@linxin666/dsh-client-ui-task-board 0.3.5 → 0.3.9

package/lib/types/client/TaskBoardSettingsCard.d.ts

@@ -4,7 +4,8 @@
  * the Web UI plugin group renders, bound to the `task-board` namespace.
  */
 import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
-import type { SettingsScope, SnapshotStore } from '@deepseek-ai/dsh-client-runtime/client';
+import type { SnapshotStore } from '@deepseek-ai/dsh-client-store';
+import type { SettingsScope } from '@deepseek-ai/dsh-client-ui-settings/client';
 import { type CardActions, type CardShell, type FieldState as CardFieldState } from './settings-form.ts';
 /** The task-board fields this card edits (the namespace's full schema). */
 export interface TaskBoardSettings {

package/lib/types/client/board/TaskBoard.d.ts

@@ -1,4 +1,7 @@
 import { type BoardController } from '../../core/controller.ts';
+import { type TaskRecord } from '../../core/tasks.ts';
+/** Case-insensitive title/description/freeze-snapshot match. */
+export declare function matchesFilter(task: TaskRecord, filter: string): boolean;
 /** Board component; subscribes to the controller snapshot. */
 export declare function TaskBoard({ controller }: {
     controller: BoardController;

package/lib/types/client/board/TaskForm.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Shared task-modal pieces: the overlay shell (backdrop, form, title, error,
+ * footer) and the title/description/prompt field trio used by both the
+ * NewTaskModal and the EditTaskModal. State stays in the owning modal; these
+ * are controlled components.
+ */
+import type { ReactNode } from 'react';
+/** Modal overlay: closes on backdrop press, submits through the form. */
+export declare function ModalShell({ ariaLabel, title, error, pending, submitLabel, onSubmit, onClose, children, }: {
+    ariaLabel: string;
+    title: string;
+    error: string | undefined;
+    pending: boolean;
+    submitLabel: string;
+    onSubmit: () => void;
+    onClose: () => void;
+    children: ReactNode;
+}): import("react").JSX.Element;
+/** Title + description + prompt fields shared by the new and edit task forms. */
+export declare function TaskContentFields({ title, description, prompt, onTitleChange, onDescriptionChange, onPromptChange, }: {
+    title: string;
+    description: string;
+    prompt: string;
+    /** Receives the new title; the owner also clears its error state. */
+    onTitleChange: (value: string) => void;
+    onDescriptionChange: (value: string) => void;
+    onPromptChange: (value: string) => void;
+}): import("react").JSX.Element;

package/lib/types/client/host-api.d.ts

@@ -3,7 +3,7 @@ import { type TaskBoardAction, type TaskBoardEventPayload, type TaskBoardSnapsho
 export interface TaskBoardHostTransport {
     bootstrap(legacy: readonly TaskRecord[]): Promise<TaskBoardSnapshot>;
     state(): Promise<TaskBoardSnapshot>;
-    action(action: TaskBoardAction): Promise<TaskBoardSnapshot>;
+    action(action: TaskBoardAction, initiator?: string): Promise<TaskBoardSnapshot>;
     subscribe(listener: (event?: TaskBoardEventPayload) => void): () => void;
 }
 export declare class HttpTaskBoardHostTransport implements TaskBoardHostTransport {
@@ -11,7 +11,7 @@ export declare class HttpTaskBoardHostTransport implements TaskBoardHostTranspor
     constructor(storage?: Pick<Storage, 'getItem' | 'setItem'> | undefined);
     bootstrap(legacy: readonly TaskRecord[]): Promise<TaskBoardSnapshot>;
     state(): Promise<TaskBoardSnapshot>;
-    action(action: TaskBoardAction): Promise<TaskBoardSnapshot>;
+    action(action: TaskBoardAction, initiator?: string): Promise<TaskBoardSnapshot>;
     private post;
     private request;
     subscribe(listener: (event?: TaskBoardEventPayload) => void): () => void;

