@linxin666/dsh-client-ui-task-board 0.4.2 → 0.4.4

package/lib/index.js

@@ -16,6 +16,112 @@ const FIELD_RANGES = [
 	[1, 12],
 	[0, 7]
 ];
+/** IANA `Area/Location`, plus the bare `UTC` the platform reports. */
+const IANA_ZONE = /^[A-Za-z][A-Za-z0-9_+.-]*(?:\/[A-Za-z0-9_+.-]+)+$/;
+/** Cached formatters: constructing an Intl formatter dominates the cost of a resolve. */
+const FORMATTERS = /* @__PURE__ */ new Map();
+function zoneFormatter(timeZone) {
+	let formatter = FORMATTERS.get(timeZone);
+	if (formatter === void 0) {
+		formatter = new Intl.DateTimeFormat("en-US", {
+			timeZone,
+			hourCycle: "h23",
+			year: "numeric",
+			month: "2-digit",
+			day: "2-digit",
+			hour: "2-digit",
+			minute: "2-digit"
+		});
+		FORMATTERS.set(timeZone, formatter);
+	}
+	return formatter;
+}
+/**
+* The wall-clock reading of one instant in an explicit zone. Reading through
+* Intl (rather than the process `Date` accessors) is what makes the result
+* independent of the Host's own TZ.
+* @param timeZone - explicit IANA zone.
+* @param epochMs - instant to read.
+* @returns the zone-local calendar and clock fields.
+*/
+function partsInZone(timeZone, epochMs) {
+	const fields = {};
+	for (const part of zoneFormatter(timeZone).formatToParts(new Date(epochMs))) if (part.type !== "literal") fields[part.type] = part.value;
+	return {
+		year: Number(fields.year),
+		month: Number(fields.month),
+		day: Number(fields.day),
+		hour: Number(fields.hour),
+		minute: Number(fields.minute)
+	};
+}
+/** The zone's UTC offset in effect at one instant, in milliseconds. */
+function offsetAt(timeZone, epochMs) {
+	const parts = partsInZone(timeZone, epochMs);
+	return Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute) - epochMs;
+}
+/**
+* Resolve a wall clock in an explicit zone to its instant.
+*
+* The offset is probed a day either side of the naive guess so both DST
+* transitions are covered, then every candidate offset whose inverse maps back
+* to the requested wall clock is kept. No survivor means the wall clock does
+* not exist (a spring-forward gap); several means it is ambiguous (a fall-back
+* overlap), and the earliest instant wins so the repeated clock is taken once.
+* @param timeZone - explicit IANA zone.
+* @param year - full calendar year.
+* @param month - 1-12.
+* @param day - day of month.
+* @param hour - 0-23.
+* @param minute - 0-59.
+* @returns the instant in ms epoch, or undefined when the wall clock is skipped.
+*/
+function zonedEpoch(timeZone, year, month, day, hour, minute) {
+	const naive = Date.UTC(year, month - 1, day, hour, minute);
+	const offsets = /* @__PURE__ */ new Set([
+		offsetAt(timeZone, naive - 864e5),
+		offsetAt(timeZone, naive),
+		offsetAt(timeZone, naive + 864e5)
+	]);
+	let earliest;
+	for (const offset of offsets) {
+		const candidate = naive - offset;
+		const parts = partsInZone(timeZone, candidate);
+		if (parts.year !== year || parts.month !== month || parts.day !== day) continue;
+		if (parts.hour !== hour || parts.minute !== minute) continue;
+		if (earliest === void 0 || candidate < earliest) earliest = candidate;
+	}
+	return earliest;
+}
+/**
+* The Host process's IANA zone, used for schedules that store no zone of their
+* own (a ledger written before zones were persisted).
+* @returns a zone name Intl accepts, never empty.
+*/
+function resolveHostTimeZone() {
+	try {
+		const zone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+		return typeof zone === "string" && zone !== "" ? zone : "UTC";
+	} catch {
+		return "UTC";
+	}
+}
+/**
+* Whether a value names a zone this runtime can actually resolve. A stored
+* zone is trusted only after it round-trips through Intl, so a typo or a zone
+* that this ICU build does not know can never arm a schedule.
+* @param value - candidate zone name.
+* @returns true when the name is usable.
+*/
+function isValidTimeZone(value) {
+	if (value.trim() !== value || value === "") return false;
+	if (value !== "UTC" && !IANA_ZONE.test(value)) return false;
+	try {
+		return new Intl.DateTimeFormat("en-US", { timeZone: value }).resolvedOptions().timeZone !== void 0;
+	} catch {
+		return false;
+	}
+}
 /**
 * Parse a 5-field cron expression.
 * @returns the match sets, or null when the expression is invalid.
@@ -38,8 +144,8 @@ function parseCron(expr) {
 		days: sets[2],
 		months: sets[3],
 		weekdays,
-		dayWildcard: fields[2] === "*",
-		weekdayWildcard: fields[4] === "*"
+		dayStarred: fields[2].startsWith("*"),
+		weekdayStarred: fields[4].startsWith("*")
 	};
 }
 /** Whether the expression parses. */
@@ -47,52 +153,57 @@ function isValidCron(expr) {
 	return parseCron(expr) !== null;
 }
 /**
-* Compute the next matching instant after `fromMs` (ms epoch), in local time,
-* at minute granularity, strictly greater than `fromMs`. Returns the ms epoch
-* of the matching minute's start, or undefined when the calendar constraint
-* can never match (for example `0 0 30 2 *`). The five-year horizon includes
-* a full leap cycle, so a valid February 29 schedule remains reachable from
-* every non-leap year.
+* Compute the next matching instant after `fromMs` strictly greater than it,
+* interpreting the expression's wall clock in `timeZone` (the Host zone when
+* omitted). Returns the ms epoch of the matching minute's start, or undefined
+* when the calendar constraint can never match (for example `0 0 30 2 *`).
+* The five-year horizon includes a full leap cycle, so a valid February 29
+* schedule remains reachable from every non-leap year.
 *
 * Walks candidate year/month/day/hour/minute values straight from the parsed
 * field sets instead of scanning every minute: a sparse expression such as
 * `0 0 29 2 *` used to iterate ~1.5M wall-clock minutes before reaching the
-* next leap day. Wall-clock field construction + the final `matches` re-check
-* preserve the old minute scan's DST semantics exactly (nonexistent spring
-* minutes normalize forward and the repeated fall-back hour is never visited).
+* next leap day. A candidate wall clock that the zone skips (spring-forward
+* gap) is passed over, which is what makes the gap semantics fall out of the
+* candidate walk rather than needing a separate rule.
+* @param expr - 5-field cron expression.
+* @param fromMs - exclusive lower bound, ms epoch.
+* @param timeZone - explicit IANA zone; defaults to the Host zone.
+* @returns the next trigger instant, or undefined when unreachable.
 */
-function nextRunAtMs(expr, fromMs) {
+function nextRunAtMs(expr, fromMs, timeZone) {
 	const schedule = parseCron(expr);
 	if (schedule === null) return void 0;
 	if (!hasPossibleCalendarDay(schedule)) return void 0;
-	const from = new Date(fromMs);
+	const zone = timeZone ?? resolveHostTimeZone();
+	const start = partsInZone(zone, fromMs);
 	const limitMs = fromMs + 5 * 366 * 24 * 60 * 60 * 1e3;
 	const sortedMinutes = [...schedule.minutes].sort((a, b) => a - b);
 	const sortedHours = [...schedule.hours].sort((a, b) => a - b);
 	const sortedMonths = [...schedule.months].sort((a, b) => a - b);
-	let year = from.getFullYear();
-	let month = from.getMonth() + 1;
-	let day = from.getDate();
-	let hour = from.getHours();
-	let minute = from.getMinutes() + 1;
-	while (new Date(year, month - 1, 1, 0, 0, 0, 0).getTime() <= limitMs) {
+	let year = start.year;
+	let month = start.month;
+	let day = start.day;
+	let hour = start.hour;
+	let minute = start.minute + 1;
+	while (Date.UTC(year, month - 1, 1) <= limitMs + 864e5) {
 		for (const candidateMonth of sortedMonths) {
 			if (candidateMonth < month) continue;
-			const daysInMonth = new Date(year, candidateMonth, 0).getDate();
+			const daysInMonth = new Date(Date.UTC(year, candidateMonth, 0)).getUTCDate();
 			const dayStart = candidateMonth === month ? day : 1;
 			for (let candidateDay = dayStart; candidateDay <= daysInMonth; candidateDay += 1) {
-				if (!dayCandidate(schedule, new Date(year, candidateMonth - 1, candidateDay, 0, 0, 0, 0))) continue;
+				if (!dayCandidate(schedule, year, candidateMonth, candidateDay)) continue;
 				const hourStart = candidateMonth === month && candidateDay === day ? hour : 0;
 				for (const candidateHour of sortedHours) {
 					if (candidateHour < hourStart) continue;
 					const minuteStart = candidateMonth === month && candidateDay === day && candidateHour === hour ? minute : 0;
 					for (const candidateMinute of sortedMinutes) {
 						if (candidateMinute < minuteStart) continue;
-						const candidate = new Date(year, candidateMonth - 1, candidateDay, candidateHour, candidateMinute, 0, 0);
-						const time = candidate.getTime();
+						const time = zonedEpoch(zone, year, candidateMonth, candidateDay, candidateHour, candidateMinute);
+						if (time === void 0) continue;
 						if (time <= fromMs) continue;
 						if (time > limitMs) return void 0;
-						if (matches(schedule, candidate)) return time;
+						return time;
 					}
 				}
 			}
@@ -104,17 +215,20 @@ function nextRunAtMs(expr, fromMs) {
 		minute = 0;
 	}
 }
-/** Day/weekday OR gate shared by {@link matches} and the candidate scan. */
-function dayCandidate(schedule, date) {
-	const dayMatches = schedule.days.has(date.getDate());
-	const weekdayMatches = schedule.weekdays.has(date.getDay());
-	if (schedule.dayWildcard) return weekdayMatches;
-	if (schedule.weekdayWildcard) return dayMatches;
-	return dayMatches || weekdayMatches;
+/**
+* The Vixie day gate shared by the candidate walk. Both fields restricted is
+* OR; any other combination is AND, because a starred field matches every
+* value and so cannot widen the result.
+*/
+function dayCandidate(schedule, year, month, day) {
+	const dayMatches = schedule.days.has(day);
+	const weekdayMatches = schedule.weekdays.has(new Date(Date.UTC(year, month - 1, day)).getUTCDay());
+	if (!schedule.dayStarred && !schedule.weekdayStarred) return dayMatches || weekdayMatches;
+	return dayMatches && weekdayMatches;
 }
 /** Reject impossible month/day pairs without spending the multi-year scan. */
 function hasPossibleCalendarDay(schedule) {
-	if (schedule.dayWildcard || !schedule.weekdayWildcard) return true;
+	if (schedule.dayStarred || !schedule.weekdayStarred) return true;
 	const maximumDay = /* @__PURE__ */ new Map([
 		[1, 31],
 		[2, 29],
@@ -165,13 +279,6 @@ function parseField(field, min, max, out) {
 	}
 	return true;
 }
-/** Day/weekday OR semantics: a restricted day field alone gates, and vice versa. */
-function matches(schedule, date) {
-	if (!schedule.minutes.has(date.getMinutes())) return false;
-	if (!schedule.hours.has(date.getHours())) return false;
-	if (!schedule.months.has(date.getMonth() + 1)) return false;
-	return dayCandidate(schedule, date);
-}
 function isDigits(value) {
 	return /^\d+$/.test(value);
 }
@@ -379,6 +486,7 @@ function createTask(input, now, id) {
 		model: normalizeTargetId(input.model),
 		reuseSession: input.reuseSession === true ? true : void 0,
 		teamRun: input.teamRun === true ? true : void 0,
+		goalRun: input.goalRun === false ? false : void 0,
 		...input.freeze === void 0 ? {} : { freeze: freezeOf(input.freeze, now) },
 		...input.handover === void 0 ? {} : { handover: {
 			...input.handover,
@@ -406,11 +514,14 @@ function withSchedule(task, patch, now) {
 	const schedule = {
 		enabled: current?.enabled ?? false,
 		cron: current?.cron ?? "",
+		...current?.timeZone === void 0 ? {} : { timeZone: current.timeZone },
 		nextRunAt: current?.nextRunAt,
 		lastTriggeredAt: current?.lastTriggeredAt
 	};
 	if ("enabled" in patch) schedule.enabled = patch.enabled ?? false;
 	if ("cron" in patch) schedule.cron = patch.cron ?? "";
+	if ("timeZone" in patch) if (patch.timeZone === void 0) delete schedule.timeZone;
+	else schedule.timeZone = patch.timeZone;
 	if ("nextRunAt" in patch) schedule.nextRunAt = patch.nextRunAt;
 	if ("lastTriggeredAt" in patch) schedule.lastTriggeredAt = patch.lastTriggeredAt;
 	return {
@@ -501,8 +612,8 @@ function indexOf(tasks) {
 * under a larger limit survives that limit being lowered, and restore and
 * inheritance must still see all of it.
