@linxin666/dsh-client-ui-task-board 0.4.2 → 0.4.4

package/lib/types/core/subtask.d.ts

@@ -24,28 +24,40 @@ export declare const DEFAULT_SUBTASK_DEPTH = 1;
 export declare function normalizeSubtaskDepth(value: unknown): number;
 /** Whether an unknown value is a settled execution outcome. */
 export declare function isExecutionOutcome(value: unknown): value is ExecutionOutcome;
+/**
+ * Reusable lineage index over ONE task list: the id lookup and the direct
+ * children per parent. A caller that runs several lineage queries over the same
+ * ledger (the link-subtask candidate gate runs one per task) builds this once
+ * instead of rescanning the list per query.
+ */
+export interface LineageIndex {
+    readonly byId: ReadonlyMap<string, TaskRecord>;
+    readonly childrenByParent: ReadonlyMap<string, readonly TaskRecord[]>;
+}
+/** Build the reusable index for a task list (ledger order preserved). */
+export declare function buildLineageIndex(tasks: readonly TaskRecord[]): LineageIndex;
 /**
  * Nearest-first ancestor chain of a task. The walk is cycle-safe and bounded
  * by the ledger size rather than by the deployment maximum: a chain stored
  * under a larger limit survives that limit being lowered, and restore and
  * inheritance must still see all of it.
  */
-export declare function ancestorChain(tasks: readonly TaskRecord[], task: TaskRecord): TaskRecord[];
+export declare function ancestorChain(tasks: readonly TaskRecord[], task: TaskRecord, lineage?: LineageIndex): TaskRecord[];
 /** Root-to-task depth: a root task is 0, its subtask 1, and so on. */
-export declare function taskDepth(tasks: readonly TaskRecord[], id: string): number;
+export declare function taskDepth(tasks: readonly TaskRecord[], id: string, lineage?: LineageIndex): number;
 /** Direct subtasks of a task, in ledger order. */
-export declare function directSubtasks(tasks: readonly TaskRecord[], id: string): TaskRecord[];
+export declare function directSubtasks(tasks: readonly TaskRecord[], id: string, lineage?: LineageIndex): TaskRecord[];
 /**
  * Descendants of a task in breadth-first order, bounded by maxSubtaskDepth
  * total depth. The visited set keeps a malformed ledger from looping.
  */
-export declare function descendantTasks(tasks: readonly TaskRecord[], id: string, maxSubtaskDepth: number): TaskRecord[];
+export declare function descendantTasks(tasks: readonly TaskRecord[], id: string, maxSubtaskDepth: number, lineage?: LineageIndex): TaskRecord[];
 /**
  * Height of a task's own subtree (0 for a leaf), bounded by the hard maximum.
  * The visited set makes the walk terminate on a cyclic hand-edited ledger
  * instead of recursing until the stack overflows.
  */
-export declare function subtreeHeight(tasks: readonly TaskRecord[], id: string, visited?: ReadonlySet<string>): number;
+export declare function subtreeHeight(tasks: readonly TaskRecord[], id: string, visited?: ReadonlySet<string>, lineage?: LineageIndex): number;
 /** Why a parent link was refused; also the source of the Host error text. */
 export type ParentLinkRejection = 'unknown-task' | 'unknown-parent' | 'archived-parent' | 'self-parent' | 'cycle' | 'depth-exceeded';
 export interface ParentLinkCheck {
@@ -61,7 +73,7 @@ export interface ParentLinkCheck {
  * and the resulting depth (parent depth + 1 + the child own subtree height)
  * must stay within maxSubtaskDepth.
  */
-export declare function checkParentLink(tasks: readonly TaskRecord[], childId: string, parentId: string | null, maxSubtaskDepth: number): ParentLinkCheck;
+export declare function checkParentLink(tasks: readonly TaskRecord[], childId: string, parentId: string | null, maxSubtaskDepth: number, lineage?: LineageIndex): ParentLinkCheck;
 /**
  * The tasks one run request opens executions for: the requested task first,
  * then its on-board descendants within the configured depth. Archived tasks
@@ -110,13 +122,20 @@ export declare function effectiveTaskPermission(task: TaskRecord): TaskRecord['p
  */
 /**
  * The immutable teammate name for one team-mode member. Teammate names are
- * lower-kebab-case and must stay unique for the lifetime of the Team, so the
- * run-group token is appended: two runs of the same tree never collide. A title
- * with no ASCII word characters (a CJK title, for example) keeps a stable
- * generic prefix and is still distinguished by the token.
+ * lower-kebab-case and must stay unique for the lifetime of the Team: the
+ * run-group token separates two runs of the same tree, and the member
+ * discriminator separates two members of one run that reduce to the same slug.
+ *
+ * The discriminator is not cosmetic. A title with no ASCII word characters (a
+ * CJK title, for example) carries no slug at all, so every such title of one
+ * run group collides on the generic prefix; Agent Teams answers every member
+ * after the first with `teammate name "..." was already used in this Team`,
+ * and those subtasks never start. Two ASCII titles that share a slug
+ * (`AI 强度预测` next to `AI 配比优化`) collide the same way.
  * @param title - the member task's title.
  * @param token - the run group id (the task id when no group is recorded).
+ * @param memberId - the member task's id, which makes the name unique in the run.
  * @returns the teammate name handed to the Agent Teams service.
  */
-export declare function teammateName(title: string, token: string): string;
+export declare function teammateName(title: string, token: string, memberId?: string): string;
 export declare function resolveExecutionTargets(task: TaskRecord, tasks: readonly TaskRecord[], maxSubtaskDepth?: number): TaskRecord;

