@linxin666/dsh-client-ui-task-board 0.4.3 → 0.4.5

package/src/core/tasks.ts

@@ -5,7 +5,9 @@
  * unit-testable in isolation.
  */
 import type { FreezeSnapshot } from './freeze-snapshot.ts'
+import type { ExecutionVerification } from './verification.ts'
 import type { TaskHandover, TaskHandoverInput } from './handover.ts'
+import { normalizeTaskIntegrations, type TaskBoardExtensionPayload } from './extension.ts'
 
 /** Task lifecycle status, one per kanban column. */
 export type TaskStatus = 'backlog' | 'todo' | 'running' | 'done' | 'failed'
@@ -55,6 +57,14 @@ export interface ExecutionRecord {
   ownResult?: ExecutionOutcome
   /** Human failure text that arrived with {@link ownResult}. */
   ownError?: string
+  /**
+   * Goal acceptance state of this execution (task-board goal verification).
+   * Fixed when the execution starts and never rewritten from later settings:
+   * the contract is frozen here, the attempts accrue here, and the settlement
+   * rule reads the pass record here. Absent on an execution that started
+   * before the feature existed, which keeps it on the historical verdict.
+   */
+  verification?: ExecutionVerification
 }
 
 /**
@@ -87,6 +97,13 @@ export interface ScheduleRule {
   enabled: boolean
   /** 5-field cron expression: `分 时 日 月 周`. */
   cron: string
+  /**
+   * IANA zone the cron wall clock is read in (issue #1722). Absent means the
+   * Host process zone, which is what a rule written before zones were
+   * persisted keeps using; the Host stamps its own zone at ledger migration so
+   * a later `TZ` change cannot silently move an existing rule.
+   */
+  timeZone?: string
   /** Next due instant (ms epoch); maintained by the scheduler/controller. */
   nextRunAt: number | undefined
   /** Instant of the latest scheduled trigger (ms epoch). */
@@ -278,6 +295,30 @@ export interface TaskRecord {
    * and a subtask's own permission pin cannot be honored in this mode.
    */
   teamRun?: boolean
+  /**
+   * Start every execution of this task with dsh's built-in `/goal` command,
+   * armed with the composed execution prompt as its objective. The session then
+   * keeps working automatic continuation rounds until the agent marks the goal
+   * complete, and this board settles the execution on the goal's own end
+   * instead of at the first turn end. Absent means ON — the option is checked
+   * by default, so only an explicit `false` runs the task as a single plain
+   * turn. A session whose `/goal` command is refused still runs the prompt.
+   */
+  goalRun?: boolean
+  /**
+   * Run this task's goal executions WITHOUT the board's acceptance gate.
+   *
+   * Absent means INHERIT: the execution's applicability is decided by the
+   * board-wide `goalVerification` switch frozen at start, exactly as a card
+   * that never touched this option behaves. Only an explicit `true` opts the
+   * card out, and the execution records `applicability: 'disabled'` so the
+   * report says plainly that nothing certified this run.
+   *
+   * The opt-out is per execution, not per run: flipping it never rewrites the
+   * verdict rule of an execution already open, and a rerun or a scheduled
+   * occurrence reads the card's current value when it freezes its contract.
+   */
+  skipVerification?: boolean
   /**
    * Frozen context snapshot for a continuation card; absent on plain tasks.
    * Sanitized before it enters the ledger (redaction, slash-command taint,
@@ -309,6 +350,20 @@ export interface TaskRecord {
    * absent means on-board.
    */
   archivedAt?: number
+  /**
+   * Opaque external-provider metadata, keyed by extension id; optional and
+   * additive so existing tasks require no ledger migration. The board stores
+   * and forwards it without interpreting the keys — each provider owns the
+   * shape and validation of its own entry.
+   */
+  integrations?: Record<string, TaskBoardExtensionPayload>
+  /**
+   * Whether the card is held off the board: it exists in the ledger (and its
+   * execution history is intact) but no column ever renders it. Providers
+   * create hidden cards for work they materialize but do not want displayed;
+   * absent means on-board.
+   */
+  hidden?: boolean
 }
 