 */
-function ancestorChain(tasks, task) {
-	const index = indexOf(tasks);
+function ancestorChain(tasks, task, lineage) {
+	const index = lineage?.byId ?? indexOf(tasks);
 	const chain = [];
 	const seen = /* @__PURE__ */ new Set([task.id]);
 	let current = task.parentId === void 0 ? void 0 : index.get(task.parentId);
@@ -515,29 +626,33 @@ function ancestorChain(tasks, task) {
 	return chain;
 }
 /** Root-to-task depth: a root task is 0, its subtask 1, and so on. */
-function taskDepth(tasks, id) {
-	const task = indexOf(tasks).get(id);
-	return task === void 0 ? 0 : ancestorChain(tasks, task).length;
+function taskDepth(tasks, id, lineage) {
+	const task = (lineage?.byId ?? indexOf(tasks)).get(id);
+	return task === void 0 ? 0 : ancestorChain(tasks, task, lineage).length;
 }
 /** Direct subtasks of a task, in ledger order. */
-function directSubtasks(tasks, id) {
+function directSubtasks(tasks, id, lineage) {
+	if (lineage !== void 0) return [...lineage.childrenByParent.get(id) ?? []];
 	return tasks.filter((task) => task.parentId === id);
 }
 /**
 * Descendants of a task in breadth-first order, bounded by maxSubtaskDepth
 * total depth. The visited set keeps a malformed ledger from looping.
 */
-function descendantTasks(tasks, id, maxSubtaskDepth) {
+function descendantTasks(tasks, id, maxSubtaskDepth, lineage) {
 	const visited = /* @__PURE__ */ new Set([id]);
 	const found = [];
 	let frontier = [id];
 	for (let depth = 1; depth <= maxSubtaskDepth && frontier.length > 0; depth += 1) {
 		const next = [];
-		for (const parentId of frontier) for (const task of tasks) {
-			if (task.parentId !== parentId || visited.has(task.id)) continue;
-			visited.add(task.id);
-			found.push(task);
-			next.push(task.id);
+		for (const parentId of frontier) {
+			const children = lineage === void 0 ? tasks.filter((task) => task.parentId === parentId) : lineage.childrenByParent.get(parentId) ?? [];
+			for (const task of children) {
+				if (visited.has(task.id)) continue;
+				visited.add(task.id);
+				found.push(task);
+				next.push(task.id);
+			}
 		}
 		frontier = next;
 	}
@@ -548,13 +663,13 @@ function descendantTasks(tasks, id, maxSubtaskDepth) {
 * The visited set makes the walk terminate on a cyclic hand-edited ledger
 * instead of recursing until the stack overflows.
 */
-function subtreeHeight(tasks, id, visited = /* @__PURE__ */ new Set()) {
+function subtreeHeight(tasks, id, visited = /* @__PURE__ */ new Set(), lineage) {
 	if (visited.has(id)) return 0;
 	const seen = /* @__PURE__ */ new Set([...visited, id]);
-	const children = directSubtasks(tasks, id);
+	const children = directSubtasks(tasks, id, lineage);
 	if (children.length === 0) return 0;
 	let height = 0;
-	for (const child of children) height = Math.max(height, 1 + subtreeHeight(tasks, child.id, seen));
+	for (const child of children) height = Math.max(height, 1 + subtreeHeight(tasks, child.id, seen, lineage));
 	return Math.min(height, 3);
 }
 /**
@@ -564,8 +679,8 @@ function subtreeHeight(tasks, id, visited = /* @__PURE__ */ new Set()) {
 * and the resulting depth (parent depth + 1 + the child own subtree height)
 * must stay within maxSubtaskDepth.
 */
-function checkParentLink(tasks, childId, parentId, maxSubtaskDepth) {
-	if (tasks.find((task) => task.id === childId) === void 0) return {
+function checkParentLink(tasks, childId, parentId, maxSubtaskDepth, lineage) {
+	if ((lineage === void 0 ? tasks.find((task) => task.id === childId) : lineage.byId.get(childId)) === void 0) return {
 		ok: false,
 		reason: "unknown-task"
 	};
@@ -574,7 +689,7 @@ function checkParentLink(tasks, childId, parentId, maxSubtaskDepth) {
 		ok: false,
 		reason: "self-parent"
 	};
-	const parent = tasks.find((task) => task.id === parentId);
+	const parent = lineage === void 0 ? tasks.find((task) => task.id === parentId) : lineage.byId.get(parentId);
 	if (parent === void 0) return {
 		ok: false,
 		reason: "unknown-parent"
@@ -583,11 +698,11 @@ function checkParentLink(tasks, childId, parentId, maxSubtaskDepth) {
 		ok: false,
 		reason: "archived-parent"
 	};
-	if (descendantTasks(tasks, childId, 3).some((task) => task.id === parentId)) return {
+	if (descendantTasks(tasks, childId, 3, lineage).some((task) => task.id === parentId)) return {
 		ok: false,
 		reason: "cycle"
 	};
-	if (taskDepth(tasks, parentId) + 1 + subtreeHeight(tasks, childId) > maxSubtaskDepth) return {
+	if (taskDepth(tasks, parentId, lineage) + 1 + subtreeHeight(tasks, childId, /* @__PURE__ */ new Set(), lineage) > maxSubtaskDepth) return {
 		ok: false,
 		reason: "depth-exceeded"
 	};
@@ -671,18 +786,44 @@ function effectiveTaskPermission(task) {
 */
 /**
 * The immutable teammate name for one team-mode member. Teammate names are
-* lower-kebab-case and must stay unique for the lifetime of the Team, so the
-* run-group token is appended: two runs of the same tree never collide. A title
-* with no ASCII word characters (a CJK title, for example) keeps a stable
-* generic prefix and is still distinguished by the token.
+* lower-kebab-case and must stay unique for the lifetime of the Team: the
+* run-group token separates two runs of the same tree, and the member
+* discriminator separates two members of one run that reduce to the same slug.
+*
+* The discriminator is not cosmetic. A title with no ASCII word characters (a
+* CJK title, for example) carries no slug at all, so every such title of one
+* run group collides on the generic prefix; Agent Teams answers every member
+* after the first with `teammate name "..." was already used in this Team`,
+* and those subtasks never start. Two ASCII titles that share a slug
+* (`AI 强度预测` next to `AI 配比优化`) collide the same way.
 * @param title - the member task's title.
 * @param token - the run group id (the task id when no group is recorded).
+* @param memberId - the member task's id, which makes the name unique in the run.
 * @returns the teammate name handed to the Agent Teams service.
 */
-function teammateName(title, token) {
+function teammateName(title, token, memberId) {
 	const slug = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32).replace(/-+$/g, "");
 	const suffix = token.replace(/[^a-z0-9]/gi, "").slice(0, 8).toLowerCase();
-	return `${slug === "" ? "subtask" : slug}-${suffix === "" ? "run" : suffix}`;
+	const member = memberId === void 0 || memberId === "" ? void 0 : stableTag(memberId);
+	return [
+		slug === "" ? "subtask" : slug,
+		member,
+		suffix === "" ? "run" : suffix
+	].filter((part) => part !== void 0).join("-");
+}
+/**
+* A stable 4-hex tag for one member id. The name is derived twice for the same
+* member — once for the Lead's prompt and once for the spawn request — so the
+* tag must be a pure function of the id, never of a clock or a counter. FNV-1a
+* keeps it dependency-free in `core/`, which both halves compile.
+*/
+function stableTag(value) {
+	let hash = 2166136261;
+	for (let index = 0; index < value.length; index += 1) {
+		hash ^= value.charCodeAt(index);
+		hash = Math.imul(hash, 16777619) >>> 0;
+	}
+	return hash.toString(16).padStart(8, "0").slice(0, 4);
 }
 function resolveExecutionTargets(task, tasks, maxSubtaskDepth = 3) {
 	if (task.parentId === void 0) return task;
@@ -910,6 +1051,7 @@ function isTaskRecordShape(value) {
 	if (record.mode !== void 0 && typeof record.mode !== "string") return false;
 	if (record.permission !== void 0 && typeof record.permission !== "string") return false;
 	if (record.reuseSession !== void 0 && typeof record.reuseSession !== "boolean") return false;
+	if (record.goalRun !== void 0 && typeof record.goalRun !== "boolean") return false;
 	if (!Array.isArray(record.executions)) return false;
 	for (const execution of record.executions) {
 		if (typeof execution !== "object" || execution === null) return false;
@@ -944,9 +1086,11 @@ function normalizeSchedule(schedule) {
 	const rule = schedule;
 	if (typeof rule.cron !== "string") return void 0;
 	if (rule.cron.trim() === "" || !isValidCron(rule.cron)) return void 0;
+	const timeZone = typeof rule.timeZone === "string" && isValidTimeZone(rule.timeZone) ? rule.timeZone : void 0;
 	return {
 		enabled: rule.enabled === true,
 		cron: rule.cron,
+		...timeZone === void 0 ? {} : { timeZone },
 		nextRunAt: typeof rule.nextRunAt === "number" ? rule.nextRunAt : void 0,
 		lastTriggeredAt: typeof rule.lastTriggeredAt === "number" ? rule.lastTriggeredAt : void 0
 	};
@@ -1031,6 +1175,7 @@ function parseLedger(raw) {
 		task.archivedAt = typeof row.archivedAt === "number" && Number.isFinite(row.archivedAt) ? row.archivedAt : void 0;
 		task.permission = isTaskPermission(row.permission) ? row.permission : void 0;
 		task.reuseSession = row.reuseSession === true ? true : void 0;
+		task.goalRun = row.goalRun === false ? false : void 0;
 		task.freeze = normalizeFreeze(row.freeze);
 		task.handover = normalizeHandover(row.handover);
 		task.tags = normalizeTags(row.tags);
@@ -1145,8 +1290,9 @@ function applyRestoreTask(tasks, id, now, maxSubtaskDepth = 1) {
 * @param now - clock instant (ms epoch).
 * @param id - minted task id.
 * @param maxSubtaskDepth - deployment subtask depth limit.
+* @param hostTimeZone - zone a rule that stores no zone of its own follows.
 */
-function applyCreateTask(tasks, input, now, id, maxSubtaskDepth = 1) {
+function applyCreateTask(tasks, input, now, id, maxSubtaskDepth = 1, hostTimeZone = resolveHostTimeZone()) {
 	if (input.title.trim() === "") return {
 		task: void 0,
 		tasks,
@@ -1181,10 +1327,18 @@ function applyCreateTask(tasks, input, now, id, maxSubtaskDepth = 1) {
 	const requested = input.schedule;
 	if (requested?.enabled === true && requested.cron.trim() !== "" && isValidCron(requested.cron)) {
 		const cron = requested.cron.trim();
-		task = withSchedule(task, {
+		const requestedZone = requested.timeZone;
+		if (requestedZone !== void 0 && !isValidTimeZone(requestedZone)) return {
+			task: void 0,
+			tasks,
+			error: "invalid schedule time zone"
+		};
+		const nextRunAt = nextRunAtMs(cron, now, requestedZone ?? hostTimeZone);
+		if (nextRunAt !== void 0) task = withSchedule(task, {
 			enabled: true,
 			cron,
-			nextRunAt: nextRunAtMs(cron, now)
+			timeZone: requestedZone,
+			nextRunAt
 		}, now);
 	}
 	return {
@@ -1222,15 +1376,17 @@ function applyDeleteTask(tasks, selectedTaskId, id) {
 * the core cron parser (schedule.ts) and the withSchedule transition.
