(released && released.final)) {
+        saysNo(taskId, released);
+      }
+      continue;
+    }
+    if (row.claim_released !== undefined) continue;
     const actor = actorByTask.get(taskId);
     if (!taskId || !actor) continue;
     const worktreePath = row.worktree || worktreeByTask.get(taskId) || '';
@@ -3543,9 +3918,19 @@ function releasePausedClaimsWithoutWork(cli, { paused, worktreeByTask, actorByTa
     const reason = noWork && !ENGINE_DID_NOT_FINISH.has(row.stage)
       ? 'engine produced no work'
       : releaseReason(`paused at ${pausedStageLabel(row.stage)}`, row.stage === 'build' ? row.reason || row.detail : row.detail || row.reason);
-    const released = cli(['task', 'release', refByTask.get(taskId) || taskId, '--as', actor, '--reason', reason]);
+    const ref = refByTask.get(taskId) || taskId;
+    let released = letGo(release, { ref, actor, reason });
+    if (released && released.retryable) released = letGo(release, { ref, actor, reason });
+    if (released && (released.not_ours || released.unnamed)) {
+      row.claim_released = false;
+      log(released.unnamed ? unnamedClaimLine(taskId) : claimTakenOverLine(taskId));
+      continue;
+    }
     row.claim_released = Boolean(released && released.status === 0);
-    if (!row.claim_released) continue;
+    if (!row.claim_released) {
+      if (released && released.retryable) saysNo(taskId, released);
+      continue;
+    }
     log(keepClaimsWithWork
       ? `    released claim on ${taskId} (engine produced no work)`
       : `    released claim on ${taskId} so a retry can pick it up${worktreePath ? `; any work stays in ${path.basename(worktreePath)}` : ''}`);
@@ -3572,14 +3957,26 @@ function releasePausedClaimsWithoutWork(cli, { paused, worktreeByTask, actorByTa
 // same ids, so it is never looked up again. With no row id there is nothing exact to
 // release, and nothing is.
 //
+// It also names the claim it made (claimEventId, see claimLedger). A job another run has claimed since is
+// left alone, with one plain line: the pull request is still open for a person, and the claim is not this
+// flight's to put the kind on. With no name for its claim, the flight cannot say the claim is its own, so it
+// writes nothing and says so in one plain line.
+//
 // Tried once: if the release fails too, the row says so.
-function releaseClaimOfUnsavedPullRequest({ taskDb, db, root, row, rowId, actor, log = () => {} }) {
+function releaseClaimOfUnsavedPullRequest({ taskDb, db, root, row, rowId, actor, log = () => {}, claimEventId = '' }) {
   const reason = releaseReason(`PR ${row.pull_request.url} is open but its proof could not be saved`, row.detail);
   let released = false;
+  let notOurs = false;
+  let unnamed = false;
   let failure = 'unknown';
   try {
     if (!rowId) {
       failure = 'the flight has no row id for it';
+    } else if (!claimEventId && storeHoldsJob(taskDb, db, rowId)) {
+      // The store holds the job and the flight has no name for its claim: a release that names no claim
+      // could land on anyone's, so the job is left alone. A row the store does not know goes on to the
+      // release below, which answers not_found, as it always did.
+      unnamed = true;
     } else {
       const result = taskDb.releaseTask(db, {
         id: rowId,
@@ -3587,9 +3984,11 @@ function releaseClaimOfUnsavedPullRequest({ taskDb, db, root, row, rowId, actor,
         reason,
         kind: PROOF_NOT_SAVED,
         pullRequest: row.pull_request,
+        claimEventId,
       });
       if (!result.released) {
         failure = `release failed: ${result.reason}${result.claimed_by ? ` (held by ${result.claimed_by})` : ''}`;
+        notOurs = result.reason === 'claim_changed' || result.reason === 'held_by_other';
       } else {
         released = true;
         // The two files people read are drawn again from the saved state, the way the
@@ -3614,7 +4013,11 @@ function releaseClaimOfUnsavedPullRequest({ taskDb, db, root, row, rowId, actor,
   row.claim_released = released;
   log(row.claim_released
     ? `    released the claim on ${row.task} with the pull request link as the reason`
-    : `    could not release the claim on ${row.task}: ${failure.replace(/\s+/g, ' ').trim().slice(0, 80)}. it stays until its lease runs out, unless the task record is repaired first.`);
+    : notOurs
+      ? claimTakenOverLine(row.task)
+      : unnamed
+        ? unnamedClaimLine(row.task)
+        : `    could not release the claim on ${row.task}: ${failure.replace(/\s+/g, ' ').trim().slice(0, 80)}. it stays until its lease runs out, unless the task record is repaired first.`);
   return row.claim_released;
 }
 
@@ -3688,6 +4091,9 @@ async function runDispatchFlight({
   // Extra house rules a caller appends to the builder's brief (atris idea
   // tick sends the four values and the no-force-push, no-hook-skip rules).