package/lib/types/client/index.d.ts

@@ -8,7 +8,8 @@
  * shell fails the whole boot when a plugin apply throws, and an external
  * plugin must not take the GUI down.
  */
-import type { ClientContext, SettingsScope, SettingsScopeSpec } from '@deepseek-ai/dsh-client-runtime/client';
+import type { Context as ClientContext } from '@deepseek-ai/cordis';
+import type { SettingsScope, SettingsScopeSpec } from '@deepseek-ai/dsh-client-ui-settings/client';
 import { type TaskBoardKey } from './locales.ts';
 declare module '@deepseek-ai/dsh-client-ui-slots' {
     interface LocaleNamespaceMap {
@@ -46,7 +47,14 @@ declare module '@deepseek-ai/cordis' {
         };
     }
 }
-/** Required services (fiber inject waiting — the runtime must be up first). */
+/**
+ * Required services (fiber inject waiting — the runtime must be up first).
+ * The generated remote faces are probed at use time instead of injected:
+ * `remote.agentPresets` only registers on 0.1.2-alpha.2 hosts (the
+ * api-remotes contribution), so a hard wait would pend the entry forever
+ * on hosts below that cohort, which serve the same roster through the
+ * connection RPC face.
+ */
 export declare const inject: string[];
 /**
  * Mount the task board.

package/lib/types/client/locales.d.ts

@@ -39,6 +39,24 @@ export declare const zh: {
     'new.submit': string;
     'new.cancel': string;
     'new.required': string;
+    'new.freeze': string;
+    'new.freezePlaceholder': string;
+    'detail.freeze': string;
+    'detail.freeze.goal': string;
+    'detail.freeze.progress': string;
+    'detail.freeze.next': string;
+    'detail.freeze.frozenAt': string;
+    'detail.freeze.frozenBy': string;
+    'detail.freeze.redacted': string;
+    'card.frozen': string;
+    'new.handover': string;
+    'new.handoverPlaceholder': string;
+    'detail.handover': string;
+    'detail.handover.bundledAt': string;
+    'detail.handover.references': string;
+    'detail.permissionPending': string;
+    'detail.permissionConfirm': string;
+    'detail.permissionConfirmed': string;
     'detail.title': string;
     'detail.edit': string;
     'detail.close': string;
@@ -57,6 +75,7 @@ export declare const zh: {
     'detail.viewSession': string;
     'detail.noSession': string;
     'detail.executionStarted': string;
+    'detail.execution.initiator': string;
     'detail.executionEnded': string;
     'detail.result.succeeded': string;
     'detail.result.failed': string;

