@linxin666/dsh-client-ui-task-board 0.4.2 → 0.4.4

package/src/core/controller.ts

@@ -17,6 +17,7 @@ import { applyArchiveTask, applyRestoreTask } from './use-cases/task-archive.ts'
 import { applyCreateTask } from './use-cases/task-create.ts'
 import { applyDeleteTask } from './use-cases/task-delete.ts'
 import { applyScheduleNextRun as applyScheduleRollForward, applySetSchedule } from './use-cases/task-schedule.ts'
+import { resolveHostTimeZone } from './schedule.ts'
 import { applySetParent } from './use-cases/task-parent.ts'
 import { applyUpdateTask, type TaskUpdatePatch } from './use-cases/task-update.ts'
 import { DEFAULT_SUBTASK_DEPTH } from './subtask.ts'
@@ -62,6 +63,21 @@ function currentOf(sessions: SessionsControllerFace | undefined): string | undef
   return sessions?.current()
 }
 
+/** Stable id shared by the board's sidebar panel row and its main-slot page. */
+export const TASK_BOARD_PANEL_ID = 'task-board'
+
+/**
+ * The layout's panel-navigation face. The board no longer owns the center
+ * column at the DOM level: selecting the panel is the layout's business, and
+ * this is the one call that asks for it (null returns to the conversation).
+ * Optional, so a composition without the layout service keeps the board's
+ * pure state transitions testable.
+ */
+export interface PanelNavigationFace {
+  /** Select the board panel, or null to hand the column back to the conversation. */
+  select(panelId: string | null): void
+}
+
 /** Controller dependencies (all swappable in tests). */
 export interface ControllerDeps {
   store: TaskStore
@@ -72,6 +88,8 @@ export interface ControllerDeps {
   uuid?: () => string
   /** Host-authoritative transport; absent keeps the legacy in-memory test path. */
   transport?: TaskBoardTransport
+  /** Layout panel selection; absent keeps the board state-only (tests, shell-less hosts). */
+  panel?: PanelNavigationFace
 }
 
 /**
@@ -253,15 +271,31 @@ export class BoardController {
 
   // --- view state -------------------------------------------------------------
 
+  /**
+   * Show the board. The layout owns which panel the center column renders, so
+   * the state flip and the panel selection travel together here; a composition
+   * with no layout face (tests, a shell-less host) still flips the state.
+   *
+   * The selection is requested AFTER the snapshot flips so a subscriber
+   * rendering against `boardOpen` never observes "open" while the shell still
+   * shows the conversation.
+   */
   openBoard(): void {
     if (this.boardOpen) return
     this.boardOpen = true
     this.notify()
+    this.selectPanel(TASK_BOARD_PANEL_ID)
   }
 
+  /**
+   * Return the center column to the conversation. The layout's own selection is
+   * the source of truth for what the column renders, so this asks for the
+   * conversation explicitly rather than only clearing local state.
+   */
   closeBoard(): void {
     this.boardOpen = false
     this.notify()
+    this.selectPanel(null)
   }
 
   toggleBoard(): void {
@@ -269,6 +303,30 @@ export class BoardController {
     else this.openBoard()
   }
 