 /**
@@ -342,7 +397,7 @@ export interface NewTaskInput {
    * inherits the parent's unset execution targets.
    */
   parentId?: string
-  /** Workspace the execution must run in; empty/absent = the recent workspace. */
+  /** Workspace the execution must run in; empty/absent = the creating session's workspace for a root task, else the recent workspace at execution time. */
   workspaceId?: string
   /** Agent preset the execution session must be composed from; empty/absent = deployment default. */
   mode?: string
@@ -354,12 +409,23 @@ export interface NewTaskInput {
   reuseSession?: boolean
   /** Run the subtree as an Agent Team (Team Lead session plus one teammate per direct subtask). */
   teamRun?: boolean
+  /**
+   * Start the execution with dsh's built-in `/goal`. Absent/true keeps the
+   * default (goal run); an explicit false requests a single plain turn.
+   */
+  goalRun?: boolean
+  /**
+   * Run this task's goal executions without the acceptance gate; absent
+   * inherits the board-wide `goalVerification` switch.
+   */
+  skipVerification?: boolean
   /**
    * Optional scheduled-run rule requested at creation time (the new-task
-   * dialog): an enable flag plus a 5-field cron expression. The create use
-   * case arms it only when enabled and the expression is valid.
+   * dialog): an enable flag, a 5-field cron expression, and the IANA zone its
+   * wall clock is read in (absent means the Host zone). The create use case
+   * arms it only when enabled and the expression is valid.
    */
-  schedule?: { enabled: boolean; cron: string }
+  schedule?: { enabled: boolean; cron: string; timeZone?: string }
   /**
    * Optional frozen context snapshot (goal/progress/next, sanitized by the
    * protocol gate) turning the new task into a continuation card.
@@ -375,6 +441,12 @@ export interface NewTaskInput {
    * ahead of the execution prompt; a bare name changes nothing at run time.
    */
   tags?: TaskTag[]
+  /** Opaque external-provider metadata keyed by extension id. */
+  integrations?: Record<string, TaskBoardExtensionPayload>
+  /** Column the created card opens in; absent means the board default (todo). */
+  status?: TaskStatus
+  /** Create the card off-board (held in the ledger, never rendered). */
+  hidden?: boolean
 }
 
 /** The five kanban columns, in display order. */
@@ -386,8 +458,20 @@ export const COLUMNS: readonly { status: TaskStatus; label: string }[] = [
   { status: 'failed', label: '已失败' },
 ]
 
-/** Statuses a user may move a card to manually (execution states are owned by the runner). */
-export const MANUAL_STATUSES: readonly TaskStatus[] = ['backlog', 'todo']
+/**
+ * Statuses a card may be moved to by hand: every column. The board UI and the
+ * agent tool surface share this one list, so no column can be manual on one
+ * surface and locked on the other.
+ *
+ * The column is a board statement, not a claim about a run. A hand-written
+ * `done`/`failed` declares that the work finished (or failed) outside a
+ * Host-run execution — human hands, an external system — and a hand-written
+ * `running` says the work is under way without a tracked session. None of them
+ * creates an {@link ExecutionRecord}, which is what keeps a declaration
+ * distinguishable from a recorded outcome in the card's execution history; the
+ * next settled run overwrites the column with the real one.
+ */
+export const MANUAL_STATUSES: readonly TaskStatus[] = ['backlog', 'todo', 'running', 'done', 'failed']
 
 /** Statuses the runner may move a card to from 'running'. */
 export const RUNNER_SETTLE_STATUSES: readonly TaskStatus[] = ['done', 'failed']
@@ -402,9 +486,35 @@ export function isTaskStatus(value: unknown): value is TaskStatus {
   return typeof value === 'string' && (ALL_STATUSES as readonly string[]).includes(value)
 }
 
-/** Whether a manual move target is allowed from the given status. */
+/**
+ * Whether the manual move `from` -> `to` is a legal *column* change: any
+ * column, and never the one the card already shows.
+ *
+ * Whether the card may be moved at all is a separate question. The lock an
+ * executing card carries belongs to its open execution, never to the column
+ * text, so it is {@link canMoveTask} — not this predicate — that expresses it.
+ */
 export function canMoveManually(from: TaskStatus, to: TaskStatus): boolean {
-  return from !== 'running' && (MANUAL_STATUSES as readonly TaskStatus[]).includes(to)
+  return from !== to && (MANUAL_STATUSES as readonly TaskStatus[]).includes(to)
+}
+
+/**
+ * Whether the board may move `task` to `to` by hand: the card is on-board,
+ * holds no open execution, and the target is a legal column change. The ledger,
+ * the detail view's status buttons and the board's drop handler all decide
+ * through this one predicate, so no two surfaces can disagree about a card.
+ */
+export function canMoveTask(task: TaskRecord, to: TaskStatus): boolean {
+  return task.archivedAt === undefined && !hasOpenExecution(task) && canMoveManually(task.status, to)
+}
+
+/**
+ * Whether the task still has an execution the runner has not settled. This —
+ * not the `running` column — is what "the runner owns this card" means: a card
+ * parked in `running` by hand has no session and stays fully movable.
+ */
+export function hasOpenExecution(task: TaskRecord): boolean {
+  return task.executions.some(execution => execution.endedAt === undefined)
 }
 
