@linxin666/dsh-client-ui-task-board 0.4.3 → 0.4.5

package/src/host-service.ts

@@ -4,8 +4,13 @@ import { reusableSessionId } from './core/session-reuse.ts'
 import { HostTaskLedger, type OpenedRun, type OpenExecutionReference } from './host-ledger.ts'
 import { HostExecutionRunner, SessionLaunchError, promptText, type SessionCommandDispatcher, type SessionSummary, type TaskBoardWorkspaceRegistry } from './host-runner.ts'
 import { teammateName } from './core/subtask.ts'
+import { workspaceOwningSession } from './core/workspace-target.ts'
 import { PowerInhibitor } from './power-inhibitor.ts'
 import { TASK_BOARD_SCHEMA_VERSION, type TaskBoardAction, type TaskBoardEventPayload, type TaskBoardSnapshot } from './protocol.ts'
+import { TaskBoardExtensionRegistry } from './host/extension-registry.ts'
+import type { TaskBoardExtension } from './core/extension.ts'
+import type { ExecutionOutcome, TaskStatus } from './core/tasks.ts'
+import { passedAttempt, resolveContract, verificationRequired, type ExecutionVerification, type ModelCatalogView, type VerificationContract, type VerificationSettings } from './core/verification.ts'
 import type { TaskPermission } from './core/handover.ts'
 
 /** One teammate the Host asks the Agent Teams service to spawn for a team run. */
@@ -50,6 +55,26 @@ const SESSION_POLL_MS = 5_000
 const RECOVERY_TOLERANCE_MS = 60_000
 /** Largest delay a Node timer represents without clamping; longer targets re-arm in segments. */
 const MAX_TIMER_DELAY_MS = 2_147_483_647
+/**
+ * Consecutive polls that may report one execution's session history as
+ * unreadable before it is reported failed. The roster poll runs every 5 s, so
+ * this is two minutes of a session that is NOT running: no turn is executing
+ * there and its history cannot be read, which means no verdict will ever
+ * arrive. Reporting that as a failure keeps a card — and every ancestor of it —
+ * out of the running column, which nothing else can rescue.
+ */
+const UNREADABLE_SETTLE_POLLS = 24
+
+/**
+ * Provenance of one cron-triggered cascade: when the rule fired and the zone
+ * its wall clock was read in. Passed into every launched prompt of that run so
+ * a scheduled job knows its own clock rather than inferring one.
+ */
+export interface ScheduledRunContext {
+  triggeredAt: number
+  timeZone: string
+  cron: string
+}
 
 /**
  * Actions that can move an armed trigger. Only these re-arm the native timer;
@@ -102,11 +127,27 @@ export class TaskBoardHostService {
    * conversation instead of prompting into a session it cannot see.
    */
   private idleSessionIds: ReadonlySet<string> | undefined
+  /**
+   * Consecutive unreadable-history polls per open execution (see
+   * {@link noteUnreadableInspection}). Cleared as soon as an inspection
+   * resolves, so a transient reader failure never fails a card.
+   */
+  private readonly unreadablePolls = new Map<string, number>()
   private preventIdleSleep = false
+  private readonly verificationSettings: () => VerificationSettings
+  private readonly verificationCatalog: () => Promise<ModelCatalogView | undefined>
   private readonly team: TaskBoardTeamDispatcher | undefined
   private readonly timers: HostTimerFace
   private lastPowerJson = ''
   private readonly now: () => number
+  /** The deployment's workspaces, consulted to resolve a card that pins none. */
+  private readonly workspaceRegistry: TaskBoardWorkspaceRegistry | undefined
+  /**
+   * External provider extensions. The board owns task lifecycle and execution;
+   * a provider observes them through the registry's capability face and never
+   * reaches into the ledger itself.
+   */
+  readonly extensions: TaskBoardExtensionRegistry
 