package/lib/types/client/settings-form.d.ts

@@ -6,7 +6,8 @@
  * each plugin's client bundle; mirrors the official ui-plugin-config
  * card-store pattern.
  */
-import type { SettingsScope, SnapshotStore } from '@deepseek-ai/dsh-client-runtime/client';
+import type { SettingsScope } from '@deepseek-ai/dsh-client-ui-settings/client';
+import type { SnapshotStore } from '@deepseek-ai/dsh-client-store';
 /** The write one field's staged text performs when the card is saved. */
 export type FieldWrite = {
     kind: 'set';
@@ -21,9 +22,11 @@ export interface FieldSpec {
     /**
      * Whether the Host treats this field as a secret and redacts its value from
      * the read-back (role('secret') in the section schema). Redacted secrets are
-     * never compared against the draft on save; the field lands when the scope
-     * reports the write succeeded (its secret-set marker under the bridge), so
-     * a successful secret save is not misreported as failed.
+     * never compared against the draft on save: the Host strips them from every
+     * wire view layer, so the settled snapshot carries nothing to read back. A
+     * staged secret set is judged by the mutation settling; the rest of its
+     * batch, when one exists, is still judged by read-back, and the atomic
+     * mutation lands every write or none.
      */
     secret?: boolean;
     /** Render a stored value as draft text; the empty string when the section carries none. */
@@ -49,8 +52,8 @@ export interface CardShell {
     available: boolean;
     /**
      * Whether the namespace is actually served to this client. False when the
-     * Host deployment does not expose it (e.g. the official apiproxy settings
-     * allowlist omits third-party namespaces): the card renders an explanation
+     * Host deployment does not expose it (e.g. the owning plugin's settings
+     * domain is not mounted): the card renders an explanation
      * instead of its form, so a missing namespace never looks like a missing
      * plugin.
      */
@@ -83,7 +86,7 @@ export interface CardActions {
     /** Drop every staged edit. */
     discard: () => void;
 }
-/** One durable write a batched settings scope performs. */
+/** One durable write inside the save's atomic scope mutation. */
 export interface BatchedWrite {
     /** Field this entry writes. */
     field: string;
@@ -92,28 +95,6 @@ export interface BatchedWrite {
     /** Value for op set (absent for unset). */
     value?: unknown;
 }
-/** Per-field outcome of one batched scope write. */
-export interface BatchedFieldResult {
-    /** Field this entry writes. */
-    field: string;
-    /** Whether the Host accepted this field's write (per the read-back view). */
-    landed: boolean;
-}
-/**
- * Result of a batched scope write. The bridge scope posts every planned write
- * in one /mutate so the Host validate hook judges baseURL+model together; a
- * batched refusal fails the whole save rather than per-field.
- */
-export interface BatchResult {
-    /** Whether the whole mutate was accepted. */
-    ok: boolean;
-    /** Per-field success, in the request order (always present when ok). */
-    fields: BatchedFieldResult[];
-    /** Host rejection code (mutate refused). */
-    code?: string;
-    /** Host rejection message (mutate refused). */
-    message?: string;
-}
 /** Constraints a numeric field's accepted drafts must satisfy, mirroring the host schema. */
 export interface NumberConstraints {
     /** The accepted value must be a whole number. */
@@ -128,8 +109,8 @@ export declare function textField(field: string): FieldSpec;
 /**
  * A free-text field the Host treats as a secret and redacts from the read-back
  * (role('secret') in the section schema). The card still edits it like text,
- * but a save never compares the redacted value back and relies on the scope
- * reporting the write landed.
+ * but a save never compares the redacted value back: the staged set is judged
+ * by the mutation settling (see {@link FieldSpec.secret}).
  */
 export declare function secretField(field: string): FieldSpec;
 /** A boolean field, edited through true/false draft text. */
@@ -171,19 +152,22 @@ export declare class CardForm<T> {
     /** The actions the card's slot registration injects. */
     actions(): CardActions;
     /**
-     * Write every staged edit, then re-seed from what the Host accepted.
+     * Write every staged edit in one atomic scope mutation, then re-seed from
+     * what the Host accepted.
      *
-     * When the scope carries the optional batch surface (the dsh-web
-     * bridge scope), every planned write rides one mutation so cross-field
-     * validate hooks (baseURL+model) judge the batch as a unit instead of
-     * deadlocking on per-field writes. Otherwise the per-field loop runs.
-     * A field lands only when the Host reports it held the staged value; a
-     * landed field's draft is dropped, a failed one stays staged for the user.
-     * @returns settlement after every write and the read-back.
+     * The whole batch rides one mutate, so cross-field validate hooks
+     * (baseURL+model) judge it as a unit: the Host either applies every write
+     * or refuses the batch. The 0.1.2 scope contract never rejects a refused
+     * mutation — the scope recovers with a fresh Host view and resolves — so
+     * resolution alone proves nothing: the outcome is judged by reading the
+     * settled snapshot back, one planned write at a time, and one missed write
+     * fails the whole save. A scope that still rejects on refusal (the dsh-web
+     * bridge scope) reports through the same failure path with its rejection
+     * message. A save that did not land keeps its drafts, so the user can
+     * correct them instead of retyping.
+     * @returns settlement after the mutation and the read-back.
      */
     save(): Promise<void>;
-    /** The scope's batch surface when it supports one; undefined conservatively otherwise. */
-    private batchedScope;
     /**
      * Every staged edit a save would write. An entry whose draft is not a value
      * its field accepts carries no write: the form is still dirty, and the save
@@ -192,8 +176,16 @@ export declare class CardForm<T> {
      * @returns the planned writes, in the order the fields were staged.
      */
     private plan;
-    private clear;
-    private store;
+    /**
+     * Read-back judgment for a planned set: the user layer must hold the
+     * intended value once the mutation has settled.
+     */
+    private landedSet;
+    /**
+     * Read-back judgment for a planned unset: the field must be gone from the
+     * user layer once the mutation has settled.
+     */
+    private landedUnset;
     private stage;
     private specOf;
     private snapshotOf;