 */
 /**
-* Set an on-board task's schedule rule. A blank or invalid cron, or an
-* archived task, is rejected (state untouched); an enabled rule computes the
-* next run instant immediately, a disabled one carries no next-run instant.
+* Set an on-board task's schedule rule. A blank or invalid cron, an unknown or
+* archived task, or an unusable zone is rejected (state untouched); an enabled
+* rule computes the next run instant immediately in the rule's own zone, a
+* disabled one carries no next-run instant.
 * @param tasks - current ledger.
 * @param id - the task to schedule.
 * @param patch - rule fields to change (absent fields keep their current value).
 * @param now - clock instant (ms epoch).
+* @param hostTimeZone - zone a rule with no stored zone follows.
 */
-function applySetSchedule(tasks, id, patch, now) {
+function applySetSchedule(tasks, id, patch, now, hostTimeZone) {
 	const task = tasks.find((candidate) => candidate.id === id);
 	if (task === void 0 || task.archivedAt !== void 0) return {
 		tasks,
@@ -1242,8 +1398,13 @@ function applySetSchedule(tasks, id, patch, now) {
 		tasks,
 		applied: false
 	};
+	const requestedZone = patch.timeZone === void 0 ? current?.timeZone : patch.timeZone ?? void 0;
+	if (requestedZone !== void 0 && !isValidTimeZone(requestedZone)) return {
+		tasks,
+		applied: false
+	};
 	const enabled = patch.enabled ?? current?.enabled ?? false;
-	const nextRunAt = enabled ? nextRunAtMs(cron, now) : void 0;
+	const nextRunAt = enabled ? nextRunAtMs(cron, now, requestedZone ?? hostTimeZone) : void 0;
 	if (enabled && nextRunAt === void 0) return {
 		tasks,
 		applied: false
@@ -1252,6 +1413,7 @@ function applySetSchedule(tasks, id, patch, now) {
 		tasks: tasks.map((candidate) => candidate.id === id ? withSchedule(candidate, {
 			enabled,
 			cron,
+			timeZone: requestedZone ?? void 0,
 			nextRunAt
 		}, now) : candidate),
 		applied: true
@@ -1411,6 +1573,7 @@ function applyUpdateTask(tasks, id, patch, now) {
 		if ("permission" in patch && patch.permission !== void 0 && patch.permission !== task.permission || "handover" in patch) next.permissionConfirmedAt = void 0;
 		if ("reuseSession" in patch) next.reuseSession = patch.reuseSession === true ? true : void 0;
 		if ("teamRun" in patch) next.teamRun = patch.teamRun === true ? true : void 0;
+		if ("goalRun" in patch) next.goalRun = patch.goalRun === false ? false : void 0;
 		if (workspaceId !== void 0 || "workspaceId" in patch) next.workspaceId = workspaceId;
 		if (mode !== void 0 || "mode" in patch) next.mode = mode;
 		if (permission !== void 0 || "permission" in patch) next.permission = permission;
@@ -1464,6 +1627,7 @@ function validImportedKnownFields(value) {
 		const schedule = record(value.schedule);
 		if (schedule === void 0 || typeof schedule.enabled !== "boolean" || typeof schedule.cron !== "string") return false;
 		if (!optionalFiniteNumber(schedule.nextRunAt) || !optionalFiniteNumber(schedule.lastTriggeredAt)) return false;
+		if (schedule.timeZone !== void 0 && (typeof schedule.timeZone !== "string" || !isValidTimeZone(schedule.timeZone))) return false;
 	}
 	if (value.executions !== void 0) {
 		if (!Array.isArray(value.executions)) return false;
@@ -1511,6 +1675,7 @@ function importedTask(value) {
 		...task.schedule === void 0 ? {} : { schedule: {
 			enabled: task.schedule.enabled,
 			cron: task.schedule.cron,
+			...task.schedule.timeZone === void 0 ? {} : { timeZone: task.schedule.timeZone },
 			nextRunAt: task.schedule.nextRunAt,
 			lastTriggeredAt: task.schedule.lastTriggeredAt
 		} },
@@ -1519,6 +1684,7 @@ function importedTask(value) {
 		...task.mode === void 0 ? {} : { mode: task.mode },
 		...task.permission === void 0 ? {} : { permission: task.permission },
 		...task.reuseSession === void 0 ? {} : { reuseSession: task.reuseSession },
+		...task.goalRun === void 0 ? {} : { goalRun: task.goalRun },
 		...task.archivedAt === void 0 ? {} : { archivedAt: task.archivedAt },
 		...task.freeze === void 0 ? {} : { freeze: task.freeze },
 		...task.handover === void 0 ? {} : { handover: task.handover },
@@ -1565,6 +1731,7 @@ function createInput(value) {
 		"model",
 		"reuseSession",
 		"teamRun",
+		"goalRun",
 		"tags"
 	])) return false;
 	if (input.parentId !== void 0 && (typeof input.parentId !== "string" || input.parentId.trim() === "")) return false;
@@ -1572,14 +1739,20 @@ function createInput(value) {
 	if (!optionalString(input.workspaceId) || !optionalString(input.mode) || !optionalString(input.model)) return false;
 	if (input.reuseSession !== void 0 && typeof input.reuseSession !== "boolean") return false;
 	if (input.teamRun !== void 0 && typeof input.teamRun !== "boolean") return false;
+	if (input.goalRun !== void 0 && typeof input.goalRun !== "boolean") return false;
 	if (input.permission !== void 0 && !isTaskPermission(input.permission)) return false;
 	if (input.tags !== void 0 && !isTaskTagList(input.tags)) return false;
 	if (input.freeze !== void 0 && freezePayload(input.freeze) === void 0) return false;
 	if (input.handover !== void 0 && handoverPayload(input.handover) === void 0) return false;
 	if (input.schedule !== void 0) {
 		const schedule = record(input.schedule);
-		if (schedule === void 0 || !exactKeys(schedule, ["enabled", "cron"])) return false;
+		if (schedule === void 0 || !exactKeys(schedule, [
+			"enabled",
+			"cron",
+			"timeZone"
+		])) return false;
 		if (typeof schedule.enabled !== "boolean" || typeof schedule.cron !== "string") return false;
+		if (schedule.timeZone !== void 0 && (typeof schedule.timeZone !== "string" || !isValidTimeZone(schedule.timeZone))) return false;
 	}
 	return true;
 }
@@ -1597,10 +1770,12 @@ function updatePatch(value) {
 		"model",
 		"reuseSession",
 		"teamRun",
+		"goalRun",
 		"tags"
 	])) return false;
 	if (patch.reuseSession !== void 0 && patch.reuseSession !== null && typeof patch.reuseSession !== "boolean") return false;
 	if (patch.teamRun !== void 0 && patch.teamRun !== null && typeof patch.teamRun !== "boolean") return false;
+	if (patch.goalRun !== void 0 && patch.goalRun !== null && typeof patch.goalRun !== "boolean") return false;
 	for (const key of [
 		"title",
 		"description",
@@ -1616,7 +1791,11 @@ function updatePatch(value) {
 }
 function schedulePatch(value) {
 	const patch = record(value);
-	return patch !== void 0 && exactKeys(patch, ["enabled", "cron"]) && (patch.enabled === void 0 || typeof patch.enabled === "boolean") && (patch.cron === void 0 || typeof patch.cron === "string");
+	return patch !== void 0 && exactKeys(patch, [
+		"enabled",
+		"cron",
+		"timeZone"
+	]) && (patch.enabled === void 0 || typeof patch.enabled === "boolean") && (patch.cron === void 0 || typeof patch.cron === "string") && (patch.timeZone === void 0 || patch.timeZone === null || typeof patch.timeZone === "string" && isValidTimeZone(patch.timeZone));
 }
 function parseActionEnvelope(value) {
 	const parsed = parseEnvelopeAction(value);
@@ -1752,6 +1931,7 @@ function parseEnvelopeAction(value) {
 		case "delete":
 		case "archive":
 		case "restore":
+		case "settle":
 		case "run":
 		case "rerun":
 			if (!exactKeys(action, ["kind", "taskId"])) return void 0;
@@ -1773,7 +1953,11 @@ function bindingRefusalMessage(refusal, sessionDefault, surface) {
 }
 const MAX_REQUEST_CACHE = 256;
 function timeZone() {
-	return Intl.DateTimeFormat().resolvedOptions().timeZone || "local";
+	return resolveHostTimeZone();
+}
+/** The zone a schedule is evaluated in: its own, or the Host zone when it stores none. */
+function scheduleZone(schedule) {
+	return schedule.timeZone ?? timeZone();
 }
 function cloneTasks(tasks) {
 	return JSON.parse(JSON.stringify(tasks));
@@ -2044,6 +2228,7 @@ function parseHostTasks(values) {
 			schedule: {
 				enabled: false,
 				cron: schedule.cron,
+				...typeof schedule.timeZone === "string" && isValidTimeZone(schedule.timeZone) ? { timeZone: schedule.timeZone } : {},
 				nextRunAt: void 0,
 				lastTriggeredAt: typeof schedule.lastTriggeredAt === "number" && Number.isFinite(schedule.lastTriggeredAt) ? schedule.lastTriggeredAt : void 0
 			}
@@ -2084,6 +2269,7 @@ var HostTaskLedger = class {
 			for (const request of this.document.recentRequests) this.requestCache.set(request.requestId, { fingerprint: request.fingerprint });
 			this.repairSchedules(true);
 			this.reconcileInterruptedStarts();
+			this.finalizeReadyRuns(false);
 			this.commit(false);
 		} catch (error) {
 			this.dispose();
@@ -2137,6 +2323,11 @@ var HostTaskLedger = class {
 	*/
 	runtimeView() {
 		let armedSchedules = 0;
+		const teamGroups = /* @__PURE__ */ new Set();
+		for (const task of this.document.tasks) {
+			if (task.teamRun !== true) continue;
+			for (const execution of task.executions) if (execution.runGroupId !== void 0) teamGroups.add(execution.runGroupId);
+		}
 		const openExecutions = [];
 		for (const task of this.document.tasks) {
 			if (task.archivedAt === void 0 && task.schedule?.enabled === true) armedSchedules += 1;
@@ -2147,7 +2338,8 @@ var HostTaskLedger = class {
 					taskId: task.id,
 					executionId: execution.id,
 					sessionId: execution.sessionId,
-					startedAt: execution.startedAt
+					startedAt: execution.startedAt,
+					teamMember: task.teamRun !== true && execution.runGroupId !== void 0 && teamGroups.has(execution.runGroupId)
 				});
 			}
 		}
@@ -2162,6 +2354,25 @@ var HostTaskLedger = class {
 		for (const task of this.document.tasks) if (task.archivedAt === void 0 && task.schedule?.enabled === true) count += 1;
 		return count;
 	}
+	/**
+	* The earliest armed `nextRunAt` strictly after the supplied Host time, or
+	* undefined when no schedule is armed in the future. This is the instant the
+	* Host arms its native timer at, so the board wakes exactly when work is due
+	* instead of polling a fixed heartbeat.
+	* @param now - current Host time in ms epoch.
+	* @returns the nearest future trigger, or undefined when none is armed.