+  /**
+   * Reflect a panel selection that came from OUTSIDE this controller (the user
+   * clicked another sidebar row, or the layout dropped the panel id). Keeps
+   * `boardOpen` aligned with what the column actually shows without asking the
+   * layout to select anything back.
+   * @param panelId - the layout's current panel id, or null for the conversation.
+   */
+  syncPanelSelection(panelId: string | null): void {
+    const open = panelId === TASK_BOARD_PANEL_ID
+    if (open === this.boardOpen) return
+    this.boardOpen = open
+    this.notify()
+  }
+
+  /** Ask the layout to select a panel; a shell that serves no layout face is a no-op. */
+  private selectPanel(panelId: string | null): void {
+    try {
+      this.deps.panel?.select(panelId)
+    } catch {
+      // The layout service throws by contract before its root entry mounts;
+      // the state flip above already stands, and the next selection retries.
+    }
+  }
+
   /**
    * Switch between the kanban columns and the archive view. Leaving the
    * archive view with an archived task still selected closes the selection —
@@ -460,8 +518,12 @@ export class BoardController {
    * @param patch - fields to change (absent fields keep their current value).
    * @returns true when applied, false when rejected (invalid cron / unknown task).
    */
-  setSchedule(id: string, patch: { enabled?: boolean; cron?: string }): boolean {
-    const { tasks, applied } = applySetSchedule(this.tasks, id, patch, this.now())
+  setSchedule(id: string, patch: { enabled?: boolean; cron?: string; timeZone?: string | null }): boolean {
+    // The Host zone is the fallback a rule with no stored zone follows: the
+    // mirrored snapshot carries it, and a controller without a Host mirror
+    // (pure client tests) falls back to the process zone.
+    const hostTimeZone = this.hostState?.scheduler.timeZone ?? resolveHostTimeZone()
+    const { tasks, applied } = applySetSchedule(this.tasks, id, patch, this.now(), hostTimeZone)
     if (!applied) return false
     if (this.deps.transport !== undefined) {
       void this.commitRemote({ kind: 'set-schedule', taskId: id, patch }, id)
@@ -547,8 +609,8 @@ export class BoardController {
    * (background navigation, the Host runner creating and selecting a fresh
    * execution session, settlement, other plugins), so closing on `current`
    * changes would evict the board without the user asking. The board closes
-   * only on explicit user navigation: a sidebar session/workspace row click
-   * (board-mount onClickSidebarRow) or the board's own actions
+   * only on explicit user navigation: selecting another panel (the layout owns
+   * selection, and `syncPanelSelection` follows it) or the board's own actions
    * (openSession / close). Keeping the hook preserves the subscription
    * contract for future listeners.
    */

package/src/core/degraded-reason.ts

@@ -0,0 +1,81 @@
+/**
+ * The family health ledger's degraded-record contract (issues #1528, #1730).
+ *
+ * A family plugin row that fails during apply is recorded by the dsh-web-all
+ * shell as a degraded record; the shell serves the ledger through its
+ * loopback-only `GET /api/dsh-web-all/degraded` route because the failed
+ * plugin could not register any route of its own — the task board whose ledger
+ * lock is held by another DSH process is exactly that case, and without this
+ * the panel could only report "the Host API is not mounted".
+ *
+ * Both halves define this shape: the shell WRITES it (packages/dsh-web-all,
+ * src/degraded.ts — the two packages have no import edge, one is bundled into
+ * the other's profile) and a plugin's browser half PARSES it. The edits move
+ * together.
+ */
+
+/** Where a degraded row failed: module import, plugin shape, or fiber start. */
+export type DegradedStage = 'import' | 'shape' | 'start'
+
+/** One degraded family row as the shell's health route serves it. */
+export interface DegradedRow {
+  /** Real plugin package name from the shell row config. */
+  plugin: string
+  /** Where the failure happened. */
+  stage: DegradedStage
+  /** The shell's one-line reason, for display. */
+  reason: string
+}
+
+/**
+ * The one degraded record naming `plugin`, or undefined when that row is not
+ * degraded (or the payload does not come from the shell's own shape). A
+ * plugin may appear once: the shell keys the ledger by package name and
+ * refreshes the record on every new failure.
+ * @param body - parsed JSON body of the health route.
+ * @param plugin - the real plugin package name to look for.
+ * @returns the degraded row, or undefined when the ledger does not name it.
+ */
+export function degradedRowOf(body: unknown, plugin: string): DegradedRow | undefined {
+  if (typeof body !== 'object' || body === null) return undefined
+  const ledger = (body as { ok?: unknown; degraded?: unknown })
+  if (ledger.ok !== true || !Array.isArray(ledger.degraded)) return undefined
+  for (const entry of ledger.degraded) {
+    if (typeof entry !== 'object' || entry === null) continue
+    const record = entry as { plugin?: unknown; stage?: unknown; reason?: unknown }
+    if (record.plugin !== plugin) continue
+    const stage = record.stage === 'import' || record.stage === 'shape' || record.stage === 'start' ? record.stage : undefined
+    if (stage === undefined) continue
+    return { plugin, stage, reason: typeof record.reason === 'string' ? record.reason : '' }
+  }
+  return undefined
+}
+
+/** The ledger owner pid a task-board lock reason names, when it names one. */
+const OWNED_BY_PROCESS_RE = /already owned by process\s+(\d+)/
+
+/**
+ * The marker the ledger appends when it could NOT confirm the recorded PID
+ * belongs to the lock's real owner: the PID was reused by an unrelated process
+ * after a crash, and the reason then carries the manual-removal step instead.
+ * That reason must be rendered verbatim — telling the user to close "the other
+ * DSH instance" would send them after a process that never touched the board.
+ */
+const UNCONFIRMED_OWNER_MARKER = 'reused after a crash'
+
+/**
+ * Extract the pid of the LIVE process a ledger-lock failure blames, when the
+ * reason identifies one. The task board's lock refusal is the one degraded
+ * reason that carries an owner the user can act on, so the panel renders the
+ * pid in its own sentence and adds the guidance that actually applies.
+ * @param reason - the shell's one-line failure reason.
+ * @returns the confirmed owner pid, or undefined when the reason names none or
+ *   warns that the PID may have been reused (its own text owns the recovery).
+ */
+export function ledgerOwnerPid(reason: string): number | undefined {
+  if (reason.includes(UNCONFIRMED_OWNER_MARKER)) return undefined
+  const match = OWNED_BY_PROCESS_RE.exec(reason)
+  if (match === null) return undefined
+  const pid = Number(match[1])
+  return Number.isSafeInteger(pid) && pid > 0 ? pid : undefined
+}

