v4.5.4 - Centre polish and a memory governor that survives restarts

v4.5.3 gave you the memory governor and the command centre. Some gaps stayed.

A server restart made the governor forget its pause run. A loop that the governor paused could stay stopped with no rule to resume it. Also, the first reading over the ceiling could pause one more loop at once. When an orchestrator start failed, the alert of the command centre covered the Terminal and Conversation tabs. Thus you could not open the pane that showed the cause. start_ship told the orchestrator that a shipped card was card-not-done. And the code and the UI spec still used the names of the orchestrator panel that v4.5.3 removed.

This release closes those gaps. Each change is a fix or a follow-up to a released feature, so this is a patch release.

Centre names in the code and the UI spec (LOCAL-118)

This change is for contributors. The UI does not change.

• Renames. The orchestrator module now uses "centre" names. PanelAlertBar is CentreAlertBar, PanelControls is CentreControls and panel-model.ts is centre-model.ts. The query key is ["orchestrators", "centre", board]. The ["orchestrators"] prefix did not change, so prefix invalidations still match.
• The UI spec. Screen 3 of docs/standards/orchestration-ui-spec.md now describes the settings sheet of the command centre. The panel layout, the close button and the 390 px panel sheet are gone from the spec.
• Removed with the panel. The spec records two panel-only rows as removed: the "Stopped loops" list (the Resume loop action of a branch tile replaces it) and the line "Stopped. Type in the terminal to continue." of the Stop button.

Evidence: a run of the 8 visual baselines of the orchestrator screens gave 0 pixel diff. (PR #262)

The memory governor remembers its pause run after a restart (LOCAL-121)

Before this release, the pause run was in memory only. Now Dispatch rebuilds it from the board store.

• The paused mark. A governor pause now writes reason and swapMb (the swap reading of that pause) on the paused mark of the card. A pause by you writes reason only.
• The first reading after a start. The server checks the first fresh reading after it starts. Swap at or under the ceiling resumes the governor-paused loop with the oldest session start, in one sampling interval (15 s). Swap over the ceiling continues the run from the highest saved swapMb. Thus a new pause still needs 256 MB of growth past that reading.
• The ceiling, not the resume floor. After a restart, the resume uses the ceiling. The low readings of the lost run are gone, so the governor cannot prove two readings under the resume floor.
• Your pause is safe. A loop that you paused (by: user) is never a resume target.
• Scenario 8. The end-to-end memory scenario now restarts the server two times on the same data folder. Its timeout is now 9 minutes.

Evidence: in scenario 8, a restart with swap at 8000 MB resumed the memory-paused loop in 20 s with the reason swap used 8000 MB is not above the 8192 MB ceiling after a restart, and the loop that the user paused stayed paused. (PR #263)

start_ship refuses a Done card as already shipped (LOCAL-122)

• Done. start_ship on a card in Done now answers 409 already-shipped. The refusal has a pr detail when the card has a PR number. The gate reads the last PR number of the ship flow first, then the first detected PR of the card.
• Other columns. A card in any other column except Agent done still gets 409 card-not-done. A group card with loop progress keeps its loop-not-finished gate.
• Docs. The start_ship tool description, docs/ARCHITECTURE.md and the orchestration design standard name the two reasons and the pr detail.

Evidence: startShip on a Done card whose done ship flow holds PR 42 answered 409 already-shipped with pr 42, and 46 of 46 ship-flow tests pass. (PR #264)

Long decision option labels have a visual case (LOCAL-119)

The wrap of a long decision option label shipped in v4.5.2 (PR #253). Now a visual case proves it.

• The seed. Decision dec-orc-1 of the visual fixtures has the 60-character option A label "Retry the Phase 5 gate now, then send GROUP-22 the fix after".
• Baselines. The 8 command centre baselines (dark and light, 1440 px and 390 px, macOS and Linux) show the label wrapped, not clipped. A regression in the wrap now fails the visual suite.

Evidence: check, visual, CodeQL, scan and pr-title were all green on the first CI run. (LOCAL-119 ship notes)

The failed start alert sits below the pane tabs (LOCAL-120)

• The position. At 768 px and wider, the alert "The orchestrator did not start: ." with Try again now shows as a bar below the pane tabs, in the page flow. Terminal and Conversation stay clickable while it shows, so you can read the cause.
• Narrow screens. Below 768 px, the alert stays inline in the toolbar, as before.
• Visual case. The new centre-start-failed case runs at 1440 px and 768 px, in dark and light, on macOS and Linux.