   constructor(gateway: TypertGateway, options: {
     ledger?: HostTaskLedger
@@ -114,20 +155,42 @@ export class TaskBoardHostService {
     now?: () => number
     commandDispatcher?: SessionCommandDispatcher
     workspaceRegistry?: TaskBoardWorkspaceRegistry
-    sessionDefaultPermission?: TaskPermission
+    /**
+     * Permission baseline of the confirmation gate: a fixed value, or a live
+     * resolver the board re-reads so a Host Settings change needs no remount.
+     */
+    sessionDefaultPermission?: TaskPermission | (() => TaskPermission)
     maxSubtaskDepth?: number
     team?: TaskBoardTeamDispatcher
     timers?: HostTimerFace
+    /**
+     * Live acceptance settings (volatile config reads). Absent keeps goal
+     * acceptance OFF for every execution this service opens, which is what a
+     * programmatic mount without the settings domain gets.
+     */
+    verificationSettings?: () => VerificationSettings
+    /** The host model catalog the acceptance contract resolves its route from. */
+    verificationCatalog?: () => Promise<ModelCatalogView | undefined>
   } = {}) {
     this.ledger = options.ledger ?? new HostTaskLedger(undefined, undefined, {
       sessionDefaultPermission: options.sessionDefaultPermission,
       maxSubtaskDepth: options.maxSubtaskDepth,
     })
     this.runner = new HostExecutionRunner(gateway, options.commandDispatcher, options.workspaceRegistry)
+    this.workspaceRegistry = options.workspaceRegistry
     this.team = options.team
     this.timers = options.timers ?? PROCESS_TIMERS
     this.power = options.power ?? new PowerInhibitor()
     this.now = options.now ?? Date.now
+    this.verificationSettings = options.verificationSettings ?? (() => ({ enabled: false, model: '', reasoningEffort: '' }))
+    this.verificationCatalog = options.verificationCatalog ?? (async () => undefined)
+    this.extensions = new TaskBoardExtensionRegistry({
+      ledger: this.ledger,
+      // Capability writes go through the board's own action path, so every
+      // board gate (content freeze, running lock, permission gate) still holds.
+      apply: (action, initiator) => this.applyBoardAction(crypto.randomUUID(), action, initiator),
+      now: this.now,
+    })
     installStreamErrorGuards()
     this.ledger.subscribe(() => {
       this.syncPowerReasons()
@@ -169,6 +232,9 @@ export class TaskBoardHostService {
       })
     }
     this.power.setEnabled(active && preventIdleSleep)
+    // Providers follow the board's master switch: the registry stops their
+    // provider-side work and hides their seats without clearing any data.
+    this.extensions.setEnabled(active)
     if (resumed) {
       this.schedulePoll()
       this.recoverSchedule()
@@ -182,6 +248,7 @@ export class TaskBoardHostService {
 
   snapshot(): TaskBoardSnapshot {
     const state = this.ledger.state()
+    const published = this.extensions.published()
     return {
       schemaVersion: TASK_BOARD_SCHEMA_VERSION,
       revision: state.revision,
@@ -191,6 +258,38 @@ export class TaskBoardHostService {
       sessionDefaultPermission: this.ledger.sessionDefaultPermission,
       maxSubtaskDepth: this.ledger.maxSubtaskDepth,
       teamRunAvailable: this.team !== undefined,
+      ...(Object.keys(published).length === 0 ? {} : { extensions: published }),
+    }
+  }
+
+  /**
+   * Admit one external provider. Idempotent by extension id; the returned
+   * disposer releases it (its stored data stays).
+   */
+  registerExtension(extension: TaskBoardExtension): () => void {
+    return this.extensions.registerExtension(extension)
+  }
+
+  /**
+   * The acceptance configuration the settings card displays: the live settings,
+   * the contract they resolve to, and the host catalog the choices come from.
+   *
+   * The card shows the RESOLVED route, not the raw configuration, so "inherit
+   * host" reads as the concrete model and reasoning level the next execution
+   * will actually freeze, including any recorded effort fallback.
+   * @returns the resolved acceptance options.
+   */
+  async verificationOptions(): Promise<{
+    settings: VerificationSettings
+    contract: VerificationContract
+    catalog: ModelCatalogView
+  }> {
+    const settings = this.verificationSettings()
+    const catalog = await this.verificationCatalog()
+    return {
+      settings,
+      contract: resolveContract(settings, catalog),
+      catalog: catalog ?? { groups: [] },
     }
   }
 