 /** Normalize one optional execution-target string: trim; blank collapses to undefined. */
@@ -434,13 +544,14 @@ export function freezeOf(
 /** Create a task from user input. */
 export function createTask(input: NewTaskInput, now: number, id: string): TaskRecord {
   const tags = normalizeTags(input.tags)
+  const integrations = normalizeTaskIntegrations(input.integrations)
   return {
     id,
     title: input.title.trim(),
     description: input.description.trim(),
     prompt: input.prompt.trim(),
     parentId: normalizeTargetId(input.parentId),
-    status: 'todo',
+    status: input.status ?? 'todo',
     createdAt: now,
     updatedAt: now,
     executions: [],
@@ -449,10 +560,20 @@ export function createTask(input: NewTaskInput, now: number, id: string): TaskRe
     permission: isTaskPermission(input.permission) ? input.permission : undefined,
     model: normalizeTargetId(input.model),
     reuseSession: input.reuseSession === true ? true : undefined,
-  teamRun: input.teamRun === true ? true : undefined,
+    teamRun: input.teamRun === true ? true : undefined,
+    // Default ON: only an explicit false is stored, so a card that never
+    // touched the option (and every card written before the field existed)
+    // keeps starting its runs with /goal.
+    goalRun: input.goalRun === false ? false : undefined,
+    // Default OFF: only an explicit true is stored, so a card that never
+    // touched the option inherits the board-wide acceptance switch exactly as
+    // every card written before the field existed does.
+    skipVerification: input.skipVerification === true ? true : undefined,
     ...(input.freeze === undefined ? {} : { freeze: freezeOf(input.freeze, now) }),
     ...(input.handover === undefined ? {} : { handover: { ...input.handover, bundledAt: now } }),
     ...(tags === undefined ? {} : { tags }),
+    ...(integrations === undefined ? {} : { integrations }),
+    ...(input.hidden === true ? { hidden: true } : {}),
   }
 }
 
@@ -476,11 +597,18 @@ export function withSchedule(
   const schedule: ScheduleRule = {
     enabled: current?.enabled ?? false,
     cron: current?.cron ?? '',
+    ...(current?.timeZone === undefined ? {} : { timeZone: current.timeZone }),
     nextRunAt: current?.nextRunAt,
     lastTriggeredAt: current?.lastTriggeredAt,
   }
   if ('enabled' in patch) schedule.enabled = patch.enabled ?? false
   if ('cron' in patch) schedule.cron = patch.cron ?? ''
+  // An explicit `undefined` drops the stored zone (back to the Host zone);
+  // an absent key keeps it.
+  if ('timeZone' in patch) {
+    if (patch.timeZone === undefined) delete schedule.timeZone
+    else schedule.timeZone = patch.timeZone
+  }
   if ('nextRunAt' in patch) schedule.nextRunAt = patch.nextRunAt
   if ('lastTriggeredAt' in patch) schedule.lastTriggeredAt = patch.lastTriggeredAt
   return { ...task, updatedAt: now, schedule }

package/src/core/use-cases/task-create.ts

@@ -4,7 +4,7 @@
  * (no persistence or notify - the controller orchestrates those), so it is
  * unit-testable without any runtime face.
  */
-import { isValidCron, nextRunAtMs } from '../schedule.ts'
+import { isValidCron, isValidTimeZone, nextRunAtMs, resolveHostTimeZone } from '../schedule.ts'
 import { DEFAULT_SUBTASK_DEPTH, normalizeSubtaskDepth, taskDepth } from '../subtask.ts'
 import { createTask, withSchedule, type NewTaskInput, type TaskRecord } from '../tasks.ts'
 