   brief = '',
+  // The disk check before anything is claimed (see lowDiskRefusal). Tests inject both.
+  freeSpace = undefined,
+  spaceGuard = undefined,
 } = {}) {
   if (!engine) throw new Error('runDispatchFlight: engine is required');
   if (!DISPATCH_CAPABLE.includes(engine)) {
@@ -3710,8 +4116,44 @@ async function runDispatchFlight({
   }
 
   const cli = ownCli || defaultOwnCli(root);
+  // One look at the disk before anything is claimed or written to any job, not even the sweep of expired
+  // claims below: worktree start's own check and reaping. Under its floor every start would refuse anyway,
+  // and each refused start used to let a claim go that the rating then scored as a drop. A sealed review-only
+  // flight builds in the temp folder, which that check leaves alone by default, so it is asked about that
+  // folder with the check on.
+  const sealedReview = reviewOnly && !dispatcher;
+  const lowDisk = lowDiskRefusal({
+    root,
+    agent: engine,
+    task: 'dispatch',
+    freeSpace,
+    spaceGuard: sealedReview ? (spaceGuard ?? true) : spaceGuard,
+    ...(sealedReview ? { target: os.tmpdir() } : {}),
+  });
+  if (lowDisk) {
+    return stopForLowDisk({
+      schema: 'atris.dispatch_receipt.v1',
+      at: new Date().toISOString(),
+      root,
+      engine,
+      tasks: ids,
+      results: [],
+      landed: [],
+      ready: [],
+      held_for_review: [],
+      paused: [],
+    }, lowDisk, ids.map((task) => ({ task })), log);
+  }
   const leaseDb = require('./task-db');
   const leaseConnection = leaseDb.open();
+  // The claim this flight made on each job, remembered from the claim write itself (see claimJob).
+  const claims = claimLedger();
+  // A claim let go before the engine ran is recorded in this process, on the claim this flight made, as one
+  // that could not start. Any other claim the flight lets go (the engine was asked) is an ordinary release.
+  const letGoUnstarted = ({ ref, actor, reason }) => releaseOwnClaim({ taskDb: leaseDb, db: leaseConnection, root, ref, actor, reason, claimEventId: claims.eventId(ref), neverStarted: true });
+  const letGoAsked = ({ ref, actor, reason }) => releaseOwnClaim({ taskDb: leaseDb, db: leaseConnection, root, ref, actor, reason, claimEventId: claims.eventId(ref) });
+  // The start-failure releases the store failed, for the closing pass to try again (see releaseUnstartedDispatchClaim).
+  const releaseFailures = new Map();
   // The workspace this flight works in, spelled the way the store spells it. It is read once, before
   // the flight writes anything into its folder.
   const workspace = leaseDb.workspaceRoot(root);
@@ -3764,8 +4206,17 @@ async function runDispatchFlight({
   // What each claimed job is called to the task command, by the id the caller gave. Only jobs this
   // flight claimed are in it.
   const claimedRefs = new Map();
+  // Right before the assigned engine is asked, the claim is marked started.