package/lib/types/core/controller.d.ts

@@ -18,7 +18,11 @@ import type { TaskBoardAction, TaskBoardEventPayload, TaskBoardSnapshot } from '
 export interface TaskBoardTransport {
     bootstrap(legacy: readonly TaskRecord[]): Promise<TaskBoardSnapshot>;
     state(): Promise<TaskBoardSnapshot>;
-    action(action: TaskBoardAction): Promise<TaskBoardSnapshot>;
+    /**
+     * Submit one action; the optional initiator is the current DSH session id
+     * (issue #6 audit origin), asserted by the client and recorded by the Host.
+     */
+    action(action: TaskBoardAction, initiator?: string): Promise<TaskBoardSnapshot>;
     subscribe(listener: (event?: TaskBoardEventPayload) => void): () => void;
 }
 /** The sessions face the controller needs for navigation awareness. */
@@ -74,7 +78,7 @@ export interface ControllerSnapshot {
     executionOptions: ExecutionOptionsSnapshot;
     pendingTaskIds: readonly string[];
     transportError?: string;
-    host?: Pick<TaskBoardSnapshot, 'revision' | 'scheduler' | 'power'>;
+    host?: Pick<TaskBoardSnapshot, 'revision' | 'scheduler' | 'power' | 'sessionDefaultPermission'>;
 }
 /** The selected task (resolved from the ledger), or undefined. */
 export declare function selectedTaskOf(snapshot: ControllerSnapshot): TaskRecord | undefined;
@@ -186,6 +190,11 @@ export declare class BoardController {
      * the run is refused (returns false).
      */
     runTask(id: string): Promise<boolean>;
+    /**
+     * Confirm a card's above-default permission binding through the Host
+     * (resolves the pending-confirmation transaction; no-op otherwise).
+     */
+    confirmPermission(id: string): Promise<boolean>;
     /** Re-run a settled task through the Host (the Host replans and executes). */
     rerunTask(id: string): Promise<void>;
     /**

package/lib/types/core/freeze-snapshot.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Freeze-request parser and security gate: parses the system-prompt-agreed
+ * freeze format into a structured context snapshot (goal / progress / next),
+ * redacts sensitive patterns to markers, rejects slash-prefixed DSH command
+ * lines, and enforces the 8 KiB per-field byte limit.
+ * Pure functions only: no session, network, or filesystem access.
+ */
+/** Hard per-field limit: 8 KiB measured in UTF-8 bytes. */
+export declare const FREEZE_FIELD_BYTE_LIMIT: number;
+/** Marker replacing every sensitive match. */
+export declare const REDACTED_MARKER = "[REDACTED]";
+/** Structured context snapshot carried by a continuation card. */
+export interface FreezeSnapshot {
+    goal: string;
+    progress: string;
+    next: string;
+}
+/** Non-fatal notices produced by the security gate. */
+export type FreezeWarning = 'redacted';
+export type FreezeResult = {
+    ok: true;
+    snapshot: FreezeSnapshot;
+    warnings: FreezeWarning[];
+} | {
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+};
+/** Redact sensitive patterns to the marker; reports whether any hit occurred. */
+export declare function redactSensitive(text: string): {
+    text: string;
+    redacted: boolean;
+};
+/**
+ * True when any line of the text starts with "/" (a DSH command line).
+ * Leading horizontal whitespace before the slash counts too: a frozen
+ * body line like `  /kill` is still a command, not prose.
+ */
+export declare function hasSlashCommandLines(text: string): boolean;
+/**
+ * Sanitize a structured freeze snapshot (the create/update action payload):
+ * shape check, slash-command taint rejection, sensitive redaction, and the
+ * per-field byte cap - the same gate parseFreezeRequest applies to
+ * free-text freeze requests, exposed for the action data plane (issue #4).
+ * @param value - the freeze object carried by an action or read back from disk.
+ * @param extraKeys - keys allowed alongside goal/progress/next (e.g. the
+ *   protocol redacted flag, the ledger frozenAt stamp) and preserved verbatim
+ *   when present; their validation stays with the caller.
+ */
+export declare function sanitizeFreezeSnapshot(value: unknown, extraKeys?: readonly string[]): {
+    ok: true;
+    snapshot: FreezeSnapshot;
+    redacted: boolean;
+    extras: Record<string, unknown>;
+} | {
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+};
+/**
+ * Parse the freeze-request format: a <<<FREEZE ... >>>FREEZE block whose body
+ * is 目标: / 进度: / 下一步: section headers, each followed by body lines.
+ * The gate applies before returning: slash-command taint rejects the whole
+ * request, sensitive patterns are redacted to markers, and each field is
+ * capped at FREEZE_FIELD_BYTE_LIMIT UTF-8 bytes.
+ */
+export declare function parseFreezeRequest(input: string): FreezeResult;

