@linxin666/dsh-client-ui-task-board 0.4.4 → 0.4.6

package/src/host-service.ts

@@ -1,11 +1,16 @@
 import type { TypertGateway } from '@deepseek-ai/dsh-api-gateway'
-import { nextRunAtMs } from './core/schedule.ts'
+import { DEFAULT_SESSION_POLL_SECONDS, normalizeSessionPollSeconds, sessionPollMs } from './core/poll-cadence.ts'
 import { reusableSessionId } from './core/session-reuse.ts'
 import { HostTaskLedger, type OpenedRun, type OpenExecutionReference } from './host-ledger.ts'
 import { HostExecutionRunner, SessionLaunchError, promptText, type SessionCommandDispatcher, type SessionSummary, type TaskBoardWorkspaceRegistry } from './host-runner.ts'
 import { teammateName } from './core/subtask.ts'
+import { workspaceOwningSession } from './core/workspace-target.ts'
 import { PowerInhibitor } from './power-inhibitor.ts'
 import { TASK_BOARD_SCHEMA_VERSION, type TaskBoardAction, type TaskBoardEventPayload, type TaskBoardSnapshot } from './protocol.ts'
+import { TaskBoardExtensionRegistry } from './host/extension-registry.ts'
+import type { TaskBoardExtension } from './core/extension.ts'
+import type { ExecutionOutcome, ScheduleMode, TaskRecord, TaskStatus } from './core/tasks.ts'
+import { passedAttempt, resolveContract, verificationNeverInvoked, verificationOnlyInvalid, verificationRequired, withAcceptanceDetailCleared, type ExecutionVerification, type ModelCatalogView, type VerificationContract, type VerificationSettings } from './core/verification.ts'
 import type { TaskPermission } from './core/handover.ts'
 
 /** One teammate the Host asks the Agent Teams service to spawn for a team run. */
@@ -38,8 +43,8 @@ export interface TaskBoardTeamDispatcher {
   spawn(input: TeamSpawnInput): Promise<TeamSpawnResult>
 }
 
-/** Session-roster poll cadence — the one recurring Host timer this service still holds. */
-const SESSION_POLL_MS = 5_000
+/** Ceiling for the roster-poll failure backoff: a broken session tree is retried at most once a minute. */
+const POLL_FAILURE_MAX_BACKOFF_MS = 60_000
 /**
  * How late an armed schedule fire may be before it counts as a resume rather
  * than a normal occurrence. The schedule timer is armed AT the next due
@@ -60,6 +65,31 @@ const MAX_TIMER_DELAY_MS = 2_147_483_647
  */
 const UNREADABLE_SETTLE_POLLS = 24
 
+/**
+ * Why an enforced goal execution settled failed while its acceptance DID run:
+ * attempts were recorded and none of them passed. The judge answered about the
+ * work and the work did not pass.
+ */
+export const NO_MATCHING_PASS_VERIFICATION_REASON = 'goal 验收：本次执行没有匹配的验收通过记录（验收未运行、未通过或报告来自其他执行），按未验收判失败。'
+/**
+ * Why an enforced goal execution settled failed with ZERO acceptance records:
+ * the gate was never opened, so the judge never ran and nothing was ever judged
+ * (issue #1837). The root cause is a session that declared completion in prose
+ * instead of calling `update_goal(action: complete)` — a tool-adherence problem,
+ * NOT a quality verdict on the delivery — so this reason says so and keeps the
+ * two investigation directions apart.
+ */
+export const NEVER_INVOKED_VERIFICATION_REASON = 'goal 验收未触发：本次执行没有任何验收记录，验收门从未打开——执行会话没有调用 update_goal(action: complete) 来完成目标（常见于只在回复里宣告完成）。这不是质量判负：交付从未被裁判评估。'
+/**
+ * Why an enforced goal execution settled failed while its ONLY acceptance
+ * records are INVALID: the judge answered but could not locate its own
+ * rejection, so the board stopped calling it. This is NOT an evidence-backed
+ * quality veto — the requirement is explicit that such a run must not be
+ * described as one — but the execution still has no matching pass, so it ends
+ * for lack of one, and the reason names that precisely.
+ */
+export const INVALID_ONLY_VERIFICATION_REASON = 'goal 验收无效：本次执行只记录了无效验收（裁判未能给出与任务要求对应、且可定位到本次证据的否决依据），看板已停止调用裁判。这**不是**有证据的质量判负：验收本身不可用，本次运行因没有匹配的通过记录而结束。请检查验收环境与证据可见性，或用 task_board_manage(action=reset-verification) 清除记录的无效验收后重新完成目标。'
+
 /**
  * Provenance of one cron-triggered cascade: when the rule fired and the zone
  * its wall clock was read in. Passed into every launched prompt of that run so
@@ -68,7 +98,10 @@ const UNREADABLE_SETTLE_POLLS = 24
 export interface ScheduledRunContext {
   triggeredAt: number
   timeZone: string
-  cron: string
+  /** Whether this fire came from a recurring rule or a single planned instant. */
+  mode: ScheduleMode
+  /** Cron expression of a recurring rule; absent on a one-shot. */
+  cron?: string
 }
 