+	*/
+	nextArmedRunAt(now) {
+		let nearest;
+		for (const task of this.document.tasks) {
+			if (task.archivedAt !== void 0) continue;
+			const schedule = task.schedule;
+			if (schedule === void 0 || !schedule.enabled || schedule.nextRunAt === void 0) continue;
+			if (schedule.nextRunAt <= now) continue;
+			if (nearest === void 0 || schedule.nextRunAt < nearest) nearest = schedule.nextRunAt;
+		}
+		return nearest;
+	}
 	/** Return value-only references for schedules due at the supplied Host time. */
 	dueSchedules(now) {
 		const due = [];
@@ -2172,6 +2383,7 @@ var HostTaskLedger = class {
 			due.push({
 				taskId: task.id,
 				cron: schedule.cron,
+				timeZone: scheduleZone(schedule),
 				nextRunAt: schedule.nextRunAt
 			});
 		}
@@ -2244,7 +2456,7 @@ var HostTaskLedger = class {
 				...task,
 				schedule: {
 					...schedule,
-					nextRunAt: nextRunAtMs(schedule.cron, now)
+					nextRunAt: nextRunAtMs(schedule.cron, now, scheduleZone(schedule))
 				},
 				updatedAt: now
 			};
@@ -2297,15 +2509,17 @@ var HostTaskLedger = class {
 			});
 			changed = true;
 		}
+		if (task.teamRun === true && this.closeTeamMembers(taskId, groupId, execution.ownResult ?? outcome, execution.ownError ?? error, now)) changed = true;
 		if (this.settleCascade(taskId, groupId, now)) changed = true;
 		if (changed) this.commit();
 	}
 	attachSession(taskId, executionId, sessionId) {
 		const now = this.now();
-		this.document.tasks = this.document.tasks.map((task) => task.id !== taskId ? task : {
-			...task,
+		if (this.document.tasks.find((item) => item.id === taskId)?.executions.find((entry) => entry.id === executionId)?.endedAt !== void 0) return;
+		this.document.tasks = this.document.tasks.map((item) => item.id !== taskId ? item : {
+			...item,
 			updatedAt: now,
-			executions: task.executions.map((entry) => entry.id === executionId ? {
+			executions: item.executions.map((entry) => entry.id === executionId ? {
 				...entry,
 				sessionId
 			} : entry)
@@ -2328,11 +2542,12 @@ var HostTaskLedger = class {
 				this.document.scheduler.error = invalidScheduleIds.length === 0 ? void 0 : `invalid cron disabled for task(s): ${invalidScheduleIds.join(", ")}`;
 				this.repairSchedules(true, false);
 				this.reconcileInterruptedStarts(false);
+				this.finalizeReadyRuns(false);
 				break;
 			}
 			case "create": {
 				if (this.document.tasks.some((task) => task.id === action.id)) throw new Error("task id already exists");
-				if (action.input.schedule?.enabled === true && (!isValidCron(action.input.schedule.cron) || nextRunAtMs(action.input.schedule.cron, now) === void 0)) throw new Error("invalid schedule");
+				if (action.input.schedule?.enabled === true && (!isValidCron(action.input.schedule.cron) || !isValidTimeZone(action.input.schedule.timeZone ?? timeZone()) || nextRunAtMs(action.input.schedule.cron, now, action.input.schedule.timeZone ?? timeZone()) === void 0)) throw new Error("invalid schedule");
 				const input = action.input.freeze === void 0 || initiator === void 0 || initiator === "" ? action.input : {
 					...action.input,
 					freeze: {
@@ -2340,7 +2555,7 @@ var HostTaskLedger = class {
 						frozenBy: initiator
 					}
 				};
-				const result = applyCreateTask(this.document.tasks, input, now, action.id, this.maxSubtaskDepth);
+				const result = applyCreateTask(this.document.tasks, input, now, action.id, this.maxSubtaskDepth, timeZone());
 				if (result.task === void 0) throw new Error(result.error ?? "invalid task");
 				this.document.tasks = [...result.tasks];
 				break;
@@ -2391,6 +2606,19 @@ var HostTaskLedger = class {
 				this.document.tasks = [...result.tasks];
 				break;
 			}
+			case "settle": {
+				const task = this.document.tasks.find((item) => item.id === action.taskId);
+				if (task === void 0) throw new Error("task not found");
+				if (task.archivedAt !== void 0) throw new Error("archived task is read-only");
+				if (!task.executions.some((entry) => entry.endedAt === void 0)) throw new Error("task has no open execution");
+				const reason = "execution closed manually by " + (initiator === void 0 || initiator === "" ? "the operator" : initiator) + ": no verdict was recorded";
+				for (const member of cascadeTargets(this.document.tasks, action.taskId, this.maxSubtaskDepth)) for (const execution of member.executions) {
+					if (execution.endedAt !== void 0) continue;
+					this.document.tasks = this.document.tasks.map((item) => item.id !== member.id ? item : settleExecution(item, execution.id, "cancelled", now, reason));
+				}
+				this.finalizeReadyRuns(false);
+				break;
+			}
 			case "restore": {
 				if (this.subtreeHasOpenExecution(action.taskId)) throw new Error("running task cannot be restored");
 				const result = applyRestoreTask(this.document.tasks, action.taskId, now, this.maxSubtaskDepth);
@@ -2411,7 +2639,7 @@ var HostTaskLedger = class {
 			}
 			case "set-schedule": {
 				if (this.document.tasks.find((task) => task.id === action.taskId)?.archivedAt !== void 0) throw new Error("archived task is read-only");
-				const result = applySetSchedule(this.document.tasks, action.taskId, action.patch, now);
+				const result = applySetSchedule(this.document.tasks, action.taskId, action.patch, now, timeZone());
 				if (!result.applied) throw new Error("invalid schedule");
 				this.document.tasks = [...result.tasks];
 				break;
@@ -2555,6 +2783,86 @@ var HostTaskLedger = class {
 		}
 		return changed;
 	}
+	/**
+	* Close every run that is already decided, and fold every lineage whose
+	* members are all settled. The Host poll calls this on every tick, so a run
+	* can no longer be left in the running column by a settle nobody observed:
+	*
+	* - A team run is governed by its Lead. Once the Lead's own outcome is
+	*   recorded, its still-open members are settled with that verdict. A
+	*   teammate is a durable member of the Team and may never report a turn of
+	*   its own, and without this the whole lineage waits on it forever.
+	* - A cascade parent whose members are all settled is finalized here even
+	*   when the settle that completed the tree happened in another process, or
+	*   was interrupted between its child write and its parent write.
+	*
+	* Idempotent: a run that is already folded is left untouched, so a caller may
+	* invoke it on every tick.
+	* @param persist - false to leave the document for the caller to commit.
+	* @returns whether the document changed.
+	*/
+	finalizeReadyRuns(persist = true) {
+		const now = this.now();
+		let changed = false;
+		const groups = /* @__PURE__ */ new Set();
+		for (const task of this.document.tasks) for (const execution of task.executions) if (execution.endedAt === void 0 && execution.runGroupId !== void 0) groups.add(execution.runGroupId);
+		for (const groupId of groups) {
+			const lead = this.document.tasks.find((task) => task.teamRun === true && task.executions.some((entry) => entry.runGroupId === groupId));
+			const verdict = lead === void 0 ? void 0 : this.leadVerdict(lead, groupId);
+			if (lead !== void 0 && verdict !== void 0 && this.closeTeamMembers(lead.id, groupId, verdict.result, verdict.error, now)) changed = true;
+			for (const task of this.document.tasks) if (this.settleCascade(task.id, groupId, now)) changed = true;
+		}
+		if (changed && persist) this.commit();
+		return changed;
+	}
+	/**
+	* The verdict a team run's Lead has already recorded: its own turn outcome
+	* once that turn ended, or the folded outcome once its card settled.
+	*/
+	leadVerdict(lead, groupId) {
+		const execution = lead.executions.find((entry) => entry.runGroupId === groupId);
+		const result = execution?.ownResult ?? execution?.result;
+		if (result === void 0) return void 0;
+		return {
+			result,
+			error: execution?.ownError ?? execution?.error
+		};
+	}
+	/**
+	* Settle every still-open member of a team run with the Lead's verdict.
+	* A teammate that already reported its own outcome keeps it: the ordinary
+	* fold still lets a failure dominate.
+	* @param leadId - the Lead card's task id (never settled here).
+	* @param groupId - the team run's group.
+	* @param verdict - the Lead's outcome, inherited by members that never reported.
+	* @param error - the Lead's failure text, inherited with a failed verdict.
+	* @param now - clock instant (ms epoch).
+	* @returns whether the document changed.
+	*/
+	closeTeamMembers(leadId, groupId, verdict, error, now) {
+		const members = [];
+		let recorded = false;
+		this.document.tasks = this.document.tasks.map((task) => {
+			if (task.id === leadId) return task;
+			const execution = openGroupExecution(task, groupId);
+			if (execution === void 0) return task;
+			members.push(task.id);
+			if (execution.ownResult !== void 0) return task;
+			recorded = true;
+			return {
+				...task,
+				updatedAt: now,
+				executions: task.executions.map((entry) => entry.id === execution.id ? {
+					...entry,
+					ownResult: verdict,
+					ownError: error
+				} : entry)
+			};
+		});
+		let changed = recorded;
+		for (const memberId of members) if (this.settleCascade(memberId, groupId, now)) changed = true;
+		return changed;
+	}
 	repairSchedules(skipPast, persist = true) {
 		const now = this.now();
 		let changed = false;
@@ -2562,7 +2870,7 @@ var HostTaskLedger = class {
 			const schedule = task.schedule;
 			if (schedule === void 0 || !schedule.enabled) return task;
 			if (!skipPast && schedule.nextRunAt !== void 0) return task;
-			const next = nextRunAtMs(schedule.cron, now);
+			const next = nextRunAtMs(schedule.cron, now, scheduleZone(schedule));
 			if (next === void 0) {
 				changed = true;
 				this.document.scheduler.error = `invalid cron disabled for task: ${task.id}`;
@@ -2612,14 +2920,36 @@ var HostTaskLedger = class {
 		if (changed && persist) this.commit();
 	}
 	/**
-	* Field-preserving v2 to v3 migration. v3 adds no fields yet, so the
-	* migration reuses the v3 normalization, but it first proves every task
-	* row is structurally valid: a v2 document that would silently drop or
-	* coerce rows fails loudly instead (no quarantined-empty restart).
+	* Field-preserving migration of a pre-v4 document. It first proves every task
+	* row is structurally valid, so a document that would silently drop or coerce
+	* rows fails loudly instead (no quarantined-empty restart), and then reuses
+	* the current normalization.
+	*
+	* v4 adds `ScheduleRule.timeZone`. A rule written before v4 was evaluated in
+	* whatever zone the Host process happened to report, so the migration stamps
+	* that zone onto every enabled rule: the trigger instant is preserved exactly
+	* (the stored `nextRunAt` already encodes the old zone), but the rule stops
+	* following a later `TZ` change, which is what made an existing schedule
+	* silently move when the Host's zone changed.