Evidence: on macOS, 74 of 74 visual cases pass. On Linux, centre-start-failed passed 16 of 16 runs, with each case run 4 times. (PR #266)

Known limits

• You cannot approve a permission prompt from the attention queue. Open the terminal.
• The queue refuses a reply in four cases. The session shows a permission prompt, the session shows the usage limit dialog, the session waits for the usage reset, or Claude exited.
• A reply of more than 500 characters goes to the loop as a file with a one-line pointer.
• The queue has no length limit.
• A Needs input item can take up to about 2 seconds to show, because the marker watcher reads the panes every 2 seconds.
• The sidebar Dashboard row and the Go to Dashboard command show only on a board with a main orchestrator.
• When an orchestrator start fails, the reason can be raw text from the Claude pane.
• A wake line clears a message that you typed but did not send in the orchestrator terminal.
• A review session runs with the default skip-permissions argument and your gh login. "Post nothing" is a prompt instruction only.
• A Roadmap Loop session starts with Refuse for messages from other sessions, but a later Resume of it starts with Accept.
• A session with no hooks gets no settings file, so the messages setting does not apply to it.
• A review card in Done cannot start a new review after the pull request changes. Ship from a review card pushes the card branch, not the review branch. A second session on a review card fails with a general start error.
• Dismissed Inbox items never expire. Dismissed (n) ignores the search and the filters. A second dismiss within 10 s replaces the first Undo.
• The command centre conversation reads all the answered decisions of the board every 3 seconds and filters them in the browser. No load numbers exist.
• The command centre has no Markdown for orchestrator text, no message search and no paging of older messages.
• A double click on Try resume again sends two requests. A double click on Save policy or Add orchestrator also sends two requests.
• Urgent mode can make about 30 usage reads in one rolling hour on a steady climb. A 429 then holds the account, and a limit screen still moves the sessions.
• The 429 hold is in memory only. A restart reads every account at once.
• A manual usage refresh inside a 429 hold shows "Wait 30 seconds between refreshes.", also when the hold is longer.
• resume_card can resume a loop that a human paused. This is a design decision.
• A paused mark saved before v4.5.4 has no swapMb. After the upgrade, the rebuild uses the current reading for that mark.
• A restart still clears the 5 minute cooldowns of the governor. They are in memory only.
• The governor runs on macOS only. Pause and unpause by hand also work on Linux.
• The lowest swap ceiling among the boards with running loops applies. It can pause a loop on a board with a higher ceiling.
• A pause can stop an idle loop. A stopped process tree can go to swap, so swap can still increase after a pause.
• A paused loop that moves to Done stays stopped until the Done cleanup kills it.
• The dashboard progress row has no paused marker. Its count shows a paused loop as running.
• Scenario 8 (memory pause end to end) runs by hand, not in CI.
• The check takes about 15 minutes in CI since the timing split.
• The gallery dark 390 visual case can fail on an 8 GB Mac under load. It runs by hand, and it does not fail in CI.
• The centre-start-failed visual case waits for the alert only, not for the decision list. It failed one time on Linux right after a baseline update.
• The ship flow merges into main. A single card on a board whose base is a different branch is not proven.
• release_prep finds a duplicate release card by its title only. Two repositories on one board cannot have an open release card at the same version.

Upgrade notes

• The store schema stays at 3. board-db.ts did not change, so there is no migration. The reason and swapMb fields of the paused mark are new optional JSON fields.
• No default changes for an existing install.
• After the upgrade restart, when swap is at or under the ceiling, the oldest loop that the governor paused resumes on the first fresh reading.
• Otherwise there is nothing to do on upgrade.

See it

dispatch-v4.5.4-centre-polish-inline.mp4

Higher-quality video with narration: dispatch-v4.5.4-centre-polish.mp4

Full changelog: v4.5.3...v4.5.4

Requires Node ≥ 22.22, tmux, ttyd, git, and the Claude Code CLI. Setup is in the README.