@@ -32,6 +32,7 @@ export interface CreateTaskResult {
  * @param now - clock instant (ms epoch).
  * @param id - minted task id.
  * @param maxSubtaskDepth - deployment subtask depth limit.
+ * @param hostTimeZone - zone a rule that stores no zone of its own follows.
  */
 export function applyCreateTask(
   tasks: readonly TaskRecord[],
@@ -39,6 +40,7 @@ export function applyCreateTask(
   now: number,
   id: string,
   maxSubtaskDepth: number = DEFAULT_SUBTASK_DEPTH,
+  hostTimeZone: string = resolveHostTimeZone(),
 ): CreateTaskResult {
   if (input.title.trim() === '') return { task: undefined, tasks, error: 'title is required' }
   const limit = normalizeSubtaskDepth(maxSubtaskDepth)
@@ -71,7 +73,17 @@ export function applyCreateTask(
   const requested = input.schedule
   if (requested?.enabled === true && requested.cron.trim() !== '' && isValidCron(requested.cron)) {
     const cron = requested.cron.trim()
-    task = withSchedule(task, { enabled: true, cron, nextRunAt: nextRunAtMs(cron, now) }, now)
+    const requestedZone = requested.timeZone
+    // An unusable zone is refused rather than silently reinterpreted as the
+    // Host zone: the caller asked for a specific wall clock.
+    if (requestedZone !== undefined && !isValidTimeZone(requestedZone)) {
+      return { task: undefined, tasks, error: 'invalid schedule time zone' }
+    }
+    const zone = requestedZone ?? hostTimeZone
+    const nextRunAt = nextRunAtMs(cron, now, zone)
+    if (nextRunAt !== undefined) {
+      task = withSchedule(task, { enabled: true, cron, timeZone: requestedZone, nextRunAt }, now)
+    }
   }
   return { task, tasks: [...tasks, task] }
 }

package/src/core/use-cases/task-parent.ts

@@ -49,8 +49,9 @@ export function applySetParent(
   if (task.archivedAt !== undefined) return { tasks, applied: false, error: 'archived task is read-only' }
   // A task with an open execution may be a participant of a running cascade.
   // Moving it would break that group's parent walk and leave the parent card
-  // in the running column forever, so the link is frozen until it settles.
-  if (task.status === 'running' || task.executions.some(execution => execution.endedAt === undefined)) {
+  // in the running column forever, so the link is frozen until it settles. The
+  // lock is the open execution: a card parked in 'running' by hand links freely.
+  if (task.executions.some(execution => execution.endedAt === undefined)) {
     return { tasks, applied: false, error: 'running task cannot be re-parented' }
   }
   const check = checkParentLink(tasks, id, parentId, normalizeSubtaskDepth(maxSubtaskDepth))

package/src/core/use-cases/task-schedule.ts

@@ -4,13 +4,15 @@
  * orchestrates those). Validation and next-run computation live here, sharing
  * the core cron parser (schedule.ts) and the withSchedule transition.
  */
-import { isValidCron, nextRunAtMs } from '../schedule.ts'
+import { isValidCron, isValidTimeZone, nextRunAtMs } from '../schedule.ts'
 import { withSchedule, type TaskRecord } from '../tasks.ts'
 
 /** Fields the schedule use case may change on a rule. */
 export interface SetSchedulePatch {
   enabled?: boolean
   cron?: string
+  /** IANA zone for the cron wall clock; `null` clears it back to the Host zone. */
+  timeZone?: string | null
 }
 
 /** Result of arming/disarming a rule. */
@@ -22,31 +24,40 @@ export interface SetScheduleResult {
 }
 