package/src/core/package-name.ts

@@ -0,0 +1,9 @@
+/**
+ * npm identity of this plugin. The dsh-web-all degraded ledger is keyed by the
+ * real plugin package name of a family row, and this plugin's browser half
+ * must name its OWN row there to learn why its Host API is missing (issue
+ * #1730): the served bundle cannot derive the name, because a family row
+ * mounts the package from a versioned profile path. The host half spells the
+ * same name in its single-mount guard (src/index.ts); the two move together.
+ */
+export const TASK_BOARD_PACKAGE = '@linxin666/dsh-client-ui-task-board'

package/src/core/schedule.ts

@@ -1,15 +1,36 @@
 /**
- * Minimal 5-field cron parsing and next-run computation for scheduled task
- * runs. Framework-free and dependency-free so the scheduler and controller
- * share one tiny pure module.
+ * Zone-aware 5-field cron parsing and next-run computation for scheduled task
+ * runs. Framework-free and dependency-free (Intl only) so the Host scheduler
+ * and the browser next-run preview share one tiny pure module.
  *
  * Grammar: five whitespace-separated fields, 分 时 日 月 周. Every field
  * supports the wildcard, step (wildcard or range + "/n"), single value,
  * inclusive range a-b, and comma lists mixing any of those. Ranges: minutes
  * 0-59, hours 0-23, days 1-31, months 1-12, weekdays 0-7 (0 and 7 both mean
- * Sunday). When both the day and weekday fields are restricted they combine
- * with OR semantics (standard cron). Invalid expressions parse to null and
- * are rejected by the UI/controller.
+ * Sunday). Invalid expressions parse to null and are rejected by the UI and
+ * the Host.
+ *
+ * Day semantics follow Vixie cron: a field is *starred* when its field text
+ * starts with `*`. When day-of-month and day-of-week are both restricted the
+ * fields combine with OR; otherwise they combine with AND. The distinction
+ * matters for a stepped star such as `*/2`, which still restricts the dates it
+ * matches, so `0 0 */2 * 1` means "the Mondays that fall on an even day of
+ * month" rather than "every even day, or every Monday".
+ *
+ * Time zone: every candidate wall clock is interpreted in an explicit IANA
+ * zone (the schedule's stored zone, or the Host zone when none is given).
+ * A wall clock that does not exist (spring-forward gap) is skipped, and an
+ * ambiguous wall clock (fall-back overlap) resolves to the earlier instant, so
+ * a repeated local minute fires exactly once. The Host-scheduler semantics are
+ * byte-identical to `@deepseek-ai/dsh-schedule`'s resolver, which was verified
+ * against it across twelve IANA zones (including 30-minute and 45-minute DST
+ * offsets and a date-line jump) and 300k decision instants.
+ *
+ * That upstream is on the experimental track and is NOT a dependency here (no
+ * import, no inject, no peer range), so a change to it fails no test. Re-run the
+ * differential check on any `dsh-schedule` release or cohort bump that moves it,
+ * and keep this comment honest; the re-verification trigger is recorded in
+ * [the owning Agent Note](../../../../.agents/notes/implemented/feature/2026-09-29-task-board-schedule-time-zone.md).
  */
 