package/lib/types/core/tasks.d.ts

@@ -75,6 +75,13 @@ export interface ScheduleRule {
     enabled: boolean;
     /** 5-field cron expression: `分 时 日 月 周`. */
     cron: string;
+    /**
+     * IANA zone the cron wall clock is read in (issue #1722). Absent means the
+     * Host process zone, which is what a rule written before zones were
+     * persisted keeps using; the Host stamps its own zone at ledger migration so
+     * a later `TZ` change cannot silently move an existing rule.
+     */
+    timeZone?: string;
     /** Next due instant (ms epoch); maintained by the scheduler/controller. */
     nextRunAt: number | undefined;
     /** Instant of the latest scheduled trigger (ms epoch). */
@@ -214,6 +221,16 @@ export interface TaskRecord {
      * and a subtask's own permission pin cannot be honored in this mode.
      */
     teamRun?: boolean;
+    /**
+     * Start every execution of this task with dsh's built-in `/goal` command,
+     * armed with the composed execution prompt as its objective. The session then
+     * keeps working automatic continuation rounds until the agent marks the goal
+     * complete, and this board settles the execution on the goal's own end
+     * instead of at the first turn end. Absent means ON — the option is checked
+     * by default, so only an explicit `false` runs the task as a single plain
+     * turn. A session whose `/goal` command is refused still runs the prompt.
+     */
+    goalRun?: boolean;
     /**
      * Frozen context snapshot for a continuation card; absent on plain tasks.
      * Sanitized before it enters the ledger (redaction, slash-command taint,
@@ -282,14 +299,21 @@ export interface NewTaskInput {
     reuseSession?: boolean;
     /** Run the subtree as an Agent Team (Team Lead session plus one teammate per direct subtask). */
     teamRun?: boolean;
+    /**
+     * Start the execution with dsh's built-in `/goal`. Absent/true keeps the
+     * default (goal run); an explicit false requests a single plain turn.
+     */
+    goalRun?: boolean;
     /**
      * Optional scheduled-run rule requested at creation time (the new-task
-     * dialog): an enable flag plus a 5-field cron expression. The create use
-     * case arms it only when enabled and the expression is valid.
+     * dialog): an enable flag, a 5-field cron expression, and the IANA zone its
+     * wall clock is read in (absent means the Host zone). The create use case
+     * arms it only when enabled and the expression is valid.
      */
     schedule?: {
         enabled: boolean;
         cron: string;
+        timeZone?: string;
     };
     /**
      * Optional frozen context snapshot (goal/progress/next, sanitized by the