 /**
- * Set an on-board task's schedule rule. A blank or invalid cron, or an
- * archived task, is rejected (state untouched); an enabled rule computes the
- * next run instant immediately, a disabled one carries no next-run instant.
+ * Set an on-board task's schedule rule. A blank or invalid cron, an unknown or
+ * archived task, or an unusable zone is rejected (state untouched); an enabled
+ * rule computes the next run instant immediately in the rule's own zone, a
+ * disabled one carries no next-run instant.
  * @param tasks - current ledger.
  * @param id - the task to schedule.
  * @param patch - rule fields to change (absent fields keep their current value).
  * @param now - clock instant (ms epoch).
+ * @param hostTimeZone - zone a rule with no stored zone follows.
  */
 export function applySetSchedule(
   tasks: readonly TaskRecord[],
   id: string,
   patch: SetSchedulePatch,
   now: number,
+  hostTimeZone: string,
 ): SetScheduleResult {
   const task = tasks.find(candidate => candidate.id === id)
   if (task === undefined || task.archivedAt !== undefined) return { tasks, applied: false }
   const current = task.schedule
   const cron = (patch.cron ?? current?.cron ?? '').trim()
   if (cron === '' || !isValidCron(cron)) return { tasks, applied: false }
+  // An explicit null clears the stored zone; an absent key keeps it.
+  const requestedZone = patch.timeZone === undefined ? current?.timeZone : patch.timeZone ?? undefined
+  if (requestedZone !== undefined && !isValidTimeZone(requestedZone)) return { tasks, applied: false }
   const enabled = patch.enabled ?? current?.enabled ?? false
-  const nextRunAt = enabled ? nextRunAtMs(cron, now) : undefined
+  const effectiveZone = requestedZone ?? hostTimeZone
+  const nextRunAt = enabled ? nextRunAtMs(cron, now, effectiveZone) : undefined
   if (enabled && nextRunAt === undefined) return { tasks, applied: false }
   return {
     tasks: tasks.map(candidate =>
-      candidate.id === id ? withSchedule(candidate, { enabled, cron, nextRunAt }, now) : candidate),
+      candidate.id === id
+        ? withSchedule(candidate, { enabled, cron, timeZone: requestedZone ?? undefined, nextRunAt }, now)
+        : candidate),
     applied: true,
   }
 }

package/src/core/use-cases/task-tag.ts

@@ -0,0 +1,110 @@
+/**
+ * Label-management use cases (issue: labels could not be cleaned up).
+ *
+ * A label lives on every task that carries it, so renaming or removing one is a
+ * ledger-wide edit, not a task edit: the board's label row is the union of the
+ * labels in use, and without these two transitions a label created by an
+ * afternoon experiment stayed on the board forever.
+ *
+ * Both transitions are pure ledger rewrites (no persistence, no notify — the
+ * controller and the Host ledger orchestrate those), and both are idempotent:
+ * a label that no task carries changes nothing and reports no error for the
+ * delete path (the desired end state already holds), while a rename from an
+ * unknown label is refused so a stale tab cannot silently do nothing.
+ *
+ * Renaming onto a name that is already in use MERGES the two: a task carrying
+ * both keeps the row it already had (with its execution hint) and loses the
+ * duplicate, which is the only reading that cannot lose a hint the user typed.
+ */
+
+import { TAG_NAME_MAX_LENGTH, collectKnownTags, normalizeTags, type TaskRecord, type TaskTag } from '../tasks.ts'
+
+/** Outcome of one ledger-wide label edit. */
+export interface TagEditResult {
+  /** The ledger after the edit, or the input unchanged when nothing applied. */
+  tasks: readonly TaskRecord[]
+  /** Whether any task actually changed (drives whether the caller persists). */
+  changed: boolean
+  /** Refusal reason; the ledger is unchanged when set. */
+  error?: string
+}
+
+/** Trim a label name the way creation does. */
+function normalizeName(value: string): string {
+  return value.trim()
+}
+
+/** Whether any task in the ledger carries this label. */
+function carries(tasks: readonly TaskRecord[], name: string): boolean {
+  return collectKnownTags(tasks).some(tag => tag.name === name)
+}
+
+/**
+ * Rename one label everywhere, merging into an existing label of the target
+ * name. Every touched task gets a fresh updatedAt; untouched tasks keep theirs.
+ * @param tasks - current ledger.
+ * @param from - the label to rename.
+ * @param to - the new name (an existing name merges the two labels).
+ * @param now - clock instant (ms epoch).
+ * @returns the rewritten ledger, or a refusal.
+ */
+export function applyRenameTag(
+  tasks: readonly TaskRecord[],
+  from: string,
+  to: string,
+  now: number,
+): TagEditResult {
+  const source = normalizeName(from)
+  const target = normalizeName(to)
+  if (source === '') return { tasks, changed: false, error: 'a label name is required' }
+  if (target === '') return { tasks, changed: false, error: 'a label name is required' }
+  if (target.length > TAG_NAME_MAX_LENGTH) return { tasks, changed: false, error: 'label name is too long' }
+  if (source === target) return { tasks, changed: false }
+  if (!carries(tasks, source)) return { tasks, changed: false, error: 'label not found' }
+  let changed = false
+  const next = tasks.map(task => {
+    const tags = task.tags
+    if (tags === undefined || !tags.some(tag => tag.name === source)) return task
+    changed = true
+    // A task that already carried BOTH names keeps the target's own row — the
+    // target is the label that survives, so its execution hint stays the one
+    // that applies. A task carrying only the source keeps that row's hint under
+    // the new name.
+    const hasTarget = tags.some(tag => tag.name === target)
+    const merged: TaskTag[] = []
+    for (const tag of tags) {
+      if (hasTarget && tag.name === source) continue
+      const name = tag.name === source ? target : tag.name
+      if (merged.some(entry => entry.name === name)) continue
+      merged.push(name === tag.name ? tag : { ...tag, name })
+    }
+    return { ...task, tags: normalizeTags(merged), updatedAt: now }
+  })
+  return { tasks: changed ? next : tasks, changed }
+}
+
+/**
+ * Remove one label from every task that carries it. Archived cards are included:
+ * the board's label row draws from the whole ledger, so a label left on an
+ * archived card would come straight back into the filter.
+ * @param tasks - current ledger.
+ * @param name - the label to remove.
+ * @param now - clock instant (ms epoch).
+ * @returns the rewritten ledger.
+ */
+export function applyDeleteTag(
+  tasks: readonly TaskRecord[],
+  name: string,
+  now: number,
+): TagEditResult {
+  const target = normalizeName(name)
+  if (target === '') return { tasks, changed: false, error: 'a label name is required' }
+  let changed = false
+  const next = tasks.map(task => {
+    const tags = task.tags
+    if (tags === undefined || !tags.some(tag => tag.name === target)) return task
+    changed = true
+    return { ...task, tags: normalizeTags(tags.filter(tag => tag.name !== target)), updatedAt: now }
+  })
+  return { tasks: changed ? next : tasks, changed }
+}