 /**
@@ -108,6 +141,12 @@ export class TaskBoardHostService {
   private readonly listeners = new Set<() => void>()
   /** The one recurring timer: the session-roster poll. */
   private pollTimer: (() => void) | undefined
+  /** Cadence of the roster poll, in seconds (a settings field; see the config schema). */
+  private sessionPollSeconds = DEFAULT_SESSION_POLL_SECONDS
+  /** Pending delay that follows a failed poll pass, if one is armed. */
+  private pollBackoffTimer: (() => void) | undefined
+  /** Consecutive failed poll passes; doubles the next retry delay. */
+  private consecutivePollFailures = 0
   /** The armed schedule timer, if a trigger is pending. */
   private scheduleTimer: (() => void) | undefined
   /** The instant the armed schedule timer targets (ms epoch), for resume detection. */
@@ -115,13 +154,6 @@ export class TaskBoardHostService {
   private disposed = false
   private pollInFlight = false
   private active = true
-  /**
-   * Ids the last roster poll saw as present and idle; undefined while the
-   * roster is unknown. Session reuse (issue #1419) requires this positive
-   * evidence, so a launch before the first successful poll mints a fresh
-   * conversation instead of prompting into a session it cannot see.
-   */
-  private idleSessionIds: ReadonlySet<string> | undefined
   /**
    * Consecutive unreadable-history polls per open execution (see
    * {@link noteUnreadableInspection}). Cleared as soon as an inspection
@@ -129,10 +161,22 @@ export class TaskBoardHostService {
    */
   private readonly unreadablePolls = new Map<string, number>()
   private preventIdleSleep = false
+  private readonly verificationSettings: () => VerificationSettings
+  private readonly verificationCatalog: () => Promise<ModelCatalogView | undefined>
   private readonly team: TaskBoardTeamDispatcher | undefined
   private readonly timers: HostTimerFace
+  /** Live reader of the global native-/goal switch; frozen per execution. */
+  private readonly goalRunEnabled: () => boolean
   private lastPowerJson = ''
   private readonly now: () => number
+  /** The deployment's workspaces, consulted to resolve a card that pins none. */
+  private readonly workspaceRegistry: TaskBoardWorkspaceRegistry | undefined
+  /**
+   * External provider extensions. The board owns task lifecycle and execution;
+   * a provider observes them through the registry's capability face and never
+   * reaches into the ledger itself.
+   */
+  readonly extensions: TaskBoardExtensionRegistry
 
   constructor(gateway: TypertGateway, options: {
     ledger?: HostTaskLedger
@@ -140,20 +184,51 @@ export class TaskBoardHostService {
     now?: () => number
     commandDispatcher?: SessionCommandDispatcher
     workspaceRegistry?: TaskBoardWorkspaceRegistry
-    sessionDefaultPermission?: TaskPermission
+    /**
+     * Permission baseline of the confirmation gate: a fixed value, or a live
+     * resolver the board re-reads so a Host Settings change needs no remount.
+     */
+    sessionDefaultPermission?: TaskPermission | (() => TaskPermission)
     maxSubtaskDepth?: number
     team?: TaskBoardTeamDispatcher
     timers?: HostTimerFace
+    /**
+     * Live GLOBAL native /goal switch (a volatile config read). Read ONCE per
+     * execution, at launch, and carried by value from then on: a settings edit
+     * made while a run is in flight must not arm, disarm or otherwise change the
+     * goal/acceptance contract of that run. Absent means OFF, which is the
+     * default for every deployment that never configured it.
+     */
+    goalRunEnabled?: () => boolean
+    /**
+     * Live acceptance settings (volatile config reads). Absent keeps goal
+     * acceptance OFF for every execution this service opens, which is what a
+     * programmatic mount without the settings domain gets.
+     */
+    verificationSettings?: () => VerificationSettings
+    /** The host model catalog the acceptance contract resolves its route from. */
+    verificationCatalog?: () => Promise<ModelCatalogView | undefined>
   } = {}) {
     this.ledger = options.ledger ?? new HostTaskLedger(undefined, undefined, {
       sessionDefaultPermission: options.sessionDefaultPermission,
       maxSubtaskDepth: options.maxSubtaskDepth,
     })
     this.runner = new HostExecutionRunner(gateway, options.commandDispatcher, options.workspaceRegistry)
+    this.workspaceRegistry = options.workspaceRegistry
     this.team = options.team
     this.timers = options.timers ?? PROCESS_TIMERS
     this.power = options.power ?? new PowerInhibitor()
     this.now = options.now ?? Date.now
+    this.goalRunEnabled = options.goalRunEnabled ?? (() => false)
+    this.verificationSettings = options.verificationSettings ?? (() => ({ enabled: false, model: '', reasoningEffort: '' }))
+    this.verificationCatalog = options.verificationCatalog ?? (async () => undefined)
+    this.extensions = new TaskBoardExtensionRegistry({
+      ledger: this.ledger,
+      // Capability writes go through the board's own action path, so every
+      // board gate (content freeze, running lock, permission gate) still holds.
+      apply: (action, initiator) => this.applyBoardAction(crypto.randomUUID(), action, initiator),
+      now: this.now,
+    })
     installStreamErrorGuards()
     this.ledger.subscribe(() => {
       this.syncPowerReasons()
@@ -173,8 +248,11 @@ export class TaskBoardHostService {
   start(): void {
     if (this.disposed || this.pollTimer !== undefined) return
     this.syncPowerReasons()
-    this.pollTimer = this.timers.interval(() => { this.schedulePoll() }, SESSION_POLL_MS)
+    this.pollTimer = this.timers.interval(() => { this.schedulePoll() }, sessionPollMs(this.sessionPollSeconds))
     this.schedulePoll()
+    // Boot is also the cleanup catch-up point: an execution that passed before
+    // the Host stopped may still hold its detail (a crash, a failed write).
+    this.cleanupPendingAcceptanceDetail()
     // Boot is a recovery point: an occurrence armed while the Host was down is
     // not replayed, and each schedule rolls to its next future target. A
     // schedule the Board should have served while running is then armed
@@ -182,10 +260,30 @@ export class TaskBoardHostService {
     this.recoverSchedule()
   }
 