package/lib/types/core/use-cases/task-create.d.ts

@@ -22,5 +22,6 @@ export interface CreateTaskResult {
  * @param now - clock instant (ms epoch).
  * @param id - minted task id.
  * @param maxSubtaskDepth - deployment subtask depth limit.
+ * @param hostTimeZone - zone a rule that stores no zone of its own follows.
  */
-export declare function applyCreateTask(tasks: readonly TaskRecord[], input: NewTaskInput, now: number, id: string, maxSubtaskDepth?: number): CreateTaskResult;
+export declare function applyCreateTask(tasks: readonly TaskRecord[], input: NewTaskInput, now: number, id: string, maxSubtaskDepth?: number, hostTimeZone?: string): CreateTaskResult;

package/lib/types/core/use-cases/task-schedule.d.ts

@@ -3,6 +3,8 @@ import { type TaskRecord } from '../tasks.ts';
 export interface SetSchedulePatch {
     enabled?: boolean;
     cron?: string;
+    /** IANA zone for the cron wall clock; `null` clears it back to the Host zone. */
+    timeZone?: string | null;
 }
 /** Result of arming/disarming a rule. */
 export interface SetScheduleResult {
@@ -12,15 +14,17 @@ export interface SetScheduleResult {
     applied: boolean;
 }
 /**
- * Set an on-board task's schedule rule. A blank or invalid cron, or an
- * archived task, is rejected (state untouched); an enabled rule computes the
- * next run instant immediately, a disabled one carries no next-run instant.
+ * Set an on-board task's schedule rule. A blank or invalid cron, an unknown or
+ * archived task, or an unusable zone is rejected (state untouched); an enabled
+ * rule computes the next run instant immediately in the rule's own zone, a
+ * disabled one carries no next-run instant.
  * @param tasks - current ledger.
  * @param id - the task to schedule.
  * @param patch - rule fields to change (absent fields keep their current value).
  * @param now - clock instant (ms epoch).
+ * @param hostTimeZone - zone a rule with no stored zone follows.
  */
-export declare function applySetSchedule(tasks: readonly TaskRecord[], id: string, patch: SetSchedulePatch, now: number): SetScheduleResult;
+export declare function applySetSchedule(tasks: readonly TaskRecord[], id: string, patch: SetSchedulePatch, now: number, hostTimeZone: string): SetScheduleResult;
 /**
  * Roll a task's schedule rule forward (scheduler callback): persist the next
  * due instant and the trigger instant. No-op for tasks without a rule (deleted

package/lib/types/core/use-cases/task-update.d.ts

@@ -15,7 +15,7 @@ import type { TaskHandoverInput } from '../handover.ts';
  * Editable fields on a task (the update patch surface). `freeze` replaces the
  * continuation-card snapshot (restamping frozenAt); an explicit null clears it.
  */
-export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission' | 'model' | 'reuseSession' | 'teamRun'>> & {
+export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission' | 'model' | 'reuseSession' | 'teamRun' | 'goalRun'>> & {
     freeze?: FreezeSnapshot & {
         redacted?: boolean;
     } | null;