 	*/
 	migrateLegacyDocument(parsed) {
-		if (!Array.isArray(parsed.tasks) || !parsed.tasks.every((row) => isTaskRecord(row))) throw new Error("v2 document contains structurally invalid task rows");
-		return this.normalizeDocument(parsed);
+		if (!Array.isArray(parsed.tasks) || !parsed.tasks.every((row) => isTaskRecord(row))) throw new Error(`v${String(parsed.schemaVersion)} document contains structurally invalid task rows`);
+		const rows = parsed.tasks.map((value) => {
+			const schedule = value.schedule;
+			if (typeof schedule !== "object" || schedule === null) return value;
+			if (typeof schedule.timeZone === "string") return value;
+			return {
+				...value,
+				schedule: {
+					...schedule,
+					timeZone: timeZone()
+				}
+			};
+		});
+		return this.normalizeDocument({
+			...parsed,
+			tasks: rows
+		});
 	}
 	load(dir) {
 		const existed = existsSync(this.file);
@@ -2629,13 +2959,13 @@ var HostTaskLedger = class {
 		} catch (error) {
 			return this.recoverCorrupt(dir, existed, error);
 		}
-		if (parsed.schemaVersion === 2) try {
+		if (parsed.schemaVersion === 3 || parsed.schemaVersion === 2) try {
 			return this.migrateLegacyDocument(parsed);
 		} catch (error) {
-			throw new Error(`ledger v2 to v3 migration failed; original file kept at ${this.file}: ${error instanceof Error ? error.message : String(error)}`);
+			throw new Error(`ledger v${String(parsed.schemaVersion)} to v4 migration failed; original file kept at ${this.file}: ${error instanceof Error ? error.message : String(error)}`);
 		}
 		try {
-			if (parsed.schemaVersion !== 3 || !Array.isArray(parsed.tasks)) throw new Error("unsupported ledger schema");
+			if (parsed.schemaVersion !== 4 || !Array.isArray(parsed.tasks)) throw new Error("unsupported ledger schema");
 			return this.normalizeDocument(parsed);
 		} catch (error) {
 			return this.recoverCorrupt(dir, existed, error);
@@ -2657,7 +2987,7 @@ var HostTaskLedger = class {
 		const sidecarLastTickAt = this.readSchedulerSidecar();
 		const lastTickAt = sidecarLastTickAt === void 0 || documentLastTickAt !== void 0 && documentLastTickAt >= sidecarLastTickAt ? documentLastTickAt : sidecarLastTickAt;
 		return {
-			schemaVersion: 3,
+			schemaVersion: 4,
 			revision: Number.isSafeInteger(parsed.revision) && parsed.revision >= 0 ? parsed.revision : 0,
 			tasks,
 			scheduler: {
@@ -2683,7 +3013,7 @@ var HostTaskLedger = class {
 		if (existed) renameSync(this.file, `${this.file}.corrupt-${this.now()}-${process.pid}-${crypto.randomUUID()}`);
 		mkdirSync(dir, { recursive: true });
 		return {
-			schemaVersion: 3,
+			schemaVersion: 4,
 			revision: 0,
 			tasks: [],
 			scheduler: {
@@ -2875,6 +3205,16 @@ function isDefinitionWithdrawn(error) {
 }
 const SERVICE_UNAVAILABLE_ATTEMPTS = 5;
 const SERVICE_UNAVAILABLE_BACKOFF_MS = 2e3;
+/**
+* Largest number of history pages one inspection walks back. A session whose
+* window is wider than this cannot be resolved from its log, which the caller
+* treats as an unreadable history rather than as pending work.
+*/
+const HISTORY_PAGE_LIMIT = 100;
+/** One-line text of a gateway or stream failure, for a decideable reason. */
+function failureText(error) {
+	return error instanceof Error ? error.message : String(error);
+}
 function delay(ms) {
 	return new Promise((resolve) => {
 		setTimeout(resolve, ms);
@@ -2913,13 +3253,25 @@ function peerPromptPreamble(context) {
 	const peers = context.peers ?? [];
 	if (peers.length === 0) return void 0;
 	if (context.team === true) {
-		const lines = peers.map((peer) => `- ${escapeProvenanceDelimiter(peer.title)}（teammate: ${peer.name ?? teammateName(peer.title, peer.id)}）`);
+		const lines = peers.map((peer) => `- ${escapeProvenanceDelimiter(peer.title)}（teammate: ${peer.name ?? teammateName(peer.title, peer.id, peer.id)}）`);
 		return `本任务是 Agent Team 的 Lead：本次运行不额外开启独立会话，以下 ${peers.length} 个子任务成员已在本会话中作为 teammate 启动。用 list_agents / send_message / wait_agent 协调它们，用任务看板工具读写它们在看板上的卡片：\n${lines.join("\n")}`;
 	}
 	const lines = peers.map((peer) => `- ${escapeProvenanceDelimiter(peer.title)}（任务 ${peer.id}）`);
 	return `本次运行同时并发开启 ${peers.length} 个独立 DSH 会话执行下列子任务成员（可用 task_board_* 工具查看它们的进度）：\n${lines.join("\n")}`;
 }
 /**
+* The scheduled-run section: this execution was triggered by the card's cron
+* rule rather than by a person. It states the firing instant, the rule's zone,
+* and the rule text, so the run's own clock is unambiguous — the board's
+* scheduler fires on a wall clock in a specific IANA zone, which is not
+* necessarily the zone of whatever session the run lands in.
+*/
+function schedulePromptPreamble(context) {
+	const schedule = context.schedule;
+	if (schedule === void 0) return void 0;
+	return `本次执行由任务看板的定时规则自动触发：触发时间 ${new Date(schedule.triggeredAt).toISOString()}（UTC），规则时区 ${schedule.timeZone}，cron 表达式 ${schedule.cron}。需要判断「今天」「现在」或计算时间窗口时，以该时区的触发时间为准。`;
+}
+/**
 * Build the execution prompt for one task.
 * @param task - the task being launched.
 * @param context - the run's other members, for the execution-shape section.
@@ -2932,6 +3284,7 @@ function promptText(task, context = {}) {
 	const preambles = [
 		tagPromptPreamble(task),
 		handoverPreamble,
+		schedulePromptPreamble(context),
 		peerPromptPreamble(context)
 	].filter((part) => part !== void 0);
 	const preamble = preambles.length === 0 ? void 0 : preambles.join("\n\n");
@@ -2942,6 +3295,25 @@ function promptText(task, context = {}) {
 	return preamble === void 0 ? declaration : `${preamble}\n\n${declaration}`;
 }
 /**
+* The parts of an objective the built-in `/goal` command reads as an operation
+* rather than as an objective: an exact `clear`/`pause`/`resume`/`edit`
+* (case-insensitive) and a leading `edit <objective>`.
+*/
+const GOAL_COMMAND_KEYWORD = /^(?:clear|pause|resume|edit)$|^edit\s/i;
+/**
+* Build the objective the built-in `/goal` command receives. A prompt whose
+* text would be read as a goal operation is prefixed with a neutral label: the
+* instruction stays intact, and the command arms an objective instead of
+* clearing, pausing, or editing an unrelated goal (or refusing for a missing
+* one).
+* @param prompt - the composed execution prompt.
+* @returns the objective text for `/goal <objective>`.
+*/
+function goalObjective(prompt) {
+	const text = prompt.trim();
+	return GOAL_COMMAND_KEYWORD.test(text) ? `Goal: ${text}` : text;
+}
+/**
 * Build the tag section of the execution prompt (issue #1521). Only tags with
 * a non-blank `promptPrefix` contribute; a task whose tags are all bare names
 * (or which has no tags at all) yields undefined and the prompt is byte-for-byte
@@ -3131,6 +3503,73 @@ var HostExecutionRunner = class {
 				text: promptText(task, context)
 			}]
 		});
+		await this.armGoal(sessionId, task, context);
+	}
+	/**
+	* Arm dsh's built-in goal on the session. The task prompt is queued FIRST, so
+	* the session's first turn carries the instruction verbatim; `/goal
+	* <objective>` then turns the same text into a persistent objective, and
+	* dsh's goal-round driver keeps starting continuation rounds until the agent
+	* marks it complete (see {@link goalVerdict} for how the run settles).
+	*
+	* Opt-out: a task whose `goalRun` is an explicit false runs one plain turn.
+	* A refusal (no command dispatcher, no `/goal` command in this cohort, an
+	* objective the command rejects) is reported and the run continues as that
+	* plain turn: the task was asked to run, and a missing goal mode must not
+	* lose the work.
+	*/
+	async armGoal(sessionId, task, context) {
+		if (task.goalRun === false) return;
+		if (this.commands === void 0) {
+			console.warn("[dsh-task-board] no command dispatcher is available; task " + task.id + " runs without /goal");
+			return;
+		}
+		try {
+			const command = await this.commands.execute(sessionId, "/goal " + goalObjective(promptText(task, context)), AbortSignal.timeout(3e4));
+			if (command === void 0) {
+				console.warn("[dsh-task-board] /goal was not acknowledged for session " + sessionId + "; the run continues as a plain turn");
+				return;
+			}
+			if (command.kind !== "success") console.warn("[dsh-task-board] /goal was refused for session " + sessionId + ": " + (command.text ?? "no reason reported") + "; the run continues as a plain turn");
+		} catch (error) {
+			console.warn("[dsh-task-board] could not arm /goal on session " + sessionId + "; the run continues as a plain turn", error);
+		}
+	}
+	/**
+	* The verdict an armed dsh goal imposes on an otherwise completed turn.
+	*
+	* A goal run is one session working many automatic continuation rounds:
+	* dsh's goal-round driver queues the next round whenever the agent goes
+	* idle, so the first completed `turn/end` is not the execution's result.
+	* Settling there would leave the card in `done` while the session keeps
+	* working, and a scheduled task would fire a second, concurrent session.
+	* The session projection is the authority: an `active` goal keeps the
+	* execution pending, a `blocked` goal fails it with the recorded reason, and
+	* any other phase (complete, paused, or no goal at all) leaves the turn
+	* verdict in place.
+	*
+	* An unreadable projection falls back to that turn verdict: a cohort whose
+	* gateway withdrew `session/projections` must not hang every execution.
+	*/
+	async goalVerdict(sessionId) {
+		let projections;
+		try {
+			projections = await this.invoke("session", "projections", { sessionId });
+		} catch (error) {
+			console.warn("[dsh-task-board] session/projections failed while reading the goal phase; settling from the turn result", error);
+			return;
+		}
+		const goal = projections?.values?.goal;
+		if (goal === void 0 || goal === null) return void 0;
+		const view = goal.goal;
+		if (view?.phase === "active") return { outcome: "pending" };
+		if (view?.phase === "blocked") {
+			const message = view.blockedReason?.message;
+			return {
+				outcome: "failed",
+				error: "goal is blocked: " + (typeof message === "string" && message !== "" ? message : "no reason recorded")
+			};
+		}
 	}
 	async listRunning() {
 		for (let attempt = 1;; attempt++) try {
@@ -3162,8 +3601,17 @@ var HostExecutionRunner = class {
 			await delay(this.unavailableBackoffMs);
 		}
 	}
-	/** Resolve an execution outcome from the session list and bounded history pages. */
-	async inspect(sessionId, startedAt = 0, sessions) {
+	/**
+	* Resolve an execution outcome from the session list and bounded history pages.
+	* @param sessionId - the session the execution runs in.
+	* @param startedAt - instant the execution opened; earlier events are not its own.
+	* @param sessions - roster from the caller's own poll, when it already has one.
+	* @param options.whileRunning - read the first completed turn even while the
+	*   roster reports the session as running. A durable Agent Teams teammate
+	*   stays alive after its turn ends, so `running` never clears for it and the
+	*   turn it completed is the only verdict it will ever expose.