 /** The parsed match sets of one cron expression. */
@@ -20,10 +41,10 @@ export interface CronSchedule {
   months: ReadonlySet<number>
   /** Weekdays 0-6, 0 = Sunday (input 7 normalized to 0). */
   weekdays: ReadonlySet<number>
-  /** Whether the day-of-month field was the literal '*' (unrestricted). */
-  dayWildcard: boolean
-  /** Whether the weekday field was the literal '*' (unrestricted). */
-  weekdayWildcard: boolean
+  /** Whether the day-of-month field text starts with `*` (Vixie starred). */
+  dayStarred: boolean
+  /** Whether the weekday field text starts with `*` (Vixie starred). */
+  weekdayStarred: boolean
 }
 
 /** Inclusive ranges per field, in cron order. */
@@ -35,6 +56,141 @@ const FIELD_RANGES: ReadonlyArray<readonly [number, number]> = [
   [0, 7], // weekdays (7 = Sunday, normalized below)
 ]
 
+/** Fallback zone when the process reports no usable IANA zone. */
+export const HOST_TIME_ZONE_FALLBACK = 'UTC'
+
+/** IANA `Area/Location`, plus the bare `UTC` the platform reports. */
+const IANA_ZONE = /^[A-Za-z][A-Za-z0-9_+.-]*(?:\/[A-Za-z0-9_+.-]+)+$/
+
+/** One resolved wall-clock reading in some zone. */
+export interface ZonedParts {
+  year: number
+  month: number
+  day: number
+  hour: number
+  minute: number
+}
+
+/** Cached formatters: constructing an Intl formatter dominates the cost of a resolve. */
+const FORMATTERS = new Map<string, Intl.DateTimeFormat>()
+
+function zoneFormatter(timeZone: string): Intl.DateTimeFormat {
+  let formatter = FORMATTERS.get(timeZone)
+  if (formatter === undefined) {
+    formatter = new Intl.DateTimeFormat('en-US', {
+      timeZone,
+      hourCycle: 'h23',
+      year: 'numeric',
+      month: '2-digit',
+      day: '2-digit',
+      hour: '2-digit',
+      minute: '2-digit',
+    })
+    FORMATTERS.set(timeZone, formatter)
+  }
+  return formatter
+}
+
+/**
+ * The wall-clock reading of one instant in an explicit zone. Reading through
+ * Intl (rather than the process `Date` accessors) is what makes the result
+ * independent of the Host's own TZ.
+ * @param timeZone - explicit IANA zone.
+ * @param epochMs - instant to read.
+ * @returns the zone-local calendar and clock fields.
+ */
+export function partsInZone(timeZone: string, epochMs: number): ZonedParts {
+  const fields: Record<string, string> = {}
+  for (const part of zoneFormatter(timeZone).formatToParts(new Date(epochMs))) {
+    if (part.type !== 'literal') fields[part.type] = part.value
+  }
+  return {
+    year: Number(fields.year),
+    month: Number(fields.month),
+    day: Number(fields.day),
+    hour: Number(fields.hour),
+    minute: Number(fields.minute),
+  }
+}
+
+/** The zone's UTC offset in effect at one instant, in milliseconds. */
+function offsetAt(timeZone: string, epochMs: number): number {
+  const parts = partsInZone(timeZone, epochMs)
+  return Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute) - epochMs
+}
+
+/**
+ * Resolve a wall clock in an explicit zone to its instant.
+ *
+ * The offset is probed a day either side of the naive guess so both DST
+ * transitions are covered, then every candidate offset whose inverse maps back
+ * to the requested wall clock is kept. No survivor means the wall clock does
+ * not exist (a spring-forward gap); several means it is ambiguous (a fall-back
+ * overlap), and the earliest instant wins so the repeated clock is taken once.
+ * @param timeZone - explicit IANA zone.
+ * @param year - full calendar year.
+ * @param month - 1-12.
+ * @param day - day of month.
+ * @param hour - 0-23.
+ * @param minute - 0-59.
+ * @returns the instant in ms epoch, or undefined when the wall clock is skipped.
+ */
+export function zonedEpoch(
+  timeZone: string,
+  year: number,
+  month: number,
+  day: number,
+  hour: number,
+  minute: number,
+): number | undefined {
+  const naive = Date.UTC(year, month - 1, day, hour, minute)
+  const offsets = new Set([
+    offsetAt(timeZone, naive - 86_400_000),
+    offsetAt(timeZone, naive),
+    offsetAt(timeZone, naive + 86_400_000),
+  ])
+  let earliest: number | undefined
+  for (const offset of offsets) {
+    const candidate = naive - offset
+    const parts = partsInZone(timeZone, candidate)
+    if (parts.year !== year || parts.month !== month || parts.day !== day) continue
+    if (parts.hour !== hour || parts.minute !== minute) continue
+    if (earliest === undefined || candidate < earliest) earliest = candidate
+  }
+  return earliest
+}
+
+/**
+ * The Host process's IANA zone, used for schedules that store no zone of their
+ * own (a ledger written before zones were persisted).
+ * @returns a zone name Intl accepts, never empty.
+ */
+export function resolveHostTimeZone(): string {
+  try {
+    const zone = Intl.DateTimeFormat().resolvedOptions().timeZone
+    return typeof zone === 'string' && zone !== '' ? zone : HOST_TIME_ZONE_FALLBACK
+  } catch {
+    return HOST_TIME_ZONE_FALLBACK
+  }
+}
+
+/**
+ * Whether a value names a zone this runtime can actually resolve. A stored
+ * zone is trusted only after it round-trips through Intl, so a typo or a zone
+ * that this ICU build does not know can never arm a schedule.
+ * @param value - candidate zone name.
+ * @returns true when the name is usable.
+ */
+export function isValidTimeZone(value: string): boolean {
+  if (value.trim() !== value || value === '') return false
+  if (value !== 'UTC' && !IANA_ZONE.test(value)) return false
+  try {
+    return new Intl.DateTimeFormat('en-US', { timeZone: value }).resolvedOptions().timeZone !== undefined
+  } catch {
+    return false
+  }
+}
+
 /**
  * Parse a 5-field cron expression.
  * @returns the match sets, or null when the expression is invalid.
@@ -57,11 +213,11 @@ export function parseCron(expr: string): CronSchedule | null {
     days: sets[2],
     months: sets[3],
     weekdays,
-    // Only the literal '*' marks a field unrestricted: an explicit full
-    // enumeration such as '1-31' is a restricted field and must not collapse
-    // into the wildcard (it participates in day/weekday OR semantics).
-    dayWildcard: fields[2] === '*',
-    weekdayWildcard: fields[4] === '*',
+    // Vixie selects the day branch from the field TEXT: only a field starting
+    // with '*' is starred. A written-out range such as '1-31' is restricted and
+    // still participates in the OR/AND choice.
+    dayStarred: fields[2].startsWith('*'),
+    weekdayStarred: fields[4].startsWith('*'),
   }
 }
 