package/lib/types/host-ledger.d.ts

@@ -23,11 +23,20 @@ export interface OpenExecutionReference {
     readonly executionId: string;
     readonly sessionId: string | undefined;
     readonly startedAt: number;
+    /**
+     * True for a member of a team-mode run other than its Lead. A teammate is a
+     * durable member of the Team: it stays alive after its turn ends, so the
+     * roster may keep reporting its session as running, and the turn it completed
+     * is the only verdict it exposes.
+     */
+    readonly teamMember: boolean;
 }
 /** Minimal value copy used by the Host scheduler. */
 export interface DueScheduleReference {
     readonly taskId: string;
     readonly cron: string;
+    /** Zone this rule's wall clock is read in. */
+    readonly timeZone: string;
     readonly nextRunAt: number;
 }
 /** Derived runtime data for one session-poll pass. */
@@ -116,6 +125,15 @@ export declare class HostTaskLedger {
     runtimeView(): LedgerRuntimeView;
     /** Count armed, non-archived schedules without cloning task histories. */
     armedScheduleCount(): number;
+    /**
+     * The earliest armed `nextRunAt` strictly after the supplied Host time, or
+     * undefined when no schedule is armed in the future. This is the instant the
+     * Host arms its native timer at, so the board wakes exactly when work is due
+     * instead of polling a fixed heartbeat.
+     * @param now - current Host time in ms epoch.
+     * @returns the nearest future trigger, or undefined when none is armed.
+     */
+    nextArmedRunAt(now: number): number | undefined;
     /** Return value-only references for schedules due at the supplied Host time. */
     dueSchedules(now: number): DueScheduleReference[];
     subscribe(listener: () => void): () => void;
@@ -182,13 +200,56 @@ export declare class HostTaskLedger {
      * (failure dominates, then cancellation).
      */
     private settleCascade;
+    /**
+     * Close every run that is already decided, and fold every lineage whose
+     * members are all settled. The Host poll calls this on every tick, so a run
+     * can no longer be left in the running column by a settle nobody observed:
+     *
+     * - A team run is governed by its Lead. Once the Lead's own outcome is
+     *   recorded, its still-open members are settled with that verdict. A
+     *   teammate is a durable member of the Team and may never report a turn of
+     *   its own, and without this the whole lineage waits on it forever.
+     * - A cascade parent whose members are all settled is finalized here even
+     *   when the settle that completed the tree happened in another process, or
+     *   was interrupted between its child write and its parent write.
+     *
+     * Idempotent: a run that is already folded is left untouched, so a caller may
+     * invoke it on every tick.
+     * @param persist - false to leave the document for the caller to commit.
+     * @returns whether the document changed.
+     */
+    finalizeReadyRuns(persist?: boolean): boolean;
+    /**
+     * The verdict a team run's Lead has already recorded: its own turn outcome
+     * once that turn ended, or the folded outcome once its card settled.
+     */
+    private leadVerdict;
+    /**
+     * Settle every still-open member of a team run with the Lead's verdict.
+     * A teammate that already reported its own outcome keeps it: the ordinary
+     * fold still lets a failure dominate.
+     * @param leadId - the Lead card's task id (never settled here).
+     * @param groupId - the team run's group.
+     * @param verdict - the Lead's outcome, inherited by members that never reported.
+     * @param error - the Lead's failure text, inherited with a failed verdict.
+     * @param now - clock instant (ms epoch).
+     * @returns whether the document changed.
+     */
+    private closeTeamMembers;
     private repairSchedules;
     private reconcileInterruptedStarts;
     /**
-     * Field-preserving v2 to v3 migration. v3 adds no fields yet, so the
-     * migration reuses the v3 normalization, but it first proves every task
-     * row is structurally valid: a v2 document that would silently drop or
-     * coerce rows fails loudly instead (no quarantined-empty restart).
+     * Field-preserving migration of a pre-v4 document. It first proves every task
+     * row is structurally valid, so a document that would silently drop or coerce
+     * rows fails loudly instead (no quarantined-empty restart), and then reuses
+     * the current normalization.
+     *
+     * v4 adds `ScheduleRule.timeZone`. A rule written before v4 was evaluated in
+     * whatever zone the Host process happened to report, so the migration stamps
+     * that zone onto every enabled rule: the trigger instant is preserved exactly
+     * (the stored `nextRunAt` already encodes the old zone), but the rule stops
+     * following a later `TZ` change, which is what made an existing schedule
+     * silently move when the Host's zone changed.
      */
     private migrateLegacyDocument;
     private load;