-  setConfiguration(active: boolean, preventIdleSleep: boolean): void {
+  /**
+   * Apply the live configuration. The roster cadence is re-read on every
+   * commit, so a settings edit takes effect without a restart; the poll is
+   * scheduled at the new cadence immediately rather than waiting out the old
+   * interval.
+   * @param active - the board's master switch.
+   * @param preventIdleSleep - whether the board holds an idle-sleep assertion.
+   * @param sessionPollSeconds - roster-poll cadence in seconds (clamped).
+   */
+  setConfiguration(active: boolean, preventIdleSleep: boolean, sessionPollSeconds?: number): void {
     const resumed = !this.active && active
     this.active = active
     this.preventIdleSleep = preventIdleSleep
+    const cadence = normalizeSessionPollSeconds(sessionPollSeconds)
+    const retimed = this.pollTimer !== undefined && cadence !== this.sessionPollSeconds
+    this.sessionPollSeconds = cadence
+    if (retimed) {
+      // The recurring timer was armed at the old cadence: replace it and take
+      // the next pass now, so the new interval starts from this commit.
+      this.pollTimer?.()
+      this.pollTimer = this.timers.interval(() => { this.schedulePoll() }, sessionPollMs(this.sessionPollSeconds))
+      this.clearPollBackoff()
+      this.schedulePoll()
+    }
     if (resumed) {
       const current = this.power.snapshot()
       this.power.updateReasons({
@@ -195,6 +293,9 @@ export class TaskBoardHostService {
       })
     }
     this.power.setEnabled(active && preventIdleSleep)
+    // Providers follow the board's master switch: the registry stops their
+    // provider-side work and hides their seats without clearing any data.
+    this.extensions.setEnabled(active)
     if (resumed) {
       this.schedulePoll()
       this.recoverSchedule()
@@ -208,6 +309,7 @@ export class TaskBoardHostService {
 
   snapshot(): TaskBoardSnapshot {
     const state = this.ledger.state()
+    const published = this.extensions.published()
     return {
       schemaVersion: TASK_BOARD_SCHEMA_VERSION,
       revision: state.revision,
@@ -217,6 +319,42 @@ export class TaskBoardHostService {
       sessionDefaultPermission: this.ledger.sessionDefaultPermission,
       maxSubtaskDepth: this.ledger.maxSubtaskDepth,
       teamRunAvailable: this.team !== undefined,
+      // The GLOBAL native-/goal switch is published live for the UI, but the
+      // service freezes its own read at launch: this mirror is for the FORM
+      // (enable/disable + explanation), never for a run already in flight.
+      goalRunEnabled: this.goalRunEnabled(),
+      ...(Object.keys(published).length === 0 ? {} : { extensions: published }),
+    }
+  }
+
+  /**
+   * Admit one external provider. Idempotent by extension id; the returned
+   * disposer releases it (its stored data stays).
+   */
+  registerExtension(extension: TaskBoardExtension): () => void {
+    return this.extensions.registerExtension(extension)
+  }
+
+  /**
+   * The acceptance configuration the settings card displays: the live settings,
+   * the contract they resolve to, and the host catalog the choices come from.
+   *
+   * The card shows the RESOLVED route, not the raw configuration, so "inherit
+   * host" reads as the concrete model and reasoning level the next execution
+   * will actually freeze, including any recorded effort fallback.
+   * @returns the resolved acceptance options.
+   */
+  async verificationOptions(): Promise<{
+    settings: VerificationSettings
+    contract: VerificationContract
+    catalog: ModelCatalogView
+  }> {
+    const settings = this.verificationSettings()
+    const catalog = await this.verificationCatalog()
+    return {
+      settings,
+      contract: resolveContract(settings, catalog),
+      catalog: catalog ?? { groups: [] },
     }
   }
 
@@ -231,8 +369,55 @@ export class TaskBoardHostService {
     return () => { this.listeners.delete(listener) }
   }
 