@@ -71,57 +227,61 @@ export function isValidCron(expr: string): boolean {
 }
 
 /**
- * Compute the next matching instant after `fromMs` (ms epoch), in local time,
- * at minute granularity, strictly greater than `fromMs`. Returns the ms epoch
- * of the matching minute's start, or undefined when the calendar constraint
- * can never match (for example `0 0 30 2 *`). The five-year horizon includes
- * a full leap cycle, so a valid February 29 schedule remains reachable from
- * every non-leap year.
+ * Compute the next matching instant after `fromMs` strictly greater than it,
+ * interpreting the expression's wall clock in `timeZone` (the Host zone when
+ * omitted). Returns the ms epoch of the matching minute's start, or undefined
+ * when the calendar constraint can never match (for example `0 0 30 2 *`).
+ * The five-year horizon includes a full leap cycle, so a valid February 29
+ * schedule remains reachable from every non-leap year.
  *
  * Walks candidate year/month/day/hour/minute values straight from the parsed
  * field sets instead of scanning every minute: a sparse expression such as
  * `0 0 29 2 *` used to iterate ~1.5M wall-clock minutes before reaching the
- * next leap day. Wall-clock field construction + the final `matches` re-check
- * preserve the old minute scan's DST semantics exactly (nonexistent spring
- * minutes normalize forward and the repeated fall-back hour is never visited).
+ * next leap day. A candidate wall clock that the zone skips (spring-forward
+ * gap) is passed over, which is what makes the gap semantics fall out of the
+ * candidate walk rather than needing a separate rule.
+ * @param expr - 5-field cron expression.
+ * @param fromMs - exclusive lower bound, ms epoch.
+ * @param timeZone - explicit IANA zone; defaults to the Host zone.
+ * @returns the next trigger instant, or undefined when unreachable.
  */
-export function nextRunAtMs(expr: string, fromMs: number): number | undefined {
+export function nextRunAtMs(expr: string, fromMs: number, timeZone?: string): number | undefined {
   const schedule = parseCron(expr)
   if (schedule === null) return undefined
   if (!hasPossibleCalendarDay(schedule)) return undefined
-  const from = new Date(fromMs)
+  const zone = timeZone ?? resolveHostTimeZone()
+  const start = partsInZone(zone, fromMs)
   const limitMs = fromMs + 5 * 366 * 24 * 60 * 60 * 1000
 