package/lib/types/host-runner.d.ts

@@ -23,8 +23,18 @@ type ExecutionSessionId = SessionSummary['sessionId'];
 export interface SessionCommandDispatcher {
     execute(sessionId: ExecutionSessionId, line: string, signal: AbortSignal): Promise<CommandResult | undefined>;
 }
-export type ExecutionInspection = {
+export type ExecutionInspection = 
+/**
+ * No verdict yet. `unreadable` separates "the work may still be in progress"
+ * from "this session's history could not be read at all": a reader failure is
+ * not progress, and the caller decides how long to keep waiting before it
+ * reports the execution as undeterminable instead of holding a card open
+ * forever.
+ */
+{
     outcome: 'pending';
+    unreadable?: true;
+    reason?: string;
 } | {
     outcome: 'succeeded';
 } | {
@@ -64,6 +74,17 @@ export interface PromptContext {
     peers?: readonly PromptPeer[];
     /** True when those members run as teammates inside this session (Team Lead). */
     team?: boolean;
+    /**
+     * Scheduled-run provenance: the instant the cron rule actually fired and the
+     * IANA zone its wall clock was read in. Present only for a cron-triggered
+     * run, so the model can resolve an unqualified date in the run's own terms
+     * instead of guessing from the Host clock (issue #1722).
+     */
+    schedule?: {
+        triggeredAt: number;
+        timeZone: string;
+        cron: string;
+    };
 }
 /**
  * Build the execution prompt for one task.
@@ -72,6 +93,16 @@ export interface PromptContext {
  * @returns the prompt text.
  */
 export declare function promptText(task: TaskRecord, context?: PromptContext): string;
+/**
+ * Build the objective the built-in `/goal` command receives. A prompt whose
+ * text would be read as a goal operation is prefixed with a neutral label: the
+ * instruction stays intact, and the command arms an objective instead of
+ * clearing, pausing, or editing an unrelated goal (or refusing for a missing
+ * one).
+ * @param prompt - the composed execution prompt.
+ * @returns the objective text for `/goal <objective>`.
+ */
+export declare function goalObjective(prompt: string): string;
 export declare class HostExecutionRunner {
     private readonly gateway;
     private readonly commands?;
@@ -122,6 +153,37 @@ export declare class HostExecutionRunner {
      * the same permission/model pins before the prompt.
      */
     private pinAndPrompt;
+    /**
+     * Arm dsh's built-in goal on the session. The task prompt is queued FIRST, so
+     * the session's first turn carries the instruction verbatim; `/goal
+     * <objective>` then turns the same text into a persistent objective, and
+     * dsh's goal-round driver keeps starting continuation rounds until the agent
+     * marks it complete (see {@link goalVerdict} for how the run settles).
+     *
+     * Opt-out: a task whose `goalRun` is an explicit false runs one plain turn.
+     * A refusal (no command dispatcher, no `/goal` command in this cohort, an
+     * objective the command rejects) is reported and the run continues as that
+     * plain turn: the task was asked to run, and a missing goal mode must not
+     * lose the work.
+     */
+    private armGoal;
+    /**
+     * The verdict an armed dsh goal imposes on an otherwise completed turn.
+     *
+     * A goal run is one session working many automatic continuation rounds:
+     * dsh's goal-round driver queues the next round whenever the agent goes
+     * idle, so the first completed `turn/end` is not the execution's result.
+     * Settling there would leave the card in `done` while the session keeps
+     * working, and a scheduled task would fire a second, concurrent session.
+     * The session projection is the authority: an `active` goal keeps the
+     * execution pending, a `blocked` goal fails it with the recorded reason, and
+     * any other phase (complete, paused, or no goal at all) leaves the turn
+     * verdict in place.
+     *
+     * An unreadable projection falls back to that turn verdict: a cohort whose
+     * gateway withdrew `session/projections` must not hang every execution.
+     */
+    private goalVerdict;
     listRunning(): Promise<{
         known: true;
         count: number;
@@ -129,6 +191,17 @@ export declare class HostExecutionRunner {
     } | {
         known: false;
     }>;
-    /** Resolve an execution outcome from the session list and bounded history pages. */
-    inspect(sessionId: string, startedAt?: number, sessions?: readonly SessionSummary[]): Promise<ExecutionInspection>;
+    /**
+     * Resolve an execution outcome from the session list and bounded history pages.
+     * @param sessionId - the session the execution runs in.
+     * @param startedAt - instant the execution opened; earlier events are not its own.
+     * @param sessions - roster from the caller's own poll, when it already has one.
+     * @param options.whileRunning - read the first completed turn even while the
+     *   roster reports the session as running. A durable Agent Teams teammate
+     *   stays alive after its turn ends, so `running` never clears for it and the
+     *   turn it completed is the only verdict it will ever expose.
+     */
+    inspect(sessionId: string, startedAt?: number, sessions?: readonly SessionSummary[], options?: {
+        whileRunning?: boolean;
+    }): Promise<ExecutionInspection>;
 }