-  apply(requestId: string, action: TaskBoardAction, initiator?: string): TaskBoardSnapshot {
+  /**
+   * Give a root card created without a workspace pin the workspace its creator
+   * is in.
+   *
+   * An agent's `task_board_create` arrives with the calling session, and the
+   * GUI submits the session the main view shows, so the card lands where the
+   * work was asked for instead of where the Host process happens to run. A card
+   * that names a workspace keeps it, and a subtask keeps inheriting its lineage
+   * (the runner walks the ancestor chain for that).
+   *
+   * The initiator is client-asserted, so it only chooses among workspaces the
+   * deployment already knows: it can neither register one nor reach outside the
+   * list the user sees.
+   * @param action - the action about to be applied.
+   * @param initiator - the session that issued the action, when one was asserted.
+   * @returns the action, with an inherited workspace on a root creation.
+   */
+  private withInheritedWorkspace(action: TaskBoardAction, initiator?: string): TaskBoardAction {
+    if (action.kind !== 'create' || initiator === undefined || initiator === '') return action
+    const input = action.input
+    // A subtask inherits its lineage instead, and an explicit pin is the user's.
+    if ((input.parentId ?? '').trim() !== '') return action
+    if ((input.workspaceId ?? '').trim() !== '') return action
+    const workspaceId = workspaceOwningSession(this.workspaceRegistry?.list() ?? [], initiator)
+    if (workspaceId === undefined) return action
+    return { ...action, input: { ...input, workspaceId } }
+  }
+
+  apply(requestId: string, action: Extract<TaskBoardAction, { kind: 'extension-action' }>, initiator?: string): Promise<TaskBoardSnapshot>
+  apply(requestId: string, action: Exclude<TaskBoardAction, { kind: 'extension-action' }>, initiator?: string): TaskBoardSnapshot
+  apply(requestId: string, action: TaskBoardAction, initiator?: string): TaskBoardSnapshot | Promise<TaskBoardSnapshot>
+  apply(requestId: string, action: TaskBoardAction, initiator?: string): TaskBoardSnapshot | Promise<TaskBoardSnapshot> {
     if (!this.active) throw new Error('task board is disabled')
+    // Provider actions never touch the ledger directly: the registry routes the
+    // action to the owning extension, whose own capability calls come back
+    // through applyBoardAction and every board gate below.
+    if (action.kind === 'extension-action') {
+      return this.handleExtensionAction(action)
+    }
+    return this.applyBoardAction(requestId, action, initiator)
+  }
+
+  /**
+   * Apply one board-owned action with every gate intact. Provider capability
+   * calls and the same-origin wire both land here, so the two surfaces can
+   * never disagree about a card.
+   */
+  private applyBoardAction(requestId: string, action: Exclude<TaskBoardAction, { kind: 'extension-action' }>, initiator?: string): TaskBoardSnapshot {
+    const before = this.statusMap()
     // Fail closed before the ledger opens anything: a card opted into team
     // execution cannot run in a deployment that serves no Agent Teams service,
     // and silently degrading it to a plain cascade would misreport the work.
@@ -240,12 +425,14 @@ export class TaskBoardHostService {
       const task = this.ledger.state().tasks.find(item => item.id === action.taskId)
       if (task?.teamRun === true) throw new Error('Agent Teams is unavailable in this deployment')
     }
-    const result = this.ledger.applyRequest(requestId, action, initiator)
+    const result = this.ledger.applyRequest(requestId, this.withInheritedWorkspace(action, initiator), initiator)
     if (result.runs !== undefined) this.dispatchRuns(result.runs)
     // A committed schedule write (create / update / toggle / delete) moves the
     // nearest trigger; re-arm on every action so a newly enabled schedule fires
     // at its own instant without waiting for the previous target to elapse.
     if (SCHEDULE_WRITE_ACTIONS.has(action.kind)) this.refreshSchedule()
+    this.emitStatusChanges(before, initiator)
+    if (action.kind === 'delete') this.extensions.emitTaskDeleted({ taskId: action.taskId })
     return {
       schemaVersion: TASK_BOARD_SCHEMA_VERSION,
       revision: result.state.revision,
@@ -255,9 +442,41 @@ export class TaskBoardHostService {
     }
   }
 
+  /** Route one provider action and answer the resulting board snapshot. */
+  private async handleExtensionAction(action: Extract<TaskBoardAction, { kind: 'extension-action' }>): Promise<TaskBoardSnapshot> {
+    await this.extensions.handleAction({
+      extensionId: action.extensionId,
+      action: action.action,
+      ...(action.taskId === undefined ? {} : { taskId: action.taskId }),
+      ...(action.payload === undefined ? {} : { payload: action.payload }),
+    })
+    return this.snapshot()
+  }
+
+  /** Current task id -> status map, for change detection around a mutation. */
+  private statusMap(): Map<string, TaskStatus> {
+    return new Map(this.ledger.allTasks().map(task => [task.id, task.status]))
+  }
+
+  /** Emit a status change for every task whose column moved, isolated per callback. */
+  private emitStatusChanges(before: Map<string, TaskStatus>, initiator?: string): void {
+    for (const task of this.ledger.allTasks()) {
+      const previous = before.get(task.id)
+      if (previous === undefined || previous === task.status) continue
+      this.extensions.emitStatusChanged({
+        taskId: task.id,
+        status: task.status,
+        previous,
+        ...(initiator === undefined || initiator === '' ? {} : { initiator }),
+      })
+    }
+  }
+
   dispose(): void {
     this.disposed = true
+    this.extensions.dispose()
     this.clearScheduleTimer()
+    this.clearPollBackoff()
     this.pollTimer?.()
     this.pollTimer = undefined
     this.power.dispose()
@@ -266,12 +485,14 @@ export class TaskBoardHostService {
   }
 