+  const markStarted = (entry) => markClaimStarted({
+    taskDb: leaseDb,
+    db: leaseConnection,
+    claims,
+    ref: claimedRefs.get(String(entry.taskId)) || entry.taskId,
+    actor: taskActor,
+    task: entry.taskId,
+  });
   const leaseTimer = setInterval(() => {
-    for (const id of leasedIds) leaseDb.renewLease(leaseConnection, { id, holder: taskActor, pid: process.pid });
+    for (const id of leasedIds) leaseDb.renewLease(leaseConnection, { id, holder: taskActor, pid: process.pid, claimEventId: claims.eventId(id) });
   }, 5 * 60000);
   leaseTimer.unref();
   try {
@@ -3789,17 +4240,18 @@ async function runDispatchFlight({
     // named once, by its row id, at every step (see jobRef). Log lines and the receipt keep saying
     // the display id.
     const rowRef = jobRef(task, taskId);
-    const claimed = cli(['task', 'claim', rowRef, '--as', taskActor, '--lease-minutes', '60', '--lease-pid', String(process.pid)]);
+    const claimed = claimJob({ cli, taskDb: leaseDb, db: leaseConnection, root, ref: rowRef, actor: taskActor });
     if (!claimed || claimed.status !== 0) {
       const detail = String(claimed && (claimed.stderr || claimed.stdout) || 'claim failed').trim().slice(0, 300);
       flight.paused.push({ task: taskId, stage: 'claim', detail });
-      log(`    x ${taskId} claim failed`);
+      log(claimed && claimed.unnamed ? unnamedClaimLine(taskId) : `    x ${taskId} claim failed`);
       continue;
     }
     claimedRefs.set(String(taskId), rowRef);
+    claims.remember(rowRef, claimed.eventId);
     try {
       const leaseId = rowRef;
-      const leased = leaseDb.setLease(leaseConnection, { id: leaseId, holder: taskActor });
+      const leased = leaseDb.setLease(leaseConnection, { id: leaseId, holder: taskActor, claimEventId: claims.eventId(leaseId) });
       if (!leased && (!ownCli || leaseDb.getTask(leaseConnection, leaseId))) throw new Error('could not set claim lease');
       if (leased) leasedIds.add(leaseId);
       let landingWorktreePath = '';
@@ -3820,6 +4272,9 @@ async function runDispatchFlight({
             actor: taskActor,
             stage: 'worktree_start',
             detail: String(started.stderr || '').slice(0, 200),
+            release: letGoUnstarted,
+            failures: releaseFailures,
+            log,
           });
           flight.paused.push({ task: taskId, stage: 'worktree_start', detail: released.detail, claim_released: released.released });
           log(`    ✗ ${taskId} worktree start failed`);
@@ -3834,6 +4289,9 @@ async function runDispatchFlight({
           actor: taskActor,
           stage: 'remote_quarantine',
           detail: headTail(String(remoteBoundary && remoteBoundary.detail || 'could not prepare a sealed review sandbox')),
+          release: letGoUnstarted,
+          failures: releaseFailures,
+          log,
         });
         flight.paused.push({
           task: taskId,
@@ -3879,6 +4337,9 @@ async function runDispatchFlight({
         actor: taskActor,
         stage: 'prepare',
         detail: String(err && err.message || err).slice(0, 200),
+        release: letGoUnstarted,
+        failures: releaseFailures,
+        log,
       });
       flight.paused.push({ task: taskId, stage: 'prepare', detail: released.detail, claim_released: released.released });
       log(`    ✗ ${taskId} prepare failed`);
@@ -3913,7 +4374,41 @@ async function runDispatchFlight({
     log(`  fable handoff started: receipt ${path.relative(root, receiptPath)}`);
   }
 
-  const results = await Promise.all(prepared.map((entry) => {
+  // A job that never reached its engine (its brief could not be written, or its start could not be marked)
+  // pauses and its claim goes back as one that could not start, here, where it failed, while the flight's
+  // other jobs go on. The jobs that did start carry on.
+  const letGoNotStarted = (entry, result) => {
+    const stage = result.not_started;
+    const ref = claimedRefs.get(String(entry.taskId)) || entry.taskId;
+    if (stage === 'claim_lost') {
+      // The job is another run's now (see markClaimStarted). The flight lets go of nothing, writes nothing to it, and
+      // stops renewing a lease on it.