package/lib/types/core/handover.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Handover bundle (issue #5, ADR 0001): the resource reference set a
+ * continuation card carries — the pinned execution triplet (workspace /
+ * agent preset / permission) plus doc/script references — so a picking-up
+ * session can start with zero context.
+ *
+ * Security gate (adversarial scenario b): a bundle whose effective
+ * permission is HIGHER than the session default is an unconfirmed binding.
+ * It enters the pending-confirmation state (the card stores the binding
+ * without a permissionConfirmedAt stamp); manual execution refuses, cron
+ * refuses to schedule, and the human confirm-permission action resolves the
+ * transaction by stamping the confirmation. Any later permission or
+ * handover change re-arms the gate (the confirmation binds the exact
+ * permission value, blocking confirm-then-swap escalation).
+ */
+import { type TaskPermission, type TaskRecord } from './tasks.ts';
+export type { TaskPermission };
+/** Wire shape of a handover bundle (before bundledAt is stamped). */
+export interface TaskHandoverInput {
+    workspaceId?: string;
+    mode?: string;
+    permission?: TaskPermission;
+    references: string[];
+}
+/** Persisted handover bundle on a task record. */
+export interface TaskHandover extends TaskHandoverInput {
+    /** When the bundle was attached/replaced (ms epoch, stamped by the use case). */
+    bundledAt: number;
+}
+/** Most references a bundle may carry. */
+export declare const HANDOVER_MAX_REFERENCES = 32;
+/** Per-reference UTF-8 byte cap. */
+export declare const HANDOVER_MAX_REFERENCE_BYTES = 512;
+/** Total references UTF-8 byte cap. */
+export declare const HANDOVER_MAX_TOTAL_BYTES: number;
+/** Per target-id (workspace/preset) byte cap. */
+export declare const HANDOVER_MAX_TARGET_BYTES = 256;
+/** The board's notion of the deployment session-default permission (fail-safe default). */
+export declare const DEFAULT_SESSION_PERMISSION: TaskPermission;
+/** Permission elevation rank (higher = more authority). */
+export declare const PERMISSION_RANK: ReadonlyMap<TaskPermission, number>;
+/**
+ * Gate a handover bundle from the wire or disk: exact keys, string targets
+ * under the byte cap, a known permission, and a bounded string reference
+ * list. Returns the sanitized bundle, or undefined when rejected.
+ */
+export declare function sanitizeHandover(value: unknown): TaskHandoverInput | undefined;
+/** Build the persisted bundle from a sanitized input, stamping bundledAt. */
+export declare function handoverOf(input: TaskHandoverInput, now: number): TaskHandover;
+/** The permission an execution session would actually run under. */
+export declare function effectivePermission(task: Pick<TaskRecord, 'permission' | 'handover'>): TaskPermission | undefined;
+/** Whether a binding's permission is elevated above the session default. */
+export declare function exceedsSessionDefault(permission: TaskPermission | undefined, sessionDefault: TaskPermission): boolean;
+/**
+ * The confirmation-gate predicate: an elevated permission without a human
+ * confirmation stamp. Manual run/rerun and cron must refuse such a card.
+ */
+export declare function requiresPermissionConfirmation(task: Pick<TaskRecord, 'permission' | 'handover' | 'permissionConfirmedAt'>, sessionDefault?: TaskPermission): boolean;