+	*/
+	async inspect(sessionId, startedAt = 0, sessions, options = {}) {
 		let items;
 		if (sessions !== void 0) items = sessions;
 		else {
@@ -3195,7 +3643,7 @@ var HostExecutionRunner = class {
 				error: "execution session no longer exists"
 			};
 		}
-		if (summary.running) return { outcome: "pending" };
+		if (summary.running && options.whileRunning !== true) return { outcome: "pending" };
 		let opening;
 		try {
 			const iterator = (await this.stream("session", "follow", {
@@ -3205,7 +3653,11 @@ var HostExecutionRunner = class {
 			const next = await iterator.next();
 			if (typeof iterator.return === "function") await iterator.return();
 			const follow = next.done === true ? void 0 : next.value;
-			if (follow === void 0 || follow.type !== "snapshot" || typeof follow.cursor !== "number" || follow.records === void 0 || typeof follow.hasMore !== "boolean") return { outcome: "pending" };
+			if (follow === void 0 || follow.type !== "snapshot" || typeof follow.cursor !== "number" || follow.records === void 0 || typeof follow.hasMore !== "boolean") return {
+				outcome: "pending",
+				unreadable: true,
+				reason: "session/follow returned no opening frame"
+			};
 			opening = {
 				cursor: follow.cursor,
 				records: follow.records,
@@ -3213,7 +3665,11 @@ var HostExecutionRunner = class {
 			};
 		} catch (error) {
 			console.warn("[dsh-task-board] session/follow failed during execution inspection; keeping the outcome pending", error);
-			return { outcome: "pending" };
+			return {
+				outcome: "pending",
+				unreadable: true,
+				reason: "session/follow failed: " + failureText(error)
+			};
 		}
 		const openingEvents = opening.records.map((record) => ({ event: recordEvent(record) }));
 		const newestSeq = openingEvents.reduce((newest, entry) => newest === void 0 ? entry.event.seq : Math.max(newest, entry.event.seq), void 0);
@@ -3221,7 +3677,7 @@ var HostExecutionRunner = class {
 		const events = [...openingEvents];
 		let beforeSeq;
 		let reachedExecutionBoundary = !opening.hasMore;
-		for (let page = 0; page < 100 && !reachedExecutionBoundary; page += 1) {
+		for (let page = 0; page < HISTORY_PAGE_LIMIT && !reachedExecutionBoundary; page += 1) {
 			let history;
 			try {
 				history = await this.invoke("session", "page", {
@@ -3232,7 +3688,11 @@ var HostExecutionRunner = class {
 				});
 			} catch (error) {
 				console.warn("[dsh-task-board] session/page failed during execution inspection; keeping the outcome pending", error);
-				return { outcome: "pending" };
+				return {
+					outcome: "pending",
+					unreadable: true,
+					reason: "session/page failed: " + failureText(error)
+				};
 			}
 			const pageEntries = pageEvents(history);
 			events.push(...pageEntries);
@@ -3245,7 +3705,11 @@ var HostExecutionRunner = class {
 			if (oldestSeq === void 0 || oldestSeq === beforeSeq) return { outcome: "pending" };
 			beforeSeq = oldestSeq;
 		}
-		if (!reachedExecutionBoundary) return { outcome: "pending" };
+		if (!reachedExecutionBoundary) return {
+			outcome: "pending",
+			unreadable: true,
+			reason: "history scan did not reach the execution start within 100 pages"
+		};
 		const turnEnd = events.filter((entry) => entry.event.type === "turn/end" && (startedAt <= 0 || entry.event.time >= startedAt)).sort((a, b) => a.event.seq - b.event.seq)[0];
 		if (turnEnd === void 0) {
 			if (newestSeq !== void 0) this.scanMemos.set(sessionId, newestSeq);
@@ -3253,7 +3717,7 @@ var HostExecutionRunner = class {
 		}
 		this.scanMemos.delete(sessionId);
 		const reason = nonCompletedTurnEnd(turnEnd.event.data);
-		if (reason === void 0) return { outcome: "succeeded" };
+		if (reason === void 0) return await this.goalVerdict(sessionId) ?? { outcome: "succeeded" };
 		return reason === "error" ? {
 			outcome: "failed",
 			error: "agent turn ended with an error"
@@ -3567,19 +4031,64 @@ var PowerInhibitor = class {
 };
 //#endregion
 //#region src/host-service.ts
+/** Session-roster poll cadence — the one recurring Host timer this service still holds. */
 const SESSION_POLL_MS = 5e3;
-const SCHEDULE_TICK_MS = 3e4;
-const RESUME_GAP_MS = 45e3;
+/**
+* How late an armed schedule fire may be before it counts as a resume rather
+* than a normal occurrence. The schedule timer is armed AT the next due
+* instant, so landing this far past its target means the Host was suspended,
+* the process throttled, or the wall clock jumped forward — the same condition
+* the old fixed 30 s heartbeat detected through its own gap threshold.
+*/
+const RECOVERY_TOLERANCE_MS = 6e4;
+/** Largest delay a Node timer represents without clamping; longer targets re-arm in segments. */
+const MAX_TIMER_DELAY_MS = 2147483647;
+/**
+* Consecutive polls that may report one execution's session history as
+* unreadable before it is reported failed. The roster poll runs every 5 s, so
+* this is two minutes of a session that is NOT running: no turn is executing
+* there and its history cannot be read, which means no verdict will ever
+* arrive. Reporting that as a failure keeps a card — and every ancestor of it —
+* out of the running column, which nothing else can rescue.
+*/
+const UNREADABLE_SETTLE_POLLS = 24;
+/**
+* Actions that can move an armed trigger. Only these re-arm the native timer;
+* an unrelated card edit leaves the pending fire untouched.
+*/
+const SCHEDULE_WRITE_ACTIONS = /* @__PURE__ */ new Set([
+	"set-schedule",
+	"delete",
+	"archive"
+]);
+/** Process-global fallback used when the deployment serves no cordis timer service. */
+const PROCESS_TIMERS = {
+	timeout(callback, delay) {
+		const handle = setTimeout(callback, delay);
+		return () => {
+			clearTimeout(handle);
+		};
+	},
+	interval(callback, delay) {
+		const handle = setInterval(callback, delay);
+		return () => {
+			clearInterval(handle);
+		};
+	}
+};
 var TaskBoardHostService = class {
 	ledger;
 	runner;
 	power;
 	listeners = /* @__PURE__ */ new Set();
-	timers = [];
-	lastScheduleTick;
+	/** The one recurring timer: the session-roster poll. */
+	pollTimer;
+	/** The armed schedule timer, if a trigger is pending. */
+	scheduleTimer;
+	/** The instant the armed schedule timer targets (ms epoch), for resume detection. */
+	scheduleTarget;
 	disposed = false;
 	pollInFlight = false;
-	tickInFlight = false;
 	active = true;
 	/**
 	* Ids the last roster poll saw as present and idle; undefined while the
@@ -3588,8 +4097,15 @@ var TaskBoardHostService = class {
 	* conversation instead of prompting into a session it cannot see.
 	*/
 	idleSessionIds;
+	/**
+	* Consecutive unreadable-history polls per open execution (see
+	* {@link noteUnreadableInspection}). Cleared as soon as an inspection
+	* resolves, so a transient reader failure never fails a card.
+	*/
+	unreadablePolls = /* @__PURE__ */ new Map();
 	preventIdleSleep = false;
 	team;
+	timers;
 	lastPowerJson = "";
 	now;
 	constructor(gateway, options = {}) {
@@ -3599,6 +4115,7 @@ var TaskBoardHostService = class {
 		});
 		this.runner = new HostExecutionRunner(gateway, options.commandDispatcher, options.workspaceRegistry);
 		this.team = options.team;
+		this.timers = options.timers ?? PROCESS_TIMERS;
 		this.power = options.power ?? new PowerInhibitor();
 		this.now = options.now ?? Date.now;
 		installStreamErrorGuards();
@@ -3614,16 +4131,13 @@ var TaskBoardHostService = class {
 		});
 	}
 	start() {
-		if (this.disposed || this.timers.length > 0) return;
+		if (this.disposed || this.pollTimer !== void 0) return;
 		this.syncPowerReasons();
-		this.timers.push(setInterval(() => {
+		this.pollTimer = this.timers.interval(() => {
 			this.schedulePoll();
-		}, SESSION_POLL_MS));
-		this.timers.push(setInterval(() => {
-			this.scheduleTick(false);
-		}, SCHEDULE_TICK_MS));
+		}, SESSION_POLL_MS);
 		this.schedulePoll();
-		this.scheduleTick(true);
+		this.recoverSchedule();
 	}
 	setConfiguration(active, preventIdleSleep) {
 		const resumed = !this.active && active;
@@ -3640,14 +4154,14 @@ var TaskBoardHostService = class {
 		this.power.setEnabled(active && preventIdleSleep);
 		if (resumed) {
 			this.schedulePoll();
-			this.scheduleTick(true);
-		}
+			this.recoverSchedule();
+		} else if (!active) this.clearScheduleTimer();
 		this.emit();
 	}
 	snapshot() {
 		const state = this.ledger.state();
 		return {
-			schemaVersion: 3,
+			schemaVersion: 4,
 			revision: state.revision,
 			tasks: state.tasks,
 			scheduler: state.scheduler,
@@ -3679,8 +4193,9 @@ var TaskBoardHostService = class {
 		}
 		const result = this.ledger.applyRequest(requestId, action, initiator);
 		if (result.runs !== void 0) this.dispatchRuns(result.runs);
+		if (SCHEDULE_WRITE_ACTIONS.has(action.kind)) this.refreshSchedule();
 		return {
-			schemaVersion: 3,
+			schemaVersion: 4,
 			revision: result.state.revision,
 			tasks: result.state.tasks,
 			scheduler: result.state.scheduler,
@@ -3689,22 +4204,26 @@ var TaskBoardHostService = class {
 	}
 	dispose() {
 		this.disposed = true;
-		for (const timer of this.timers.splice(0)) clearInterval(timer);
+		this.clearScheduleTimer();
+		this.pollTimer?.();
+		this.pollTimer = void 0;
 		this.power.dispose();
 		this.ledger.dispose();
 		this.listeners.clear();
 	}
-	async launch(opened, others = []) {
+	async launch(opened, others = [], schedule) {
 		try {
 			const team = opened.task.teamRun === true;
 			const reuseSessionId = team ? void 0 : reusableSessionId(opened.task, this.idleSessionIds);
-			const promptContext = others.length === 0 ? void 0 : {
-				peers: others.map((other) => ({
-					id: other.task.id,
-					title: other.task.title,
-					...team ? { name: teammateName(other.task.title, other.execution.runGroupId ?? other.task.id) } : {}
-				})),
-				...team ? { team: true } : {}
+			const peers = others.length === 0 ? void 0 : others.map((other) => ({
+				id: other.task.id,
+				title: other.task.title,
+				...team ? { name: teammateName(other.task.title, other.execution.runGroupId ?? other.task.id, other.task.id) } : {}
+			}));
+			const promptContext = peers === void 0 && schedule === void 0 ? void 0 : {
+				...peers === void 0 ? {} : { peers },
+				...team ? { team: true } : {},
+				...schedule === void 0 ? {} : { schedule }
 			};
 			const sessionId = await this.runner.launch(opened.task, {
 				...reuseSessionId === void 0 ? {} : { reuseSessionId },
@@ -3738,7 +4257,7 @@ var TaskBoardHostService = class {
 		try {
 			const member = await team.spawn({
 				leadSessionId,
-				name: teammateName(opened.task.title, opened.execution.runGroupId ?? opened.task.id),
+				name: teammateName(opened.task.title, opened.execution.runGroupId ?? opened.task.id, opened.task.id),
 				description: opened.task.title,
 				prompt: promptText(opened.task)
 			});
@@ -3766,6 +4285,7 @@ var TaskBoardHostService = class {
 			return;
 		}
 		this.idleSessionIds = new Set(running.items.filter((item) => !item.running).map((item) => item.sessionId));
+		this.ledger.finalizeReadyRuns();
 		const runtime = this.ledger.runtimeView();
 		this.power.updateReasons({
 			runningSessions: running.count,
@@ -3779,26 +4299,102 @@ var TaskBoardHostService = class {
 		for (const execution of executions) {
 			if (execution.sessionId === void 0) continue;
 			try {
-				const result = await this.runner.inspect(execution.sessionId, execution.startedAt, sessions);
-				if (result.outcome === "pending") continue;
+				const result = await this.runner.inspect(execution.sessionId, execution.startedAt, sessions, { whileRunning: execution.teamMember });
+				if (result.outcome === "pending") {
+					if (result.unreadable === true) this.noteUnreadableInspection(execution, result.reason);
+					else this.unreadablePolls.delete(execution.executionId);
+					continue;
+				}
+				this.unreadablePolls.delete(execution.executionId);
 				this.ledger.settle(execution.taskId, execution.executionId, result.outcome, "error" in result ? result.error : void 0);
 			} catch {}
 		}
+		const open = new Set(executions.map((execution) => execution.executionId));
+		for (const executionId of [...this.unreadablePolls.keys()]) if (!open.has(executionId)) this.unreadablePolls.delete(executionId);
 	}
-	async tickSchedule(first) {
+	/**
+	* Count one poll whose session history could not be read. A reader failure is
+	* not progress: the session is not running (the runner only reads history for
+	* one that is idle), so nothing will ever change that verdict. After
+	* {@link UNREADABLE_SETTLE_POLLS} consecutive polls the execution is reported
+	* failed with the recorded reason, instead of holding its card — and every
+	* ancestor of it — in the running column with no way out. The first poll of
+	* each streak is logged, so the Host log names the session.