@@ -205,8 +304,55 @@ export class TaskBoardHostService {
     return () => { this.listeners.delete(listener) }
   }
 
-  apply(requestId: string, action: TaskBoardAction, initiator?: string): TaskBoardSnapshot {
+  /**
+   * Give a root card created without a workspace pin the workspace its creator
+   * is in.
+   *
+   * An agent's `task_board_create` arrives with the calling session, and the
+   * GUI submits the session the main view shows, so the card lands where the
+   * work was asked for instead of where the Host process happens to run. A card
+   * that names a workspace keeps it, and a subtask keeps inheriting its lineage
+   * (the runner walks the ancestor chain for that).
+   *
+   * The initiator is client-asserted, so it only chooses among workspaces the
+   * deployment already knows: it can neither register one nor reach outside the
+   * list the user sees.
+   * @param action - the action about to be applied.
+   * @param initiator - the session that issued the action, when one was asserted.
+   * @returns the action, with an inherited workspace on a root creation.
+   */
+  private withInheritedWorkspace(action: TaskBoardAction, initiator?: string): TaskBoardAction {
+    if (action.kind !== 'create' || initiator === undefined || initiator === '') return action
+    const input = action.input
+    // A subtask inherits its lineage instead, and an explicit pin is the user's.
+    if ((input.parentId ?? '').trim() !== '') return action
+    if ((input.workspaceId ?? '').trim() !== '') return action
+    const workspaceId = workspaceOwningSession(this.workspaceRegistry?.list() ?? [], initiator)
+    if (workspaceId === undefined) return action
+    return { ...action, input: { ...input, workspaceId } }
+  }
+
+  apply(requestId: string, action: Extract<TaskBoardAction, { kind: 'extension-action' }>, initiator?: string): Promise<TaskBoardSnapshot>
+  apply(requestId: string, action: Exclude<TaskBoardAction, { kind: 'extension-action' }>, initiator?: string): TaskBoardSnapshot
+  apply(requestId: string, action: TaskBoardAction, initiator?: string): TaskBoardSnapshot | Promise<TaskBoardSnapshot>
+  apply(requestId: string, action: TaskBoardAction, initiator?: string): TaskBoardSnapshot | Promise<TaskBoardSnapshot> {
     if (!this.active) throw new Error('task board is disabled')
+    // Provider actions never touch the ledger directly: the registry routes the
+    // action to the owning extension, whose own capability calls come back
+    // through applyBoardAction and every board gate below.
+    if (action.kind === 'extension-action') {
+      return this.handleExtensionAction(action)
+    }
+    return this.applyBoardAction(requestId, action, initiator)
+  }
+
+  /**
+   * Apply one board-owned action with every gate intact. Provider capability
+   * calls and the same-origin wire both land here, so the two surfaces can
+   * never disagree about a card.
+   */
+  private applyBoardAction(requestId: string, action: Exclude<TaskBoardAction, { kind: 'extension-action' }>, initiator?: string): TaskBoardSnapshot {
+    const before = this.statusMap()
     // Fail closed before the ledger opens anything: a card opted into team
     // execution cannot run in a deployment that serves no Agent Teams service,
     // and silently degrading it to a plain cascade would misreport the work.
@@ -214,12 +360,14 @@ export class TaskBoardHostService {
       const task = this.ledger.state().tasks.find(item => item.id === action.taskId)
       if (task?.teamRun === true) throw new Error('Agent Teams is unavailable in this deployment')
     }
-    const result = this.ledger.applyRequest(requestId, action, initiator)
+    const result = this.ledger.applyRequest(requestId, this.withInheritedWorkspace(action, initiator), initiator)
     if (result.runs !== undefined) this.dispatchRuns(result.runs)
     // A committed schedule write (create / update / toggle / delete) moves the
     // nearest trigger; re-arm on every action so a newly enabled schedule fires
     // at its own instant without waiting for the previous target to elapse.
     if (SCHEDULE_WRITE_ACTIONS.has(action.kind)) this.refreshSchedule()
+    this.emitStatusChanges(before, initiator)
+    if (action.kind === 'delete') this.extensions.emitTaskDeleted({ taskId: action.taskId })
     return {
       schemaVersion: TASK_BOARD_SCHEMA_VERSION,
       revision: result.state.revision,
@@ -229,8 +377,39 @@ export class TaskBoardHostService {
     }
   }
 