package/lib/types/core/tasks.d.ts

@@ -4,6 +4,8 @@
  * Framework-free (no cordis, no runtime imports) so the state machine is
  * unit-testable in isolation.
  */
+import type { FreezeSnapshot } from './freeze-snapshot.ts';
+import type { TaskHandover, TaskHandoverInput } from './handover.ts';
 /** Task lifecycle status, one per kanban column. */
 export type TaskStatus = 'backlog' | 'todo' | 'running' | 'done' | 'failed';
 /**
@@ -24,6 +26,16 @@ export interface ExecutionRecord {
     result: 'succeeded' | 'failed' | 'cancelled' | undefined;
     /** Human failure text when the run failed (prompt rejection or agent error). */
     error: string | undefined;
+    /**
+     * Session id of the DSH session that issued the run/rerun action (issue #6
+     * audit origin). Client-asserted, not a trust boundary; absent when the run
+     * was triggered by cron (source unknown).
+     */
+    initiatedBy?: string;
+    /** Freeze instant captured from the card snapshot when the run opened. */
+    frozenAt?: number;
+    /** Freeze source session captured from the card snapshot when the run opened. */
+    frozenBy?: string;
 }
 /**
  * Maximum number of execution records retained per task. Older settled runs
@@ -52,6 +64,23 @@ export interface ScheduleRule {
     /** Instant of the latest scheduled trigger (ms epoch). */
     lastTriggeredAt: number | undefined;
 }
+/**
+ * Frozen context snapshot carried by a continuation card (issue #4): the
+ * goal/progress/next text (already sanitized by the freeze gates) plus the
+ * freeze instant and the redaction warning flag.
+ */
+export interface TaskFreeze extends FreezeSnapshot {
+    /** When the snapshot was frozen (ms epoch, stamped by the create/update use case). */
+    frozenAt: number;
+    /** True when the freeze gates redacted sensitive patterns out of the text. */
+    redacted?: boolean;
+    /**
+     * Session id of the DSH session that authored the frozen snapshot (issue #6
+     * provenance): stamped by the Host ledger from the create/update action's
+     * initiator, or kept from the wire payload when no initiator was asserted.
+     */
+    frozenBy?: string;
+}
 /** One task on the board. */
 export interface TaskRecord {
     /** Stable task id (uuid). */
@@ -90,6 +119,25 @@ export interface TaskRecord {
      * `/permission <id>` slash command; absent leaves the session default.
      */
     permission?: TaskPermission;
+    /**
+     * Frozen context snapshot for a continuation card; absent on plain tasks.
+     * Sanitized before it enters the ledger (redaction, slash-command taint,
+     * 8 KiB per-field cap) by the protocol gate and re-normalized on load.
+     */
+    freeze?: TaskFreeze;
+    /**
+     * Handover bundle carried by a continuation card (issue #5): the pinned
+     * execution triplet plus doc/script references. Sanitized before it
+     * enters the ledger by the protocol gate and re-normalized on load; the
+     * bundle's triplet overrides the legacy pin fields at execution time.
+     */
+    handover?: TaskHandover;
+    /**
+     * Human confirmation stamp for an above-default effective permission
+     * (ms epoch). Absent while the binding awaits confirmation; any permission
+     * or handover change re-arms the gate by clearing it.
+     */
+    permissionConfirmedAt?: number;
     /**
      * When the task was archived (ms epoch). Archived tasks keep their status
      * and execution history, leave the main board, and cannot run until restored;
@@ -125,6 +173,19 @@ export interface NewTaskInput {
         enabled: boolean;
         cron: string;
     };
+    /**
+     * Optional frozen context snapshot (goal/progress/next, sanitized by the
+     * protocol gate) turning the new task into a continuation card.
+     */
+    freeze?: FreezeSnapshot & {
+        redacted?: boolean;
+        frozenBy?: string;
+    };
+    /**
+     * Optional handover bundle (pinned triplet + doc/script references,
+     * sanitized by the protocol gate) attached at creation.
+     */
+    handover?: TaskHandoverInput;
 }
 /** The five kanban columns, in display order. */
 export declare const COLUMNS: readonly {
@@ -143,6 +204,14 @@ export declare function isTaskStatus(value: unknown): value is TaskStatus;
 export declare function canMoveManually(from: TaskStatus, to: TaskStatus): boolean;
 /** Normalize one optional execution-target string: trim; blank collapses to undefined. */
 export declare function normalizeTargetId(value: string | undefined): string | undefined;
+/**
+ * Build the persisted freeze snapshot from a sanitized input, stamping the
+ * freeze instant (shared by the create and update use cases).
+ */
+export declare function freezeOf(input: FreezeSnapshot & {
+    redacted?: boolean;
+    frozenBy?: string;
+}, now: number): TaskFreeze;
 /** Create a task from user input. */
 export declare function createTask(input: NewTaskInput, now: number, id: string): TaskRecord;
 /** Clone a task with an updated status and a fresh updatedAt. */
@@ -158,7 +227,7 @@ export declare function withSchedule(task: TaskRecord, patch: Partial<ScheduleRu
  * Open a fresh execution on a task: move it to 'running' and append a
  * running execution record. Returns the new task and the new execution.
  */
-export declare function startExecution(task: TaskRecord, now: number, executionId: string): {
+export declare function startExecution(task: TaskRecord, now: number, executionId: string, initiatedBy?: string): {
     task: TaskRecord;
     execution: ExecutionRecord;
 };