package/lib/types/host-service.d.ts

@@ -31,16 +31,40 @@ export interface TeamSpawnResult {
 export interface TaskBoardTeamDispatcher {
     spawn(input: TeamSpawnInput): Promise<TeamSpawnResult>;
 }
+/**
+ * Provenance of one cron-triggered cascade: when the rule fired and the zone
+ * its wall clock was read in. Passed into every launched prompt of that run so
+ * a scheduled job knows its own clock rather than inferring one.
+ */
+export interface ScheduledRunContext {
+    triggeredAt: number;
+    timeZone: string;
+    cron: string;
+}
+/**
+ * The native timer face the Host arms through. The cordis `timer` service
+ * (dsh-base's own `cordis-plugin-timer` row) provides it: its handles are
+ * registered on the owning fiber, so unloading the board clears every armed
+ * timer without this service tracking handles by hand. A composition that
+ * serves no timer service falls back to the process globals.
+ */
+export interface HostTimerFace {
+    timeout(callback: () => void, delay: number): () => void;
+    interval(callback: () => void, delay: number): () => void;
+}
 export declare class TaskBoardHostService {
     readonly ledger: HostTaskLedger;
     readonly runner: HostExecutionRunner;
     readonly power: PowerInhibitor;
     private readonly listeners;
-    private timers;
-    private lastScheduleTick;
+    /** The one recurring timer: the session-roster poll. */
+    private pollTimer;
+    /** The armed schedule timer, if a trigger is pending. */
+    private scheduleTimer;
+    /** The instant the armed schedule timer targets (ms epoch), for resume detection. */
+    private scheduleTarget;
     private disposed;
     private pollInFlight;
-    private tickInFlight;
     private active;
     /**
      * Ids the last roster poll saw as present and idle; undefined while the
@@ -49,8 +73,15 @@ export declare class TaskBoardHostService {
      * conversation instead of prompting into a session it cannot see.
      */
     private idleSessionIds;
+    /**
+     * Consecutive unreadable-history polls per open execution (see
+     * {@link noteUnreadableInspection}). Cleared as soon as an inspection
+     * resolves, so a transient reader failure never fails a card.
+     */
+    private readonly unreadablePolls;
     private preventIdleSleep;
     private readonly team;
+    private readonly timers;
     private lastPowerJson;
     private readonly now;
     constructor(gateway: TypertGateway, options?: {
@@ -62,6 +93,7 @@ export declare class TaskBoardHostService {
         sessionDefaultPermission?: TaskPermission;
         maxSubtaskDepth?: number;
         team?: TaskBoardTeamDispatcher;
+        timers?: HostTimerFace;
     });
     start(): void;
     setConfiguration(active: boolean, preventIdleSleep: boolean): void;
@@ -84,7 +116,42 @@ export declare class TaskBoardHostService {
     private pollSessions;
     /** Reuse the session list this poll already fetched: one list RPC per tick, not 1 + E. */
     private reconcileExecutions;
-    private tickSchedule;
+    /**
+     * Count one poll whose session history could not be read. A reader failure is
+     * not progress: the session is not running (the runner only reads history for
+     * one that is idle), so nothing will ever change that verdict. After
+     * {@link UNREADABLE_SETTLE_POLLS} consecutive polls the execution is reported
+     * failed with the recorded reason, instead of holding its card — and every
+     * ancestor of it — in the running column with no way out. The first poll of
+     * each streak is logged, so the Host log names the session.
+     */
+    private noteUnreadableInspection;
+    /** Drop the armed schedule timer and forget its target. */
+    private clearScheduleTimer;
+    /**
+     * Boot / resume recovery: skip every occurrence that came due while the
+     * board was not running and roll each schedule to its next future target,
+     * then arm the timer for the nearest one. Rendering the occurrence is
+     * deliberately not attempted: the ACL of a card that fired hours ago is
+     * stale, and the board's own recovery contract is "missed triggers are
+     * skipped, never replayed".
+     */
+    private recoverSchedule;
+    /**
+     * Arm the native timer at the nearest armed future trigger. One timer serves
+     * every schedule: the ledger's next target is the only instant the Host has
+     * to wake for. A target beyond the platform's timer ceiling re-arms in
+     * segments, and a target already past (the wall clock jumped, or the process
+     * was suspended) is handled immediately as a recovery.
+     */
+    private armSchedule;
+    /**
+     * One armed target became due. A fire landing well past its target is a
+     * resume (suspend, throttle, forward clock jump) rather than a normal
+     * occurrence, so it takes the recovery path instead of launching a run for a
+     * long-stale instant.
+     */
+    private onScheduleFire;
     private armedSchedules;
     /**
      * Launch one run set. The root goes first and receives the run shape in its
@@ -96,7 +163,12 @@ export declare class TaskBoardHostService {
     private dispatchRuns;
     private scheduleLaunch;
     private schedulePoll;
-    private scheduleTick;
+    /**
+     * Re-arm from the ledger's current targets. Callers that just changed a
+     * schedule (the host routes, the agent tools) invoke this after the write
+     * commits, so a new or edited trigger arms without waiting for the next fire.
+     */
+    refreshSchedule(): void;
     private syncPowerReasons;
     private emit;
 }