+  /** Route one provider action and answer the resulting board snapshot. */
+  private async handleExtensionAction(action: Extract<TaskBoardAction, { kind: 'extension-action' }>): Promise<TaskBoardSnapshot> {
+    await this.extensions.handleAction({
+      extensionId: action.extensionId,
+      action: action.action,
+      ...(action.taskId === undefined ? {} : { taskId: action.taskId }),
+      ...(action.payload === undefined ? {} : { payload: action.payload }),
+    })
+    return this.snapshot()
+  }
+
+  /** Current task id -> status map, for change detection around a mutation. */
+  private statusMap(): Map<string, TaskStatus> {
+    return new Map(this.ledger.allTasks().map(task => [task.id, task.status]))
+  }
+
+  /** Emit a status change for every task whose column moved, isolated per callback. */
+  private emitStatusChanges(before: Map<string, TaskStatus>, initiator?: string): void {
+    for (const task of this.ledger.allTasks()) {
+      const previous = before.get(task.id)
+      if (previous === undefined || previous === task.status) continue
+      this.extensions.emitStatusChanged({
+        taskId: task.id,
+        status: task.status,
+        previous,
+        ...(initiator === undefined || initiator === '' ? {} : { initiator }),
+      })
+    }
+  }
+
   dispose(): void {
     this.disposed = true
+    this.extensions.dispose()
     this.clearScheduleTimer()
     this.pollTimer?.()
     this.pollTimer = undefined
@@ -239,7 +418,7 @@ export class TaskBoardHostService {
     this.listeners.clear()
   }
 