   private async launch(opened: OpenedRun, others: readonly OpenedRun[] = [], schedule?: ScheduledRunContext): Promise<void> {
+    /** The session this launch attached to the execution, once it exists. */
+    let attached: string | undefined
     try {
       // A team run always mints a fresh Lead session: teammates are immutable
       // children of that session, so reusing an older one would collide on
       // their names and orphan the previous team.
       const team = opened.task.teamRun === true
-      const reuseSessionId = team ? undefined : reusableSessionId(opened.task, this.idleSessionIds)
+      const reuseSessionId = team ? undefined : await this.reuseSessionFor(opened.task)
       // Both modes tell the launched agent what else this run opens; only a team
       // run names teammates, because only then does this session own them.
       const peers = others.length === 0 ? undefined : others.map(other => ({
@@ -286,17 +507,75 @@ export class TaskBoardHostService {
         ...(team ? { team: true } : {}),
         ...(schedule === undefined ? {} : { schedule }),
       }
+      // Freeze this execution's acceptance contract BEFORE the session is
+      // prompted: a settings change made while the run is in flight must not
+      // retrofit the rule that will judge it. A card that opted out resolves the
+      // same contract from an OFF switch: the board-wide switch decides the
+      // default, the card decides this execution, and both are read here.
+      const settings = this.verificationSettings()
+      // The GLOBAL native-/goal switch is read ONCE here and carried by value
+      // for the whole execution: a settings edit after this point can only
+      // affect executions that start later.
+      const globalGoalEnabled = this.goalRunEnabled() === true
+      // The card must ASK for the goal run: the option is off by default, so an
+      // absent value is a plain turn exactly like an explicit false.
+      const goalEnabled = globalGoalEnabled && opened.task.goalRun === true
+      // The card's opt-out is a DISTINCT reason, not the board switch: the
+      // report must be able to say which of the two turned the gate off.
+      const skippedBy: ExecutionVerification['applicability'] = opened.task.skipVerification === true ? 'skipped' : 'disabled'
+      const contract = resolveContract(
+        { ...settings, enabled: settings.enabled && opened.task.skipVerification !== true },
+        await this.verificationCatalog(),
+      )
+      // An execution that will not become a goal run can never fire the
+      // completion gate, so it is marked with the reason that actually applied:
+      // the global switch being off is its OWN reason, distinct from this run
+      // simply not becoming a goal run (the card never opted in, or a refused or
+      // unavailable /goal command), and it must never read as an accepted run.
+      // The reason names which switch withheld the goal: the GLOBAL master
+      // switch (this board never arms /goal) is a different fact from the card's
+      // own goal option staying off — which is the default, so it is what an
+      // untouched card gets.
+      const notArmed: ExecutionVerification['applicability'] = globalGoalEnabled ? 'goal-unavailable' : 'goal-disabled'
+      const initial: ExecutionVerification = {
+        contract,
+        attempts: [],
+        applicability: team ? 'team-member' : !contract.enabled ? skippedBy : notArmed,
+      }
+      this.ledger.setVerification(opened.task.id, opened.execution.id, initial)
       const sessionId = await this.runner.launch(opened.task, {
         ...(reuseSessionId === undefined ? {} : { reuseSessionId }),
         ...(promptContext === undefined ? {} : { promptContext }),
+        // The frozen global switch travels with the launch, so the runner's
+        // arming decision is exactly the one made above.
+        goalEnabled,
+        // Bind the session to the execution before the prompt is queued, so the
+        // completion gate can never observe the agent without its binding.
+        onSession: (id) => {
+          attached = id
+          this.ledger.attachSession(opened.task.id, opened.execution.id, id)
+        },
+        onGoalArmed: (armed) => {
+          this.setApplicability(opened.task.id, opened.execution.id, team
+            ? 'team-member'
+            : !contract.enabled ? skippedBy : armed ? 'enforced' : notArmed)
+        },
       })
-      this.ledger.attachSession(opened.task.id, opened.execution.id, sessionId)
+      if (attached === undefined) this.ledger.attachSession(opened.task.id, opened.execution.id, sessionId)
       if (team) for (const teammate of others) this.scheduleTeammate(teammate, sessionId)
     } catch (error) {
-      if (error instanceof SessionLaunchError) {
-        this.ledger.attachSession(opened.task.id, opened.execution.id, error.sessionId)
+      const launchedSession = error instanceof SessionLaunchError ? error.sessionId : undefined
+      if (launchedSession !== undefined) {
+        this.ledger.attachSession(opened.task.id, opened.execution.id, launchedSession)
+      }
+      // A scheduled occurrence that failed before any session existed created
+      // no real execution: refund the run it consumed and record why, so a
+      // failed launch can never silently spend the user's run budget. A manual
+      // run, and a launch that DID reach a session, are never refunded.
+      if (schedule !== undefined && attached === undefined && launchedSession === undefined) {
+        this.ledger.refundScheduledOccurrence(opened.task.id, this.now())
       }
-      this.ledger.settle(opened.task.id, opened.execution.id, 'failed', error instanceof Error ? error.message : String(error))
+      this.settleAndNotify(opened.task.id, opened.execution.id, 'failed', error instanceof Error ? error.message : String(error))
     }
   }
 
@@ -316,7 +595,7 @@ export class TaskBoardHostService {
   private async spawnTeammate(opened: OpenedRun, leadSessionId: string): Promise<void> {
     const team = this.team
     if (team === undefined) {
-      this.ledger.settle(opened.task.id, opened.execution.id, 'failed', 'Agent Teams is unavailable in this deployment')
+      this.settleAndNotify(opened.task.id, opened.execution.id, 'failed', 'Agent Teams is unavailable in this deployment')
       return
     }
     try {
@@ -327,45 +606,97 @@ export class TaskBoardHostService {
         prompt: promptText(opened.task),
       })
       if (member.sessionId === undefined || member.sessionId === '') {
-        this.ledger.settle(opened.task.id, opened.execution.id, 'failed', member.error ?? 'teammate provisioning failed')
+        this.settleAndNotify(opened.task.id, opened.execution.id, 'failed', member.error ?? 'teammate provisioning failed')
         return
       }
       this.ledger.attachSession(opened.task.id, opened.execution.id, member.sessionId)
     } catch (error) {
-      this.ledger.settle(opened.task.id, opened.execution.id, 'failed', error instanceof Error ? error.message : String(error))
+      this.settleAndNotify(opened.task.id, opened.execution.id, 'failed', error instanceof Error ? error.message : String(error))
     }
   }
 