+      leasedIds.delete(ref);
+      flight.paused.push({ task: entry.taskId, stage, detail: result.unnamed ? UNNAMED_CLAIM_DETAIL : LOST_CLAIM_DETAIL, worktree: entry.worktreePath, claim_released: false });
+      log(result.unnamed ? unnamedClaimLine(entry.taskId) : claimLostLine(entry.taskId));
+      return;
+    }
+    // Nothing in here may end the run: the other jobs still have their cleanup to come.
+    let detail = result.detail;
+    let released = false;
+    try {
+      ({ released, detail } = releaseUnstartedDispatchClaim(cli, {
+        taskId: entry.taskId,
+        ref,
+        actor: taskActor,
+        stage,
+        detail: result.detail,
+        release: letGoUnstarted,
+        failures: releaseFailures,
+        log,
+      }));
+    } catch (err) {
+      detail = `${String(result.detail || '').slice(0, 120)}. claim release failed: ${String(err && err.message || err).slice(0, 80)}`;
+    }
+    flight.paused.push({ task: entry.taskId, stage, detail, worktree: entry.worktreePath, claim_released: released });
+    log(`    ✗ ${entry.taskId} ${NOT_STARTED_WORDS[stage] || 'prepare'} failed`);
+  };
+  const settled = await Promise.all(prepared.map((entry) => {
     const startedAtMs = Date.now();
     return dispatchEntryWithRestaff({
       entry,
@@ -3927,19 +4422,22 @@ async function runDispatchFlight({
       defaultPin: { model, effort, maxSeconds: capSeconds(maxSeconds), ...(prep ? { prep } : {}) },
       job: rosterJob,
       prepAsk,
+      beforeEngine: markStarted,
     }).then((result) => {
+      if (result.not_started) letGoNotStarted(entry, result);
       const completedAtMs = Date.now();
       return {
         entry,
         result,
         startedAtMs,
         completedAtMs,
-        candidate: enforceRemoteBoundary && !detectDeadEngineDispatch(result)
+        candidate: enforceRemoteBoundary && !result.not_started && !detectDeadEngineDispatch(result)
           ? reviewCandidateSnapshot(entry.remoteBoundary)
           : null,
       };
     });
   }));
+  const results = settled.filter(({ result }) => !result.not_started);
   flight.results = results.map(({ entry, result, candidate, startedAtMs, completedAtMs }) => {
     const row = {
       task: entry.taskId,
@@ -4482,7 +4980,10 @@ async function runDispatchFlight({
           stampDispatchBrief(root, result.brief_id, 'partial', `opened a pull request for ${entry.taskId}, but task ready failed`);
           log('    the pull request is open, but saving its proof failed. repair the task record before starting more work.');
           const unsaved = flight.paused.find((row) => row.task === entry.taskId && row.stage === 'task_ready' && row.held_for_review === true);
-          if (unsaved) releaseClaimOfUnsavedPullRequest({ taskDb: leaseDb, db: leaseConnection, root, row: unsaved, rowId: entry.task && entry.task.id, actor: taskActor, log });
+          if (unsaved) {
+            const rowId = entry.task && entry.task.id;
+            releaseClaimOfUnsavedPullRequest({ taskDb: leaseDb, db: leaseConnection, root, row: unsaved, rowId, actor: taskActor, log, claimEventId: claims.eventId(rowId) });
+          }
           continue;
         }
         stampDispatchBrief(root, result.brief_id, 'pass', `held ${entry.taskId} for a person to land`);
@@ -4531,6 +5032,8 @@ async function runDispatchFlight({
     baseRef: landTarget,
     log,
     keepClaimsWithWork: proofOnly,
+    release: letGoAsked,
+    failures: releaseFailures,
   });
 
   recordFlightRosterRuns(root, flight, results, {
@@ -4557,7 +5060,7 @@ async function runDispatchFlight({
     clearInterval(leaseTimer);
     for (const id of leasedIds) {
       const row = leaseDb.getTask(leaseConnection, id);
-      if (row && row.status !== 'claimed') leaseDb.clearLease(leaseConnection, { id, holder: taskActor });
+      if (row && row.status !== 'claimed') leaseDb.clearLease(leaseConnection, { id, holder: taskActor, claimEventId: claims.eventId(id) });
     }
   }
 }