-  private async launch(opened: OpenedRun, others: readonly OpenedRun[] = []): Promise<void> {
+  private async launch(opened: OpenedRun, others: readonly OpenedRun[] = [], schedule?: ScheduledRunContext): Promise<void> {
     try {
       // A team run always mints a fresh Lead session: teammates are immutable
       // children of that session, so reusing an older one would collide on
@@ -248,25 +427,60 @@ export class TaskBoardHostService {
       const reuseSessionId = team ? undefined : reusableSessionId(opened.task, this.idleSessionIds)
       // Both modes tell the launched agent what else this run opens; only a team
       // run names teammates, because only then does this session own them.
-      const promptContext = others.length === 0 ? undefined : {
-        peers: others.map(other => ({
-          id: other.task.id,
-          title: other.task.title,
-          ...(team ? { name: teammateName(other.task.title, other.execution.runGroupId ?? other.task.id) } : {}),
-        })),
+      const peers = others.length === 0 ? undefined : others.map(other => ({
+        id: other.task.id,
+        title: other.task.title,
+        ...(team ? { name: teammateName(other.task.title, other.execution.runGroupId ?? other.task.id, other.task.id) } : {}),
+      }))
+      // A cron-triggered run additionally states its own firing instant and
+      // rule zone, so a scheduled job can resolve "today" without guessing.
+      const promptContext = peers === undefined && schedule === undefined ? undefined : {
+        ...(peers === undefined ? {} : { peers }),
         ...(team ? { team: true } : {}),
+        ...(schedule === undefined ? {} : { schedule }),
       }
+      // Freeze this execution's acceptance contract BEFORE the session is
+      // prompted: a settings change made while the run is in flight must not
+      // retrofit the rule that will judge it. A card that opted out resolves the
+      // same contract from an OFF switch: the board-wide switch decides the
+      // default, the card decides this execution, and both are read here.
+      const settings = this.verificationSettings()
+      // The card's opt-out is a DISTINCT reason, not the board switch: the
+      // report must be able to say which of the two turned the gate off.
+      const skippedBy: ExecutionVerification['applicability'] = opened.task.skipVerification === true ? 'skipped' : 'disabled'
+      const contract = resolveContract(
+        { ...settings, enabled: settings.enabled && opened.task.skipVerification !== true },
+        await this.verificationCatalog(),
+      )
+      const initial: ExecutionVerification = {
+        contract,
+        attempts: [],
+        applicability: team ? 'team-member' : !contract.enabled ? skippedBy : 'goal-unavailable',
+      }
+      this.ledger.setVerification(opened.task.id, opened.execution.id, initial)
+      let attached: string | undefined
       const sessionId = await this.runner.launch(opened.task, {
         ...(reuseSessionId === undefined ? {} : { reuseSessionId }),
         ...(promptContext === undefined ? {} : { promptContext }),
+        // Bind the session to the execution before the prompt is queued, so the
+        // completion gate can never observe the agent without its binding.
+        onSession: (id) => {
+          attached = id
+          this.ledger.attachSession(opened.task.id, opened.execution.id, id)
+        },
+        onGoalArmed: (armed) => {
+          this.setApplicability(opened.task.id, opened.execution.id, team
+            ? 'team-member'
+            : !contract.enabled ? skippedBy : armed ? 'enforced' : 'goal-unavailable')
+        },
       })
-      this.ledger.attachSession(opened.task.id, opened.execution.id, sessionId)
+      if (attached === undefined) this.ledger.attachSession(opened.task.id, opened.execution.id, sessionId)
       if (team) for (const teammate of others) this.scheduleTeammate(teammate, sessionId)
     } catch (error) {
       if (error instanceof SessionLaunchError) {
         this.ledger.attachSession(opened.task.id, opened.execution.id, error.sessionId)
       }
-      this.ledger.settle(opened.task.id, opened.execution.id, 'failed', error instanceof Error ? error.message : String(error))
+      this.settleAndNotify(opened.task.id, opened.execution.id, 'failed', error instanceof Error ? error.message : String(error))
     }
   }
 
@@ -286,23 +500,23 @@ export class TaskBoardHostService {
   private async spawnTeammate(opened: OpenedRun, leadSessionId: string): Promise<void> {
     const team = this.team
     if (team === undefined) {
-      this.ledger.settle(opened.task.id, opened.execution.id, 'failed', 'Agent Teams is unavailable in this deployment')
+      this.settleAndNotify(opened.task.id, opened.execution.id, 'failed', 'Agent Teams is unavailable in this deployment')
       return
     }
     try {
       const member = await team.spawn({
         leadSessionId,
-        name: teammateName(opened.task.title, opened.execution.runGroupId ?? opened.task.id),
+        name: teammateName(opened.task.title, opened.execution.runGroupId ?? opened.task.id, opened.task.id),
         description: opened.task.title,
         prompt: promptText(opened.task),
       })
       if (member.sessionId === undefined || member.sessionId === '') {
-        this.ledger.settle(opened.task.id, opened.execution.id, 'failed', member.error ?? 'teammate provisioning failed')
+        this.settleAndNotify(opened.task.id, opened.execution.id, 'failed', member.error ?? 'teammate provisioning failed')
         return
       }
       this.ledger.attachSession(opened.task.id, opened.execution.id, member.sessionId)
     } catch (error) {
-      this.ledger.settle(opened.task.id, opened.execution.id, 'failed', error instanceof Error ? error.message : String(error))
+      this.settleAndNotify(opened.task.id, opened.execution.id, 'failed', error instanceof Error ? error.message : String(error))
     }
   }
 