package/lib/types/core/use-cases/task-update.d.ts

@@ -4,16 +4,25 @@
  * fresh updatedAt. Pure ledger transition (no persistence or notify — the
  * controller orchestrates those).
  *
- * An explicit `undefined` in the patch clears an execution-target field
- * (the task falls back to the runtime default); content fields are trimmed
- * and never cleared. An unknown permission string is ignored so stale UI
- * can never persist a value the execution service rejects.
+ * An explicit `undefined` in the patch clears the field (the task falls
+ * back to the runtime default); an unknown permission string is ignored so
+ * stale UI can never persist a value the execution service rejects.
  */
 import { type TaskRecord } from '../tasks.ts';
-/** Editable fields on a task (the update patch surface). */
-export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission'>>;
+import type { FreezeSnapshot } from '../freeze-snapshot.ts';
+import type { TaskHandoverInput } from '../handover.ts';
 /**
- * The fields that edit the task's content (what the user reads and what the
+ * Editable fields on a task (the update patch surface). `freeze` replaces the
+ * continuation-card snapshot (restamping frozenAt); an explicit null clears it.
+ */
+export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission'>> & {
+    freeze?: FreezeSnapshot & {
+        redacted?: boolean;
+    } | null;
+    /** Replaces the handover bundle (restamping bundledAt); an explicit null clears it. */
+    handover?: TaskHandoverInput | null;
+};
+/** The fields that edit the task's content (what the user reads and what the
  * next execution sends). Unlike the execution targets they stay editable only
  * while the task has never started executing — after the first run the
  * recorded prompt is the record of what actually ran, so it becomes read-only.

package/lib/types/host-ledger.d.ts

@@ -1,5 +1,6 @@
 import { type ExecutionRecord, type TaskRecord } from './core/tasks.ts';
 import { type TaskBoardAction, type TaskBoardSchedulerSnapshot } from './protocol.ts';
+import { type TaskPermission } from './core/handover.ts';
 export interface LedgerState {
     revision: number;
     tasks: TaskRecord[];
@@ -47,7 +48,11 @@ export declare class HostTaskLedger {
     readonly lockFile: string;
     /** Small sidecar for the 30 s scheduler heartbeat (lastTickAt only). */
     readonly schedulerFile: string;
-    constructor(dir?: string, now?: () => number);
+    /** Session-default permission the confirmation gate compares against. */
+    readonly sessionDefaultPermission: TaskPermission;
+    constructor(dir?: string, now?: () => number, options?: {
+        sessionDefaultPermission?: TaskPermission;
+    });
     /** Revision + scheduler without any task cloning; feeds the SSE event frame. */
     summary(): {
         revision: number;
@@ -66,7 +71,7 @@ export declare class HostTaskLedger {
     dueSchedules(now: number): DueScheduleReference[];
     subscribe(listener: () => void): () => void;
     dispose(): void;
-    applyRequest(requestId: string, action: TaskBoardAction): {
+    applyRequest(requestId: string, action: TaskBoardAction, initiator?: string): {
         state: LedgerState;
         run?: OpenedRun;
     };
@@ -78,7 +83,17 @@ export declare class HostTaskLedger {
     private apply;
     private repairSchedules;
     private reconcileInterruptedStarts;
+    /**
+     * Field-preserving v2 to v3 migration. v3 adds no fields yet, so the
+     * migration reuses the v3 normalization, but it first proves every task
+     * row is structurally valid: a v2 document that would silently drop or
+     * coerce rows fails loudly instead (no quarantined-empty restart).
+     */
+    private migrateLegacyDocument;
     private load;
+    private normalizeDocument;
+    /** Quarantine an unreadable document and start from an empty ledger. */
+    private recoverCorrupt;
     private syncRecentRequests;
     private readSchedulerSidecar;
     /** Atomic write of the scheduler heartbeat sidecar (0600, tmp + rename + fsync). */