State the task-state/session-state boundary in DESIGN.md §8

docs/DESIGN.md

@@ -145,6 +145,8 @@ Ordering of the queue: every `needs-input`, `review`, and `proposed` task plus t
 
 ## 8. Dispatch and agent integration
 
+**The boundary** between Voro and the agent is task state versus session state. Orchestrators — Vibe Kanban, Claude Squad, Claude Code's own agent view — answer "what is my agent doing?" by observing the process: streaming logs, multiplexing terminals, polling a supervisor. Voro does not observe; it is told. The return-path verbs push task-level transitions (`done` → review, `ask` → needs-input), which are exactly the attention states the queue exists to surface and which cannot be reliably inferred from process observation anyway — a session exiting cleanly says nothing about whether the task is finished, blocked, or half-abandoned. The session row's pid and log_path are receipts, not management handles: the log so redispatch can hand a successor the predecessor's trail, the pid to detect the one failure the return path cannot report — a session that died without calling anything. This is what keeps dispatch agent-agnostic. Voro never parses an agent's internals, so anything that can run a shell command integrates through a command template, and an agent's own session tooling (attach, resume, fleet views) remains available underneath without Voro knowing about it.
+
 **Agent resolution**, in order: the task's `agent` override if set (the capability case — a task that needs image generation is inherently a task for the agent that has it, so the choice is worth persisting on the task); otherwise the global default from `agents.toml`. The TUI offers two dispatch actions: dispatch-with-resolved-agent on one key, dispatch-via-picker on another — the picker existing mostly for the cap case, where the default is temporarily unusable but nothing about the task has changed.
 
 **Redispatch** is a first-class action born of the same cap case: a `running` task whose session ends with outcome `capped` or `failed` drops back to `ready` with a visible flag, and redispatching it offers the agent picker plus the previous session's notes/log so the successor agent does not start cold.