package/src/core/use-cases/task-update.ts

@@ -16,7 +16,7 @@ import type { TaskHandoverInput } from '../handover.ts'
  * Editable fields on a task (the update patch surface). `freeze` replaces the
  * continuation-card snapshot (restamping frozenAt); an explicit null clears it.
  */
-export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission' | 'model' | 'reuseSession' | 'teamRun'>> & {
+export type TaskUpdatePatch = Partial<Pick<TaskRecord, 'title' | 'description' | 'prompt' | 'workspaceId' | 'mode' | 'permission' | 'model' | 'reuseSession' | 'teamRun' | 'goalRun' | 'skipVerification'>> & {
   freeze?: FreezeSnapshot & { redacted?: boolean } | null
   /** Replaces the handover bundle (restamping bundledAt); an explicit null clears it. */
   handover?: TaskHandoverInput | null
@@ -43,11 +43,13 @@ export function hasContentPatch(patch: TaskUpdatePatch): boolean {
 
 /**
  * Whether a task's content may still be edited: the task must be on-board
- * (not archived) and must never have started executing. Fail-closed: a
- * running, settled, or cancelled-before-launch task keeps its content fixed.
+ * (not archived) and must never have started executing. Fail-closed: a task
+ * with any execution record — running, settled, or cancelled before launch —
+ * keeps its content fixed. The run, not the column, is the trigger: a card
+ * parked in 'running' by hand has nothing recorded yet and stays editable.
  */
 export function canEditTaskContent(task: TaskRecord): boolean {
-  return task.archivedAt === undefined && task.status !== 'running' && task.executions.length === 0
+  return task.archivedAt === undefined && task.executions.length === 0
 }
 
 /** Keep an unknown permission string from entering the ledger. */
@@ -108,6 +110,13 @@ export function applyUpdateTask(
     if ('reuseSession' in patch) next.reuseSession = patch.reuseSession === true ? true : undefined
     // Team execution is a boolean opt-in with the same clear-by-false rule.
     if ('teamRun' in patch) next.teamRun = patch.teamRun === true ? true : undefined
+    // The /goal opt-in is default-ON: true (or an explicit null) returns the
+    // card to the default and stores nothing, only false pins a plain turn.
+    if ('goalRun' in patch) next.goalRun = patch.goalRun === false ? false : undefined
+    // The acceptance opt-out is the mirror image: default OFF, so only true
+    // pins a card out of the gate; false (or an explicit null) returns it to
+    // inheriting the board-wide switch and stores nothing.
+    if ('skipVerification' in patch) next.skipVerification = patch.skipVerification === true ? true : undefined
     if (workspaceId !== undefined || 'workspaceId' in patch) next.workspaceId = workspaceId
     if (mode !== undefined || 'mode' in patch) next.mode = mode
     if (permission !== undefined || 'permission' in patch) next.permission = permission