-  private async pollSessions(): Promise<void> {
-    if (this.disposed) return
-    if (!this.active && this.ledger.runtimeView().openExecutions.length === 0) return
+  /**
+   * One roster pass, and whether it could read the session tree.
+   *
+   * The board reads the DSH session roster only while it has something the
+   * roster can decide: an execution to inspect, or a card parked in the running
+   * column whose verdict may arrive from a settle this process never saw. That
+   * gate is what removes the cost the reporter measured — `session/list`
+   * rebuilds every persisted session row (string conversion, object allocation,
+   * a stat per record), and an idle board with no tasks was paying it every few
+   * seconds forever.
+   * @returns whether the roster was readable (an idle pass counts as readable).
+   */
+  private async pollSessions(): Promise<boolean> {
+    if (this.disposed) return true
+    const runtime = this.ledger.runtimeView()
+    if (!this.active) {
+      // A disabled board still settles the runs it opened before it was
+      // switched off, and re-reads the roster while a card sits in the running
+      // column. With neither, the poll is a no-op.
+      if (runtime.openExecutions.length === 0 && runtime.armedSchedules === 0) return true
+    } else if (!runtime.needsSessionState) {
+      // Idle board: nothing to reconcile and nothing to count. Keep the last
+      // power reading (a stale count only delays the release of the idle-sleep
+      // assertion, never starts one) and stand down.
+      return true
+    }
     const running = await this.runner.listRunning()
     const previous = this.power.snapshot()
     if (!running.known) {
-      this.idleSessionIds = undefined
       this.power.updateReasons({
         runningSessions: previous.runningSessions,
-        armedSchedules: this.ledger.armedScheduleCount(),
+        armedSchedules: runtime.armedSchedules,
         sessionStateKnown: false,
       })
-      return
+      return false
     }
-    this.idleSessionIds = new Set(running.items.filter(item => !item.running).map(item => item.sessionId))
     // Fold whatever the board can already decide before spending inspection
     // RPCs: a team run whose Lead recorded its verdict, and any lineage whose
     // members are all settled. Idempotent, so an already folded board is free.
+    const foldedBefore = this.statusMap()
     this.ledger.finalizeReadyRuns()
+    this.emitStatusChanges(foldedBefore)
     // Read after the RPC so executions attached while it was in flight are
     // included in this pass, matching the former full-state snapshot timing.
-    const runtime = this.ledger.runtimeView()
+    const current = this.ledger.runtimeView()
     this.power.updateReasons({
       runningSessions: running.count,
-      armedSchedules: runtime.armedSchedules,
+      armedSchedules: current.armedSchedules,
       sessionStateKnown: true,
     })
     // No unconditional emit here: real changes already emit through the
     // ledger subscription (settles) and the gated power listener above.
-    await this.reconcileExecutions(running.items, runtime.openExecutions)
+    await this.reconcileExecutions(running.items, current.openExecutions)
+    return true
+  }
+
+  /**
+   * The session a run may continue in, for a card that opted into reuse
+   * (issue #1419). Reuse requires positive evidence that the previous session
+   * is present and idle, and that evidence must be read for THIS launch: an
+   * idle board no longer polls, so a roster cached from an earlier pass could
+   * be hours old — either refusing a session that has been idle all along, or
+   * prompting into one that started running since. A card that did not opt in
+   * reads no roster at all, and a read that fails mints a fresh conversation
+   * exactly as an unknown roster always did.
+   * @param task - the task about to run.
+   * @returns the session id to continue in, or undefined for a fresh session.
+   */
+  private async reuseSessionFor(task: TaskRecord): Promise<string | undefined> {
+    if (task.reuseSession !== true) return undefined
+    let running: Awaited<ReturnType<HostExecutionRunner['listRunning']>>
+    try {
+      running = await this.runner.listRunning()
+    } catch (error) {
+      // A read that failed is an unknown roster, and an unknown roster never
+      // reuses; the launch itself must not fail over the reuse probe.
+      this.notePollFailure()
+      safeConsoleError('[dsh-task-board] session roster read for session reuse failed; starting a fresh session', error)
+      return undefined
+    }
+    if (!running.known) return undefined
+    return reusableSessionId(task, new Set(running.items.filter(item => !item.running).map(item => item.sessionId)))
   }
 