package/lib/types/index.d.ts

@@ -9,7 +9,7 @@ import type { Context, Volatile } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
 import type { ToolDefinition } from '@deepseek-ai/dsh-tools';
 import type { LlmRuntime } from '@deepseek-ai/dsh-llm';
-import { type TaskBoardTeamDispatcher } from './host-service.ts';
+import { type HostTimerFace, type TaskBoardTeamDispatcher } from './host-service.ts';
 import { type TaskPermission } from './core/tasks.ts';
 /** Default environment variable holding the authenticated proxy token. */
 export declare const DEFAULT_PROXY_TOKEN_ENV = "DSH_TASK_BOARD_PROXY_TOKEN";
@@ -139,6 +139,16 @@ interface AgentToolRegistry {
  * @returns the registry, or undefined when this deployment serves none.
  */
 export declare function resolveToolRegistry(ctx: Context): AgentToolRegistry | undefined;
+/**
+ * Resolve the native cordis timer service (dsh-base's own `cordis-plugin-timer`
+ * row). The board arms its schedule through it so unloading the row clears
+ * every pending timer with the owning fiber, instead of the row tracking raw
+ * process handles by hand. A composition that serves no timer service keeps
+ * working on the process globals.
+ * @param ctx - the plugin context.
+ * @returns the timer face, or undefined when this deployment serves none.
+ */
+export declare function resolveHostTimers(ctx: Context): HostTimerFace | undefined;
 /** The subset of the Agent Teams service this plugin drives. */
 interface AgentTeamsFace {
     spawnTeammate(caller: unknown, request: {

