In beakerd's queued_recipes routine there is code to check whether a system's permissions have changed since it was originally added as a candidate for the recipe, and if so to remove it. But the transaction is not committed in that case. This is a regression in 0.10. I broke it in commit 7e690c1e. This will need a hot fix since any recipe which reaches that code will never progress beyond the Queued state without manual intervention.
Workaround is to delete the offending rows from system_recipe_map manually: DELETE FROM system_recipe_map USING system_recipe_map INNER JOIN system ON system_recipe_map.system_id = system.id WHERE system.fqdn = '<fqdn>' AND recipe_id IN (<id>, <id>, ...);
On Gerrit: http://gerrit.beaker-project.org/1519
Fixed in beaker-server-0.10.5-1.