   /** Reuse the session list this poll already fetched: one list RPC per tick, not 1 + E. */
@@ -375,6 +706,16 @@ export class TaskBoardHostService {
   ): Promise<void> {
     for (const execution of executions) {
       if (execution.sessionId === undefined) continue
+      const record = this.ledger.getTask(execution.taskId)?.executions.find(entry => entry.id === execution.executionId)
+      const verification = record?.verification
+      // A cycle the gate already closed is decided here, without another
+      // inspection: the goal may still be active (or un-blockable) exactly
+      // because the acceptance failed, and the card must not stay in the
+      // running column waiting for a verdict that is already recorded.
+      if (verification?.failedReason !== undefined) {
+        this.settleAndNotify(execution.taskId, execution.executionId, 'failed', verification.failedReason)
+        continue
+      }
       try {
         // A team member's turn is read even while the roster calls its session
         // running: a durable teammate never goes idle for good.
@@ -387,7 +728,29 @@ export class TaskBoardHostService {
           continue
         }
         this.unreadablePolls.delete(execution.executionId)
-        this.ledger.settle(execution.taskId, execution.executionId, result.outcome, 'error' in result ? result.error : undefined)
+        // Forced acceptance: the old fallback paths — a completed turn, a
+        // paused goal, an unreadable projection, a manual settle — must never
+        // be mistaken for a verified success. Only a matching pass record
+        // settles this execution as succeeded.
+        if (result.outcome === 'succeeded' && verificationRequired(verification) && passedAttempt(verification) === undefined) {
+          // Two different failures share this branch, and they send the reader
+          // in opposite directions: attempts on record mean the judge ran and
+          // the work did not pass, while zero attempts mean the gate never
+          // opened at all (issue #1837) — the session narrated completion
+          // instead of calling `update_goal(action: complete)`.
+          this.settleAndNotify(
+            execution.taskId,
+            execution.executionId,
+            'failed',
+            verificationNeverInvoked(verification)
+              ? NEVER_INVOKED_VERIFICATION_REASON
+              : verificationOnlyInvalid(verification)
+                ? INVALID_ONLY_VERIFICATION_REASON
+                : NO_MATCHING_PASS_VERIFICATION_REASON,
+          )
+          continue
+        }
+        this.settleAndNotify(execution.taskId, execution.executionId, result.outcome, 'error' in result ? result.error : undefined)
       } catch {
         // A transient inspection failure never settles a running execution.
       }
@@ -407,6 +770,95 @@ export class TaskBoardHostService {
    * ancestor of it — in the running column with no way out. The first poll of
    * each streak is logged, so the Host log names the session.
    */
+  private settleAndNotify(taskId: string, executionId: string, outcome: ExecutionOutcome, error?: string): void {
+    const before = this.ledger.getTask(taskId)
+    if (before?.executions.find(entry => entry.id === executionId)?.endedAt !== undefined) {
+      // Already settled: the ledger would no-op, and re-emitting would report
+      // the same settlement twice.
+      this.ledger.settle(taskId, executionId, outcome, error)
+      return
+    }
+    const previousStatus = before?.status
+    this.ledger.settle(taskId, executionId, outcome, error)
+    const task = this.ledger.getTask(taskId)
+    if (task !== undefined && previousStatus !== undefined && previousStatus !== task.status) {
+      this.extensions.emitStatusChanged({ taskId, status: task.status, previous: previousStatus })
+    }
+    this.extensions.emitExecutionSettled({
+      taskId,
+      executionId,
+      outcome,
+      ...(error === undefined ? {} : { error }),
+    })
+    // The pass record and the settlement are DURABLE by this point (both are in
+    // the ledger above), so the acceptance-only detail may now be cleaned. A
+    // cleanup failure is recorded against the execution and retried on the next
+    // Host start; it never revokes the pass this settlement just wrote.
+    if (outcome === 'succeeded') this.cleanupAcceptanceDetail(taskId, executionId)
+  }
+
+  /**
+   * Remove one execution's acceptance-only detail after it PASSED and settled.
+   *
+   * Deliberately narrow: only the acceptance mechanism's own per-attempt
+   * material (findings, invalid diagnostics, the bulky judge side) is removed,
+   * and only for THIS execution, keyed by its own id in the ledger it belongs
+   * to. No user file, task artifact, raw session history or other execution's
+   * record is read or written. Idempotent by the record's own state, and it
+   * clearly never touches a run that did not pass (the caller's guard) — a
+   * failed or invalid execution keeps everything a repair or a review needs.
+   * @param taskId - the task whose execution settled.
+   * @param executionId - the settled execution.
+   */
+  private cleanupAcceptanceDetail(taskId: string, executionId: string): void {
+    const execution = this.ledger.getTask(taskId)?.executions.find(entry => entry.id === executionId)
+    const verification = execution?.verification
+    // Only an execution with a REAL pass record is cleaned. An execution whose
+    // acceptance never ran (no block) or was disabled/skipped has nothing this
+    // mechanism created, and a failed one must keep its evidence.
+    if (verification === undefined || passedAttempt(verification) === undefined) return
+    if (verification.cleanup?.state === 'cleaned') return
+    try {
+      const cleaned = withAcceptanceDetailCleared(verification, this.now())
+      if (cleaned === undefined) return
+      this.ledger.setVerification(taskId, executionId, cleaned)
+    } catch (error) {
+      // Record the failure so the UI can say the cleanup is pending and the
+      // Host retries it at start; the pass itself is untouched.
+      const attempts = (verification.cleanup?.attempts ?? 0) + 1
+      this.ledger.setVerification(taskId, executionId, {
+        ...verification,
+        cleanup: {
+          state: 'failed',
+          attempts,
+          startedAt: verification.cleanup?.startedAt ?? this.now(),
+          lastError: error instanceof Error ? error.message : String(error),
+          audit: verification.cleanup?.audit ?? [],
+        },
+      })
+      safeConsoleError('[dsh-task-board] acceptance-detail cleanup failed; it is retried on the next Host start', error)
+    }
+  }
+
+  /**
+   * Catch-up pass: clean the acceptance detail of every execution that PASSED
+   * and settled but whose cleanup did not finish (a crash, a failed write, a
+   * Host killed mid-cleanup).
+   *
+   * The same bounds as any other cleanup apply — only a real pass record on a
+   * settled execution is touched — so this can never delete material belonging
+   * to an execution that did not pass, and never a user file.
+   */
+  private cleanupPendingAcceptanceDetail(): void {
+    for (const task of this.ledger.allTasks()) {
+      for (const execution of task.executions) {
+        if (execution.endedAt === undefined) continue
+        if (execution.result !== 'succeeded') continue
+        this.cleanupAcceptanceDetail(task.id, execution.id)
+      }
+    }
+  }
+
   private noteUnreadableInspection(execution: OpenExecutionReference, reason: string | undefined): void {
     const polls = (this.unreadablePolls.get(execution.executionId) ?? 0) + 1
     this.unreadablePolls.set(execution.executionId, polls)
@@ -417,7 +869,7 @@ export class TaskBoardHostService {
     }
     if (polls < UNREADABLE_SETTLE_POLLS) return
     this.unreadablePolls.delete(execution.executionId)
-    this.ledger.settle(
+    this.settleAndNotify(
       execution.taskId,
       execution.executionId,
       'failed',
@@ -484,13 +936,21 @@ export class TaskBoardHostService {
       this.recoverSchedule()
       return
     }
+    const before = this.statusMap()
     for (const schedule of this.ledger.dueSchedules(now)) {
-      const next = nextRunAtMs(schedule.cron, schedule.nextRunAt, schedule.timeZone)
+      // The ledger owns both the budget gate and the next target: it refuses a
+      // rule that already spent its runs and stops a one-shot as it fires.
       this.dispatchRuns(
-        this.ledger.openScheduled(schedule.taskId, next, now),
-        { triggeredAt: now, timeZone: schedule.timeZone, cron: schedule.cron },
+        this.ledger.openScheduled(schedule.taskId, now),
+        {
+          triggeredAt: now,
+          timeZone: schedule.timeZone,
+          mode: schedule.mode,
+          ...(schedule.cron === undefined ? {} : { cron: schedule.cron }),
+        },
       )
     }
+    this.emitStatusChanges(before)
     // The launched run (or the rolled-forward target) moved every due schedule,
     // so the next nearest target has to be recomputed from the ledger.
     this.armSchedule()
@@ -517,6 +977,16 @@ export class TaskBoardHostService {
     }
   }
 