package/lib/types/mount-once.d.ts

@@ -4,19 +4,50 @@
  * the loader accepts a standalone install of the same package side by side;
  * without this guard the second instance would still re-register the same
  * webserver routes, tools, settings namespaces, and system-prompt sections
- * and fail the boot. mountOnce makes the second host apply a no-op for the
- * lifetime of the first instance (the browser half is already deduped by
- * package name in the client module host).
+ * and fail the boot. mountOnce makes a mount of an already-mounted package a
+ * no-op for as long as the first instance lives (the browser half is already
+ * deduped by package name in the client module host).
+ *
+ * A no-op is only safe while the holder is ALIVE. The holder can be disposed
+ * long after the refused mount ran its course: the Host reloads a profile by
+ * creating the new loader entries before the old ones are torn down (a
+ * plugin-manager enable/disable/install write, a settings-driven row reload,
+ * HMR), so the new aggregate shell entry mounts its family plugin while the
+ * previous entry still owns the name. Dropping that refused mount lost the
+ * plugin for good - the previous entry then disposed its own mount, releasing
+ * the name with nobody left to take it, and the family row stayed listed as
+ * active while its host routes 404ed (the task-board panel showed
+ * "board.hostError.notMounted", no degraded record appeared, and only a Host
+ * restart recovered it).
+ *
+ * The refused mount is therefore QUEUED, not dropped, and replayed the moment
+ * the holder releases the name - if the waiting fiber is still alive then. The
+ * single-instance guarantee is unchanged: exactly one mount is live per
+ * package name, and the replay re-enters the guard so a later mount still
+ * dedupes against it.
  *
  * The registry rides a global symbol so two module instances of the same
- * package (npm copy vs repository link) still share one verdict. cordis
- * `ctx.effect` runs its callback immediately and treats the callback's
+ * package (npm copy vs repository link) still share one verdict. That symbol
+ * is a CROSS-REPOSITORY contract, not this file's private state: the four
+ * satellite packages (dsh-skins / dsh-pet / dsh-presets /
+ * dsh-community-plugins) are separate repositories carrying their own copy of
+ * this guard, rebuilt on their own schedule, so the value under `MOUNTED`
+ * must keep the shape every published copy reads (a `Set` of package names
+ * with `has`/`add`/`delete`). The wait queues this guard added therefore live
+ * under their own additive key, and the registry reads back a `Set` even when
+ * some other build left a different value there. Changing `MOUNTED`'s shape
+ * in place broke that contract once: a satellite's legacy copy created a
+ * `Set`, the family's new copy read it as a `Map`, and every family row
+ * mounted after it failed with "claims.get is not a function".
+ *
+ * cordis `ctx.effect` runs its callback immediately and treats the callback's
  * return value as the fiber disposer, so the unmarker is returned, not run.
  */
 /**
  * Wrap a cordis plugin apply so the package runs at most once per process.
- * The first mount registers normally and unmarks when its fiber disposes;
- * any later mount of the same package name is a no-op.
+ * The first mount registers normally and releases the name when its fiber
+ * disposes; a mount refused while that name is held waits for the release and
+ * then runs, unless its own fiber disposes first.
  * @param packageName - npm package identity shared by every install source.
  * @param fn - the original plugin apply.
  * @returns an apply of the same shape.

package/lib/types/protocol.d.ts

@@ -1,8 +1,10 @@
 import type { TaskUpdatePatch } from './core/use-cases/task-update.ts';
 import { type NewTaskInput, type TaskPermission, type TaskRecord, type TaskStatus } from './core/tasks.ts';
-export declare const TASK_BOARD_SCHEMA_VERSION: 3;
-/** Ledger documents written before v3; loaded once and migrated on startup. */
-export declare const TASK_BOARD_LEGACY_SCHEMA_VERSION: 2;
+export declare const TASK_BOARD_SCHEMA_VERSION: 4;
+/** Ledger documents written before v4; loaded once and migrated on startup. */
+export declare const TASK_BOARD_LEGACY_SCHEMA_VERSION: 3;
+/** Ledger documents written before v3; migrated through the v3 normalization too. */
+export declare const TASK_BOARD_OLDER_SCHEMA_VERSION: 2;
 export declare const TASK_BOARD_API_PREFIX = "/api/task-board";
 export type PowerPhase = 'disabled' | 'idle' | 'acquiring' | 'active' | 'error' | 'unsupported';
 export interface TaskBoardPowerSnapshot {
@@ -90,12 +92,16 @@ export type TaskBoardAction = {
 } | {
     kind: 'restore';
     taskId: string;
+} | {
+    kind: 'settle';
+    taskId: string;
 } | {
     kind: 'set-schedule';
     taskId: string;
     patch: {
         enabled?: boolean;
         cron?: string;
+        timeZone?: string | null;
     };
 } | {
     kind: 'run';