+	*/
+	noteUnreadableInspection(execution, reason) {
+		const polls = (this.unreadablePolls.get(execution.executionId) ?? 0) + 1;
+		this.unreadablePolls.set(execution.executionId, polls);
+		const detail = reason ?? "no reason reported";
+		if (polls === 1) safeConsoleError("[dsh-task-board] execution session " + (execution.sessionId ?? "unknown") + " history is unreadable; it stays pending for up to 24 polls: " + detail);
+		if (polls < UNREADABLE_SETTLE_POLLS) return;
+		this.unreadablePolls.delete(execution.executionId);
+		this.ledger.settle(execution.taskId, execution.executionId, "failed", "execution session history is unreadable (24 consecutive polls); the outcome cannot be determined: " + detail);
+	}
+	/** Drop the armed schedule timer and forget its target. */
+	clearScheduleTimer() {
+		this.scheduleTimer?.();
+		this.scheduleTimer = void 0;
+		this.scheduleTarget = void 0;
+	}
+	/**
+	* Boot / resume recovery: skip every occurrence that came due while the
+	* board was not running and roll each schedule to its next future target,
+	* then arm the timer for the nearest one. Rendering the occurrence is
+	* deliberately not attempted: the ACL of a card that fired hours ago is
+	* stale, and the board's own recovery contract is "missed triggers are
+	* skipped, never replayed".
+	*/
+	recoverSchedule() {
+		if (this.disposed) return;
+		this.clearScheduleTimer();
+		const now = this.now();
+		this.ledger.setScheduler({ lastTickAt: now });
+		this.ledger.skipMissed(now);
+		this.armSchedule();
+	}
+	/**
+	* Arm the native timer at the nearest armed future trigger. One timer serves
+	* every schedule: the ledger's next target is the only instant the Host has
+	* to wake for. A target beyond the platform's timer ceiling re-arms in
+	* segments, and a target already past (the wall clock jumped, or the process
+	* was suspended) is handled immediately as a recovery.
+	*/
+	armSchedule() {
+		if (this.disposed || !this.active) return;
+		this.clearScheduleTimer();
+		const target = this.ledger.nextArmedRunAt(this.now());
+		if (target === void 0) return;
+		this.scheduleTarget = target;
+		const delay = Math.max(0, Math.min(target - this.now(), MAX_TIMER_DELAY_MS));
+		this.scheduleTimer = this.timers.timeout(() => {
+			this.scheduleTimer = void 0;
+			this.onScheduleFire(target);
+		}, delay);
+	}
+	/**
+	* One armed target became due. A fire landing well past its target is a
+	* resume (suspend, throttle, forward clock jump) rather than a normal
+	* occurrence, so it takes the recovery path instead of launching a run for a
+	* long-stale instant.
+	*/
+	onScheduleFire(target) {
 		if (this.disposed || !this.active) return;
 		const now = this.now();
-		const recovered = first || this.lastScheduleTick !== void 0 && now - this.lastScheduleTick > RESUME_GAP_MS;
-		this.lastScheduleTick = now;
+		this.scheduleTarget = void 0;
 		this.ledger.setScheduler({ lastTickAt: now });
-		if (recovered) {
-			this.ledger.skipMissed(now);
+		if (now - target > RECOVERY_TOLERANCE_MS) {
+			this.recoverSchedule();
 			return;
 		}
 		for (const schedule of this.ledger.dueSchedules(now)) {
-			const next = nextRunAtMs(schedule.cron, schedule.nextRunAt);
-			this.dispatchRuns(this.ledger.openScheduled(schedule.taskId, next, now));
+			const next = nextRunAtMs(schedule.cron, schedule.nextRunAt, schedule.timeZone);
+			this.dispatchRuns(this.ledger.openScheduled(schedule.taskId, next, now), {
+				triggeredAt: now,
+				timeZone: schedule.timeZone,
+				cron: schedule.cron
+			});
 		}
+		this.armSchedule();
 	}
 	armedSchedules() {
 		return this.ledger.armedScheduleCount();
@@ -3810,15 +4406,15 @@ var TaskBoardHostService = class {
 	* others back. A team run's members are spawned inside the root's Lead
 	* session instead, once that session exists.
 	*/
-	dispatchRuns(runs) {
+	dispatchRuns(runs, schedule) {
 		if (runs.length === 0) return;
 		const root = runs.find((run) => run.dispatch !== "teammate") ?? runs[0];
 		const others = runs.filter((run) => run !== root);
-		this.scheduleLaunch(root, others);
-		for (const run of others) if (run.dispatch !== "teammate") this.scheduleLaunch(run);
+		this.scheduleLaunch(root, others, schedule);
+		for (const run of others) if (run.dispatch !== "teammate") this.scheduleLaunch(run, [], schedule);
 	}
-	scheduleLaunch(opened, others = []) {
-		this.launch(opened, others).catch((error) => {
+	scheduleLaunch(opened, others = [], schedule) {
+		this.launch(opened, others, schedule).catch((error) => {
 			safeConsoleError("[dsh-task-board] execution launch settlement failed", error);
 		});
 	}
@@ -3831,14 +4427,18 @@ var TaskBoardHostService = class {
 			this.pollInFlight = false;
 		});
 	}
-	scheduleTick(first) {
-		if (this.tickInFlight || this.disposed) return;
-		this.tickInFlight = true;
-		this.tickSchedule(first).catch((error) => {
-			safeConsoleError("[dsh-task-board] scheduler tick failed", error);
-		}).finally(() => {
-			this.tickInFlight = false;
-		});
+	/**
+	* Re-arm from the ledger's current targets. Callers that just changed a
+	* schedule (the host routes, the agent tools) invoke this after the write
+	* commits, so a new or edited trigger arms without waiting for the next fire.
+	*/
+	refreshSchedule() {
+		if (this.disposed) return;
+		if (!this.active) {
+			this.clearScheduleTimer();
+			return;
+		}
+		this.armSchedule();
 	}
 	syncPowerReasons() {
 		const current = this.power.snapshot();
@@ -4058,6 +4658,7 @@ function scheduleView(schedule) {
 	return {
 		enabled: schedule.enabled,
 		cron: schedule.cron,
+		...schedule.timeZone === void 0 ? {} : { timeZone: schedule.timeZone },
 		...schedule.nextRunAt === void 0 ? {} : { nextRunAt: schedule.nextRunAt },
 		...schedule.lastTriggeredAt === void 0 ? {} : { lastTriggeredAt: schedule.lastTriggeredAt }
 	};
@@ -4107,6 +4708,7 @@ function taskSummary(task, tasks, sessionDefault) {
 		...task.model === void 0 ? {} : { model: task.model },
 		...task.reuseSession === true ? { reuseSession: true } : {},
 		...task.teamRun === true ? { teamRun: true } : {},
+		...task.goalRun === false ? { goalRun: false } : {},
 		...task.schedule === void 0 ? {} : { schedule: scheduleView(task.schedule) },
 		...task.freeze === void 0 ? {} : { continuationCard: true },
 		...task.permissionConfirmedAt === void 0 ? {} : { permissionConfirmedAt: task.permissionConfirmedAt },
@@ -4299,11 +4901,12 @@ function buildManageTool(host) {
 	return defineTool({
 		name: "task_board_manage",
 		description: [
-			"Move, archive, restore, or delete one task board card.",
+			"Move, archive, restore, delete, or settle one task board card.",
 			"move-todo and move-backlog are the manual column moves; a running card cannot be moved.",
+			"settle force-closes the open execution of a card the board can no longer observe (a stuck running card) and records it cancelled with the caller as the reason, so the card returns to the todo column and can be run again.",
 			"archive takes the whole subtask tree off the board and is refused while any member has an unsettled execution; restore brings the task, its ancestors and its subtree back; delete removes one card and is refused while it still has subtasks (detach or delete them first) or while it runs.",
 			"It cannot confirm a permission binding: the confirmation gate is a human act performed in the board UI.",
-			"Triggers: 任务看板, task board, 看板, 归档, archive, 删除任务, delete task, 移动任务, move task."
+			"Triggers: 任务看板, task board, 看板, 归档, archive, 删除任务, delete task, 移动任务, move task, 卡住, stuck, 强制结算, settle."
 		].join(" "),
 		parameters: {
 			taskId: {
@@ -4319,7 +4922,8 @@ function buildManageTool(host) {
 					"move-backlog",
 					"archive",
 					"restore",
-					"delete"
+					"delete",
+					"settle"
 				],
 				description: "The lifecycle operation to perform."
 			}
@@ -4345,6 +4949,10 @@ function buildManageTool(host) {
 					kind: "archive",
 					taskId: args.taskId
 				},
+				settle: {
+					kind: "settle",
+					taskId: args.taskId
+				},
 				restore: {
 					kind: "restore",
 					taskId: args.taskId
@@ -4380,7 +4988,8 @@ function buildScheduleTool(host) {
 	return defineTool({
 		name: "task_board_schedule",
 		description: [
-			"Arm, change, or disarm a task scheduled runs (5-field cron in the Host local time zone; day-of-month and day-of-week use OR semantics).",
+			"Arm, change, or disarm a task scheduled runs (5-field cron; day-of-month and day-of-week follow Vixie semantics: both restricted means OR, otherwise AND).",
+			"The cron wall clock is read in the rule stored IANA time zone; omit timeZone to use the Host zone reported by task_board_list/task_board_get. DST gaps are skipped and an ambiguous fall-back time fires once, at the earlier instant.",
 			"A due scheduled task runs the same cascade a manual run does, so a root task runs its whole subtask tree.",
 			"A schedule whose tree contains an unconfirmed above-default permission is refused and rolls to its next occurrence; the reason is reported in the list board summary as schedulerError.",
 			"Missed occurrences during Host downtime are skipped, never queued; a task that is already running skips its occurrence.",
@@ -4399,6 +5008,10 @@ function buildScheduleTool(host) {
 			cron: {
 				type: "string",
 				description: "5-field cron expression: minute hour day-of-month month day-of-week."
+			},
+			timeZone: {
+				type: "string",
+				description: "IANA zone the cron wall clock is read in (for example Asia/Shanghai). Omit to keep the stored zone, or pass an empty string to clear it back to the Host zone."
 			}
 		},
 		output: {
@@ -4406,11 +5019,12 @@ function buildScheduleTool(host) {
 			render: renderJson
 		},
 		async execute(args, exec) {
-			if (args.enabled === void 0 && args.cron === void 0) return refused("nothing-to-change", "pass enabled and/or cron");
+			if (args.enabled === void 0 && args.cron === void 0 && args.timeZone === void 0) return refused("nothing-to-change", "pass enabled and/or cron and/or timeZone");
 			if (!host.snapshot().tasks.some((task) => task.id === args.taskId)) return refused("task-not-found", "no task with id " + args.taskId);
 			const patch = {
 				...args.enabled === void 0 ? {} : { enabled: args.enabled },
-				...args.cron === void 0 ? {} : { cron: args.cron }
+				...args.cron === void 0 ? {} : { cron: args.cron },
+				...args.timeZone === void 0 ? {} : { timeZone: args.timeZone === "" ? null : args.timeZone }
 			};
 			try {
 				const snapshot = host.apply(crypto.randomUUID(), {
@@ -4595,6 +5209,10 @@ function buildCreateTool(host) {
 				type: "boolean",
 				description: "Run this task as an Agent Team: running it starts one Team Lead session and the Host spawns a teammate per subtask inside it. Omit or false for one independent session per member. Refused when the deployment serves no Agent Teams service."
 			},
+			goalRun: {
+				type: "boolean",
+				description: "Start each run with dsh built-in /goal so the session keeps working continuation rounds until the goal completes. Default true (omit to keep it); pass false for a single plain turn."
+			},
 			tags: {
 				type: "array",
 				description: "Labels: the name renders as a badge and drives the board filter; promptPrefix is injected ahead of the execution prompt on every run.",
@@ -4654,6 +5272,7 @@ function buildCreateTool(host) {
 				...args.model === void 0 || args.model === "" ? {} : { model: args.model },
 				...args.reuseSession === true ? { reuseSession: true } : {},
 				...args.teamRun === true ? { teamRun: true } : {},
+				...args.goalRun === false ? { goalRun: false } : {},
 				...tags.length === 0 ? {} : { tags },
 				...args.schedule === void 0 ? {} : { schedule: {
 					enabled: args.schedule.enabled,
@@ -4715,8 +5334,13 @@ function buildUpdateTool(host) {
 				description: "New agent preset id; an empty string clears it."