   const sortedMinutes = [...schedule.minutes].sort((a, b) => a - b)
   const sortedHours = [...schedule.hours].sort((a, b) => a - b)
   const sortedMonths = [...schedule.months].sort((a, b) => a - b)
 
-  let year = from.getFullYear()
-  let month = from.getMonth() + 1
-  let day = from.getDate()
-  let hour = from.getHours()
-  // Strictly after fromMs: the old scan started from the next minute.
-  let minute = from.getMinutes() + 1
+  let year = start.year
+  let month = start.month
+  let day = start.day
+  let hour = start.hour
+  // Strictly after fromMs: the walk starts from the next minute.
+  let minute = start.minute + 1
 
-  while (new Date(year, month - 1, 1, 0, 0, 0, 0).getTime() <= limitMs) {
+  while (Date.UTC(year, month - 1, 1) <= limitMs + 86_400_000) {
     for (const candidateMonth of sortedMonths) {
       if (candidateMonth < month) continue
-      const daysInMonth = new Date(year, candidateMonth, 0).getDate()
+      const daysInMonth = new Date(Date.UTC(year, candidateMonth, 0)).getUTCDate()
       const dayStart = candidateMonth === month ? day : 1
       for (let candidateDay = dayStart; candidateDay <= daysInMonth; candidateDay += 1) {
-        const dayProbe = new Date(year, candidateMonth - 1, candidateDay, 0, 0, 0, 0)
-        if (!dayCandidate(schedule, dayProbe)) continue
+        if (!dayCandidate(schedule, year, candidateMonth, candidateDay)) continue
         const hourStart = candidateMonth === month && candidateDay === day ? hour : 0
         for (const candidateHour of sortedHours) {
           if (candidateHour < hourStart) continue
           const minuteStart = candidateMonth === month && candidateDay === day && candidateHour === hour ? minute : 0
           for (const candidateMinute of sortedMinutes) {
             if (candidateMinute < minuteStart) continue
-            const candidate = new Date(year, candidateMonth - 1, candidateDay, candidateHour, candidateMinute, 0, 0)
-            const time = candidate.getTime()
+            const time = zonedEpoch(zone, year, candidateMonth, candidateDay, candidateHour, candidateMinute)
+            if (time === undefined) continue
             if (time <= fromMs) continue
             if (time > limitMs) return undefined
-            if (matches(schedule, candidate)) return time
+            return time
           }
         }
       }
@@ -135,18 +295,22 @@ export function nextRunAtMs(expr: string, fromMs: number): number | undefined {
   return undefined
 }
 
-/** Day/weekday OR gate shared by {@link matches} and the candidate scan. */
-function dayCandidate(schedule: CronSchedule, date: Date): boolean {
-  const dayMatches = schedule.days.has(date.getDate())
-  const weekdayMatches = schedule.weekdays.has(date.getDay())
-  if (schedule.dayWildcard) return weekdayMatches
-  if (schedule.weekdayWildcard) return dayMatches
-  return dayMatches || weekdayMatches
+/**
+ * The Vixie day gate shared by the candidate walk. Both fields restricted is
+ * OR; any other combination is AND, because a starred field matches every
+ * value and so cannot widen the result.
+ */
+function dayCandidate(schedule: CronSchedule, year: number, month: number, day: number): boolean {
+  const dayMatches = schedule.days.has(day)
+  // Day of week is a property of the calendar date, so it is zone-independent.
+  const weekdayMatches = schedule.weekdays.has(new Date(Date.UTC(year, month - 1, day)).getUTCDay())
+  if (!schedule.dayStarred && !schedule.weekdayStarred) return dayMatches || weekdayMatches
+  return dayMatches && weekdayMatches
 }
 