+  /**
+   * Move one execution's applicability without touching its frozen contract or
+   * its recorded attempts (used when the run's goal form becomes known).
+   */
+  private setApplicability(taskId: string, executionId: string, applicability: ExecutionVerification['applicability']): void {
+    const verification = this.ledger.getTask(taskId)?.executions.find(entry => entry.id === executionId)?.verification
+    if (verification === undefined || verification.applicability === applicability) return
+    this.ledger.setVerification(taskId, executionId, { ...verification, applicability })
+  }
+
   private scheduleLaunch(opened: OpenedRun, others: readonly OpenedRun[] = [], schedule?: ScheduledRunContext): void {
     void this.launch(opened, others, schedule).catch(error => {
       safeConsoleError('[dsh-task-board] execution launch settlement failed', error)
@@ -526,11 +996,47 @@ export class TaskBoardHostService {
   private schedulePoll(): void {
     if (this.pollInFlight || this.disposed) return
     this.pollInFlight = true
-    void this.pollSessions().catch(error => {
+    void this.pollSessions().then((rosterReadable) => {
+      // A pass that could not read the roster is a failure even though it
+      // resolved: the board knows no more about its sessions than before.
+      if (rosterReadable) this.consecutivePollFailures = 0
+      else this.notePollFailure()
+    }).catch(error => {
+      this.notePollFailure()
       safeConsoleError('[dsh-task-board] session polling failed', error)
     }).finally(() => { this.pollInFlight = false })
   }
 
+  /**
+   * Count one failed pass and arm the retry that follows it.
+   *
+   * A session tree that is down is retried on a doubling delay instead of
+   * hammering it on the fixed cadence: the heartbeat would otherwise repeat
+   * every failure — and every retry inside {@link HostExecutionRunner.listRunning}
+   * — at exactly the interval the reporter measured.
+   */
+  private notePollFailure(): void {
+    this.consecutivePollFailures += 1
+    this.armPollBackoff()
+  }
+
+  /** Arm the retry that follows a failed pass, doubling up to the ceiling. */
+  private armPollBackoff(): void {
+    if (this.disposed) return
+    this.pollBackoffTimer?.()
+    const delay = Math.min(sessionPollMs(this.sessionPollSeconds) * 2 ** Math.min(this.consecutivePollFailures, 8), POLL_FAILURE_MAX_BACKOFF_MS)
+    this.pollBackoffTimer = this.timers.timeout(() => {
+      this.pollBackoffTimer = undefined
+      this.schedulePoll()
+    }, delay)
+  }
+
+  /** Drop a pending retry; the next regular tick takes over. */
+  private clearPollBackoff(): void {
+    this.pollBackoffTimer?.()
+    this.pollBackoffTimer = undefined
+  }
+
   /**
    * Re-arm from the ledger's current targets. Callers that just changed a
    * schedule (the host routes, the agent tools) invoke this after the write