@@ -321,6 +535,12 @@ export class TaskBoardHostService {
       return
     }
     this.idleSessionIds = new Set(running.items.filter(item => !item.running).map(item => item.sessionId))
+    // Fold whatever the board can already decide before spending inspection
+    // RPCs: a team run whose Lead recorded its verdict, and any lineage whose
+    // members are all settled. Idempotent, so an already folded board is free.
+    const foldedBefore = this.statusMap()
+    this.ledger.finalizeReadyRuns()
+    this.emitStatusChanges(foldedBefore)
     // Read after the RPC so executions attached while it was in flight are
     // included in this pass, matching the former full-state snapshot timing.
     const runtime = this.ledger.runtimeView()
@@ -341,14 +561,99 @@ export class TaskBoardHostService {
   ): Promise<void> {
     for (const execution of executions) {
       if (execution.sessionId === undefined) continue
+      const record = this.ledger.getTask(execution.taskId)?.executions.find(entry => entry.id === execution.executionId)
+      const verification = record?.verification
+      // A cycle the gate already closed is decided here, without another
+      // inspection: the goal may still be active (or un-blockable) exactly
+      // because the acceptance failed, and the card must not stay in the
+      // running column waiting for a verdict that is already recorded.
+      if (verification?.failedReason !== undefined) {
+        this.settleAndNotify(execution.taskId, execution.executionId, 'failed', verification.failedReason)
+        continue
+      }
       try {
-        const result = await this.runner.inspect(execution.sessionId, execution.startedAt, sessions)
-        if (result.outcome === 'pending') continue
-        this.ledger.settle(execution.taskId, execution.executionId, result.outcome, 'error' in result ? result.error : undefined)
+        // A team member's turn is read even while the roster calls its session
+        // running: a durable teammate never goes idle for good.
+        const result = await this.runner.inspect(execution.sessionId, execution.startedAt, sessions, {
+          whileRunning: execution.teamMember,
+        })
+        if (result.outcome === 'pending') {
+          if (result.unreadable === true) this.noteUnreadableInspection(execution, result.reason)
+          else this.unreadablePolls.delete(execution.executionId)
+          continue
+        }
+        this.unreadablePolls.delete(execution.executionId)
+        // Forced acceptance: the old fallback paths — a completed turn, a
+        // paused goal, an unreadable projection, a manual settle — must never
+        // be mistaken for a verified success. Only a matching pass record
+        // settles this execution as succeeded.
+        if (result.outcome === 'succeeded' && verificationRequired(verification) && passedAttempt(verification) === undefined) {
+          this.settleAndNotify(
+            execution.taskId,
+            execution.executionId,
+            'failed',
+            'goal 验收：本次执行没有匹配的验收通过记录（验收未运行、未通过或报告来自其他执行），按未验收判失败。',
+          )
+          continue
+        }
+        this.settleAndNotify(execution.taskId, execution.executionId, result.outcome, 'error' in result ? result.error : undefined)
       } catch {
         // A transient inspection failure never settles a running execution.
       }
     }
+    const open = new Set(executions.map(execution => execution.executionId))
+    for (const executionId of [...this.unreadablePolls.keys()]) {
+      if (!open.has(executionId)) this.unreadablePolls.delete(executionId)
+    }
+  }
+
+  /**
+   * Count one poll whose session history could not be read. A reader failure is
+   * not progress: the session is not running (the runner only reads history for
+   * one that is idle), so nothing will ever change that verdict. After
+   * {@link UNREADABLE_SETTLE_POLLS} consecutive polls the execution is reported
+   * failed with the recorded reason, instead of holding its card — and every
+   * ancestor of it — in the running column with no way out. The first poll of
+   * each streak is logged, so the Host log names the session.
+   */
+  private settleAndNotify(taskId: string, executionId: string, outcome: ExecutionOutcome, error?: string): void {
+    const before = this.ledger.getTask(taskId)
+    if (before?.executions.find(entry => entry.id === executionId)?.endedAt !== undefined) {
+      // Already settled: the ledger would no-op, and re-emitting would report
+      // the same settlement twice.
+      this.ledger.settle(taskId, executionId, outcome, error)
+      return
+    }
+    const previousStatus = before?.status
+    this.ledger.settle(taskId, executionId, outcome, error)
+    const task = this.ledger.getTask(taskId)
+    if (task !== undefined && previousStatus !== undefined && previousStatus !== task.status) {
+      this.extensions.emitStatusChanged({ taskId, status: task.status, previous: previousStatus })
+    }
+    this.extensions.emitExecutionSettled({
+      taskId,
+      executionId,
+      outcome,
+      ...(error === undefined ? {} : { error }),
+    })
+  }
+
+  private noteUnreadableInspection(execution: OpenExecutionReference, reason: string | undefined): void {
+    const polls = (this.unreadablePolls.get(execution.executionId) ?? 0) + 1
+    this.unreadablePolls.set(execution.executionId, polls)
+    const detail = reason ?? 'no reason reported'
+    if (polls === 1) {
+      safeConsoleError('[dsh-task-board] execution session ' + (execution.sessionId ?? 'unknown')
+        + ' history is unreadable; it stays pending for up to ' + UNREADABLE_SETTLE_POLLS + ' polls: ' + detail)
+    }
+    if (polls < UNREADABLE_SETTLE_POLLS) return
+    this.unreadablePolls.delete(execution.executionId)
+    this.settleAndNotify(
+      execution.taskId,
+      execution.executionId,
+      'failed',
+      'execution session history is unreadable (' + UNREADABLE_SETTLE_POLLS + ' consecutive polls); the outcome cannot be determined: ' + detail,
+    )
   }
 