 /** Reject impossible month/day pairs without spending the multi-year scan. */
 function hasPossibleCalendarDay(schedule: CronSchedule): boolean {
-  if (schedule.dayWildcard || !schedule.weekdayWildcard) return true
+  if (schedule.dayStarred || !schedule.weekdayStarred) return true
   const maximumDay = new Map<number, number>([
     [1, 31], [2, 29], [3, 31], [4, 30], [5, 31], [6, 30],
     [7, 31], [8, 31], [9, 30], [10, 31], [11, 30], [12, 31],
@@ -194,14 +358,6 @@ function parseField(field: string, min: number, max: number, out: Set<number>):
   return true
 }
 
-/** Day/weekday OR semantics: a restricted day field alone gates, and vice versa. */
-function matches(schedule: CronSchedule, date: Date): boolean {
-  if (!schedule.minutes.has(date.getMinutes())) return false
-  if (!schedule.hours.has(date.getHours())) return false
-  if (!schedule.months.has(date.getMonth() + 1)) return false
-  return dayCandidate(schedule, date)
-}
-
 function isDigits(value: string): boolean {
   return /^\d+$/.test(value)
 }

package/src/core/store.ts

@@ -9,7 +9,7 @@
  * channel later); tests run against the in-memory backend and a jsdom
  * localStorage backend.
  */
-import { isValidCron } from './schedule.ts'
+import { isValidCron, isValidTimeZone } from './schedule.ts'
 import { isTaskPermission, isTaskStatus, normalizeTags, normalizeTargetId, type ScheduleRule, type TaskFreeze, type TaskRecord, type TaskPermission, type TaskStatus } from './tasks.ts'
 import { isExecutionOutcome } from './subtask.ts'
 import type { TaskHandover } from './handover.ts'
@@ -68,6 +68,7 @@ function isTaskRecordShape(value: unknown): value is Omit<TaskRecord, 'status'>
   if (record.mode !== undefined && typeof record.mode !== 'string') return false
   if (record.permission !== undefined && typeof record.permission !== 'string') return false
   if (record.reuseSession !== undefined && typeof record.reuseSession !== 'boolean') return false
+  if (record.goalRun !== undefined && typeof record.goalRun !== 'boolean') return false
   if (!Array.isArray(record.executions)) return false
   for (const execution of record.executions) {
     if (typeof execution !== 'object' || execution === null) return false
@@ -108,9 +109,14 @@ function normalizeSchedule(schedule: unknown): ScheduleRule | undefined {
   // schedule instead of being dropped for later repair.
   if (typeof rule.cron !== 'string') return undefined
   if (rule.cron.trim() === '' || !isValidCron(rule.cron)) return undefined
+  // A stored zone survives only when this runtime can resolve it; an unusable
+  // name is dropped (the rule then follows the Host zone) instead of being
+  // kept to fail every later resolve.
+  const timeZone = typeof rule.timeZone === 'string' && isValidTimeZone(rule.timeZone) ? rule.timeZone : undefined
   return {
     enabled: rule.enabled === true,
     cron: rule.cron,
+    ...(timeZone === undefined ? {} : { timeZone }),
     nextRunAt: typeof rule.nextRunAt === 'number' ? rule.nextRunAt : undefined,
     lastTriggeredAt: typeof rule.lastTriggeredAt === 'number' ? rule.lastTriggeredAt : undefined,
   }
@@ -202,6 +208,9 @@ export function parseLedger(raw: string | null): TaskRecord[] {
     task.archivedAt = typeof row.archivedAt === 'number' && Number.isFinite(row.archivedAt) ? row.archivedAt : undefined
     task.permission = isTaskPermission(row.permission) ? row.permission as TaskPermission : undefined
     task.reuseSession = row.reuseSession === true ? true : undefined
+    // The goal opt-in is stored only when it is OFF: absent means the default
+    // (start each run with /goal), so a hand-edited true normalizes back to it.
+    task.goalRun = row.goalRun === false ? false : undefined
     task.freeze = normalizeFreeze(row.freeze)
     task.handover = normalizeHandover(row.handover)
     // Tags are repaired field by field like the schedule: a malformed entry is