 			},
 			permission: {
-				type: "string",
-				enum: [...TASK_PERMISSIONS, ""],
+				oneOf: [{
+					type: "string",
+					enum: [...TASK_PERMISSIONS]
+				}, {
+					type: "string",
+					const: ""
+				}],
 				description: "New permission preset; an empty string clears it back to the session default."
 			},
 			model: {
@@ -4731,6 +5355,10 @@ function buildUpdateTool(host) {
 				type: "boolean",
 				description: "Switches this task between a plain cascade (one session per member) and an Agent Team run (Lead session plus a teammate per subtask)."
 			},
+			goalRun: {
+				type: "boolean",
+				description: "Whether each run starts with dsh built-in /goal (default true). Pass false to run one plain turn instead."
+			},
 			tags: {
 				type: "array",
 				description: "Replacement label set; an empty array clears all labels.",
@@ -4766,6 +5394,7 @@ function buildUpdateTool(host) {
 			if (has(args, "permission") && typeof args.permission === "string") patch.permission = args.permission === "" ? void 0 : args.permission;
 			if (has(args, "reuseSession")) patch.reuseSession = args.reuseSession === true;
 			if (has(args, "teamRun")) patch.teamRun = args.teamRun === true;
+			if (has(args, "goalRun")) patch.goalRun = args.goalRun === false ? false : true;
 			if (has(args, "tags")) {
 				const tags = args.tags ?? [];
 				patch.tags = tags.length === 0 ? null : tags.map((tag) => ({
@@ -4895,13 +5524,47 @@ function resolveAccess(access) {
 	};
 }
 /**
+* Harness browser-auth cookie prefix (dsh-client-connection): the
+* authority-bound signed cookie the Host mints in exchange for its launch
+* token. dsh-web's remote channel redeems that token before re-issuing paired
+* traffic to 127.0.0.1 (packages/dsh-remote-web-ui/src/inner-auth.ts), and the
+* official DSH Desktop shell keeps its own copy from the same exchange and
+* attaches it to every request it forwards for the dsh-app://app/ page. The
+* two constants describe one fact and move together.
+*/
+const BROWSER_AUTH_COOKIE_PREFIX = "dsh-auth-";
+/**
+* Whether a Cookie header carries the Host's browser-auth credential. Only an
+* application on this machine can hold it: the desktop shell never lets it
+* reach the page's cookie jar, and SameSite=Strict keeps a cross-site page
+* from attaching it.
+* @param header - the raw Cookie header value.
+*/
+function carriesBrowserAuthCookie(header) {
+	if (header === void 0) return false;
+	return header.split(";").some((segment) => segment.trim().startsWith(BROWSER_AUTH_COOKIE_PREFIX));
+}
+/**
 * Browser-signal tripwire, NOT an authority check: a bare curl sends neither
 * header and is refused, but a curl with a forged Origin passes this too.
 * The real boundary is the loopback socket + Host + origin-equality checks
 * in isTrustedTaskBoardRequest below; do not rely on this marker alone.
+*
+* A first-party client that presents NEITHER header must still pass. The DSH
+* Desktop shell serves the Web GUI from dsh-app://app/ and forwards that
+* page's Host requests itself, deleting origin and sec-fetch-site on the
+* way (dsh-desktop-host's forwardWebRequest), so the panel's own fetch
+* arrives marker-less and every route behind this guard answered 403 - which
+* the panel renders as its board.hostError.unauthorized message. The shell
+* does attach the Host's browser-auth cookie, redeemed from the Host's launch
+* URL at startup and deliberately withheld from the page. That credential,
+* not a header the shell strips, is the browser signal of an application on
+* this machine; a marker-less, credential-less request stays refused.
 */
 function browserSameOriginMarker(req) {
-	return req.headers["sec-fetch-site"] === "same-origin" || typeof req.headers.origin === "string";
+	if (req.headers["sec-fetch-site"] === "same-origin") return true;
+	if (typeof req.headers.origin === "string") return true;
+	return carriesBrowserAuthCookie(req.headers.cookie);
 }
 function sameAuthority(req, host) {
 	if (req.headers["sec-fetch-site"] === "cross-site") return false;
@@ -5113,38 +5776,111 @@ function makeTaskBoardRoutes(service, access = {}, options = {}) {
 * the loader accepts a standalone install of the same package side by side;
 * without this guard the second instance would still re-register the same
 * webserver routes, tools, settings namespaces, and system-prompt sections
-* and fail the boot. mountOnce makes the second host apply a no-op for the
-* lifetime of the first instance (the browser half is already deduped by
-* package name in the client module host).
+* and fail the boot. mountOnce makes a mount of an already-mounted package a
+* no-op for as long as the first instance lives (the browser half is already
+* deduped by package name in the client module host).
+*
+* A no-op is only safe while the holder is ALIVE. The holder can be disposed
+* long after the refused mount ran its course: the Host reloads a profile by
+* creating the new loader entries before the old ones are torn down (a
+* plugin-manager enable/disable/install write, a settings-driven row reload,
+* HMR), so the new aggregate shell entry mounts its family plugin while the
+* previous entry still owns the name. Dropping that refused mount lost the
+* plugin for good - the previous entry then disposed its own mount, releasing
+* the name with nobody left to take it, and the family row stayed listed as
+* active while its host routes 404ed (the task-board panel showed
+* "board.hostError.notMounted", no degraded record appeared, and only a Host
+* restart recovered it).
+*
+* The refused mount is therefore QUEUED, not dropped, and replayed the moment
+* the holder releases the name - if the waiting fiber is still alive then. The
+* single-instance guarantee is unchanged: exactly one mount is live per
+* package name, and the replay re-enters the guard so a later mount still
+* dedupes against it.
 *
 * The registry rides a global symbol so two module instances of the same
-* package (npm copy vs repository link) still share one verdict. cordis
-* `ctx.effect` runs its callback immediately and treats the callback's
+* package (npm copy vs repository link) still share one verdict. That symbol
+* is a CROSS-REPOSITORY contract, not this file's private state: the four
+* satellite packages (dsh-skins / dsh-pet / dsh-presets /
+* dsh-community-plugins) are separate repositories carrying their own copy of
+* this guard, rebuilt on their own schedule, so the value under `MOUNTED`
+* must keep the shape every published copy reads (a `Set` of package names
+* with `has`/`add`/`delete`). The wait queues this guard added therefore live
+* under their own additive key, and the registry reads back a `Set` even when
+* some other build left a different value there. Changing `MOUNTED`'s shape
+* in place broke that contract once: a satellite's legacy copy created a
+* `Set`, the family's new copy read it as a `Map`, and every family row
+* mounted after it failed with "claims.get is not a function".
+*
+* cordis `ctx.effect` runs its callback immediately and treats the callback's
 * return value as the fiber disposer, so the unmarker is returned, not run.
 */
+/** Published cross-repository contract: package names currently mounted. */
 const MOUNTED = Symbol.for("dsh-web.mounted-plugins");
+/** Additive key this guard owns: refused mounts waiting for the name. */
+const WAITERS = Symbol.for("dsh-web.mounted-plugins.waiters");
+/**
+* The shared name registry, always a `Set` whatever another build stored here:
+* a foreign value (an interim shape, a hand-written global) must not take every
+* family plugin down with it.
+* @returns the process-wide set of mounted package names.
+*/
 function mountedSet() {
 	const registry = globalThis;
-	return registry[MOUNTED] ??= /* @__PURE__ */ new Set();
+	const existing = registry[MOUNTED];
+	if (existing instanceof Set) return existing;
+	const created = /* @__PURE__ */ new Set();
+	registry[MOUNTED] = created;
+	return created;
+}
+/** Queue per package name for mounts refused while a holder was alive. */
+function mountWaiters() {
+	const registry = globalThis;
+	return registry[WAITERS] ??= /* @__PURE__ */ new Map();
 }
 /**
 * Wrap a cordis plugin apply so the package runs at most once per process.
-* The first mount registers normally and unmarks when its fiber disposes;
-* any later mount of the same package name is a no-op.
+* The first mount registers normally and releases the name when its fiber
+* disposes; a mount refused while that name is held waits for the release and
+* then runs, unless its own fiber disposes first.
 * @param packageName - npm package identity shared by every install source.
 * @param fn - the original plugin apply.
 * @returns an apply of the same shape.
 */
 function mountOnce(packageName, fn) {
-	return ((...args) => {
+	const mount = (...args) => {
 		const mounted = mountedSet();
-		if (mounted.has(packageName)) return;
+		const ctx = args[0];
+		if (mounted.has(packageName)) {
+			const waiters = mountWaiters();
+			const queue = waiters.get(packageName) ?? [];
+			let alive = true;
+			const pending = { run: () => {
+				if (alive) mount(...args);
+			} };
+			ctx?.effect?.(() => () => {
+				alive = false;
+				const index = queue.indexOf(pending);
+				if (index >= 0) queue.splice(index, 1);
+			});
+			queue.push(pending);
+			waiters.set(packageName, queue);
+			return;
+		}
 		mounted.add(packageName);
-		args[0]?.effect?.(() => () => {
+		ctx?.effect?.(() => () => {
 			mounted.delete(packageName);
+			const waiters = mountWaiters();
+			const queue = waiters.get(packageName);
+			if (queue === void 0) return;
+			waiters.delete(packageName);
+			for (const waiter of queue.splice(0)) queueMicrotask(() => {
+				waiter.run();
+			});
 		});
 		return fn(...args);
-	});
+	};
+	return mount;
 }
 //#endregion
 //#region src/index.ts
@@ -5228,6 +5964,27 @@ function resolveToolRegistry(ctx) {
 		return;
 	}
 }
+/**
+* Resolve the native cordis timer service (dsh-base's own `cordis-plugin-timer`
+* row). The board arms its schedule through it so unloading the row clears
+* every pending timer with the owning fiber, instead of the row tracking raw
+* process handles by hand. A composition that serves no timer service keeps
+* working on the process globals.
+* @param ctx - the plugin context.
+* @returns the timer face, or undefined when this deployment serves none.
+*/
+function resolveHostTimers(ctx) {
+	try {
+		const timer = ctx.get("timer");
+		if (timer === void 0) return void 0;
+		return typeof timer.timeout === "function" && typeof timer.interval === "function" ? {
+			timeout: timer.timeout.bind(timer),
+			interval: timer.interval.bind(timer)
+		} : void 0;
+	} catch {
+		return;
+	}
+}
 /** Schema default, re-read for hand-built test contexts (the loader applies them normally). */
 const DEFAULT_ANNOUNCE = false;
 /**
@@ -5331,6 +6088,7 @@ function applyImpl(ctx, config) {
 		workspaceRegistry: ctx.workspaceRegistry,
 		sessionDefaultPermission: config?.sessionDefaultPermission ?? "read-only",
 		maxSubtaskDepth: maxSubtaskDepth(),
+		timers: resolveHostTimers(ctx),
 		team: buildTeamDispatcher(ctx, config?.teamProvider ?? "spawn"),
 		commandDispatcher: { async execute(sessionId, line, signal) {
 			const agent = ctx.agents.get(sessionId);
@@ -5416,4 +6174,4 @@ function applyImpl(ctx, config) {
 	sync();
 }
 //#endregion
-export { Config, DEFAULT_PROXY_TOKEN_ENV, DEFAULT_TEAM_PROVIDER, TASK_BOARD_GUIDANCE, apply, buildTeamDispatcher, inject, readConfigField, resolveAgentTeams, resolveLlmRuntime, resolveProxyAccess, resolveToolRegistry };
+export { Config, DEFAULT_PROXY_TOKEN_ENV, DEFAULT_TEAM_PROVIDER, TASK_BOARD_GUIDANCE, apply, buildTeamDispatcher, inject, readConfigField, resolveAgentTeams, resolveHostTimers, resolveLlmRuntime, resolveProxyAccess, resolveToolRegistry };