   /** Drop the armed schedule timer and forget its target. */
@@ -410,10 +715,15 @@ export class TaskBoardHostService {
       this.recoverSchedule()
       return
     }
+    const before = this.statusMap()
     for (const schedule of this.ledger.dueSchedules(now)) {
-      const next = nextRunAtMs(schedule.cron, schedule.nextRunAt)
-      this.dispatchRuns(this.ledger.openScheduled(schedule.taskId, next, now))
+      const next = nextRunAtMs(schedule.cron, schedule.nextRunAt, schedule.timeZone)
+      this.dispatchRuns(
+        this.ledger.openScheduled(schedule.taskId, next, now),
+        { triggeredAt: now, timeZone: schedule.timeZone, cron: schedule.cron },
+      )
     }
+    this.emitStatusChanges(before)
     // The launched run (or the rolled-forward target) moved every due schedule,
     // so the next nearest target has to be recomputed from the ledger.
     this.armSchedule()
@@ -430,18 +740,28 @@ export class TaskBoardHostService {
    * others back. A team run's members are spawned inside the root's Lead
    * session instead, once that session exists.
    */
-  private dispatchRuns(runs: readonly OpenedRun[]): void {
+  private dispatchRuns(runs: readonly OpenedRun[], schedule?: ScheduledRunContext): void {
     if (runs.length === 0) return
     const root = runs.find(run => run.dispatch !== 'teammate') ?? runs[0]
     const others = runs.filter(run => run !== root)
-    this.scheduleLaunch(root, others)
+    this.scheduleLaunch(root, others, schedule)
     for (const run of others) {
-      if (run.dispatch !== 'teammate') this.scheduleLaunch(run)
+      if (run.dispatch !== 'teammate') this.scheduleLaunch(run, [], schedule)
     }
   }
 
-  private scheduleLaunch(opened: OpenedRun, others: readonly OpenedRun[] = []): void {
-    void this.launch(opened, others).catch(error => {
+  /**
+   * Move one execution's applicability without touching its frozen contract or
+   * its recorded attempts (used when the run's goal form becomes known).
+   */
+  private setApplicability(taskId: string, executionId: string, applicability: ExecutionVerification['applicability']): void {
+    const verification = this.ledger.getTask(taskId)?.executions.find(entry => entry.id === executionId)?.verification
+    if (verification === undefined || verification.applicability === applicability) return
+    this.ledger.setVerification(taskId, executionId, { ...verification, applicability })
+  }
+
+  private scheduleLaunch(opened: OpenedRun, others: readonly OpenedRun[] = [], schedule?: ScheduledRunContext): void {
+    void this.launch(opened, others, schedule).catch(error => {
       safeConsoleError('[dsh-task-board] execution launch settlement failed', error)
     })
   }