@linxin666/dsh-client-ui-task-board 0.4.5 → 0.4.6

package/src/host-service.ts

@@ -1,5 +1,5 @@
 import type { TypertGateway } from '@deepseek-ai/dsh-api-gateway'
-import { nextRunAtMs } from './core/schedule.ts'
+import { DEFAULT_SESSION_POLL_SECONDS, normalizeSessionPollSeconds, sessionPollMs } from './core/poll-cadence.ts'
 import { reusableSessionId } from './core/session-reuse.ts'
 import { HostTaskLedger, type OpenedRun, type OpenExecutionReference } from './host-ledger.ts'
 import { HostExecutionRunner, SessionLaunchError, promptText, type SessionCommandDispatcher, type SessionSummary, type TaskBoardWorkspaceRegistry } from './host-runner.ts'
@@ -9,8 +9,8 @@ import { PowerInhibitor } from './power-inhibitor.ts'
 import { TASK_BOARD_SCHEMA_VERSION, type TaskBoardAction, type TaskBoardEventPayload, type TaskBoardSnapshot } from './protocol.ts'
 import { TaskBoardExtensionRegistry } from './host/extension-registry.ts'
 import type { TaskBoardExtension } from './core/extension.ts'
-import type { ExecutionOutcome, TaskStatus } from './core/tasks.ts'
-import { passedAttempt, resolveContract, verificationRequired, type ExecutionVerification, type ModelCatalogView, type VerificationContract, type VerificationSettings } from './core/verification.ts'
+import type { ExecutionOutcome, ScheduleMode, TaskRecord, TaskStatus } from './core/tasks.ts'
+import { passedAttempt, resolveContract, verificationNeverInvoked, verificationOnlyInvalid, verificationRequired, withAcceptanceDetailCleared, type ExecutionVerification, type ModelCatalogView, type VerificationContract, type VerificationSettings } from './core/verification.ts'
 import type { TaskPermission } from './core/handover.ts'
 
 /** One teammate the Host asks the Agent Teams service to spawn for a team run. */
@@ -43,8 +43,8 @@ export interface TaskBoardTeamDispatcher {
   spawn(input: TeamSpawnInput): Promise<TeamSpawnResult>
 }
 
-/** Session-roster poll cadence — the one recurring Host timer this service still holds. */
-const SESSION_POLL_MS = 5_000
+/** Ceiling for the roster-poll failure backoff: a broken session tree is retried at most once a minute. */
+const POLL_FAILURE_MAX_BACKOFF_MS = 60_000
 /**
  * How late an armed schedule fire may be before it counts as a resume rather
  * than a normal occurrence. The schedule timer is armed AT the next due
@@ -65,6 +65,31 @@ const MAX_TIMER_DELAY_MS = 2_147_483_647
  */
 const UNREADABLE_SETTLE_POLLS = 24
 
+/**
+ * Why an enforced goal execution settled failed while its acceptance DID run:
+ * attempts were recorded and none of them passed. The judge answered about the
+ * work and the work did not pass.
+ */
+export const NO_MATCHING_PASS_VERIFICATION_REASON = 'goal 验收：本次执行没有匹配的验收通过记录（验收未运行、未通过或报告来自其他执行），按未验收判失败。'
+/**
+ * Why an enforced goal execution settled failed with ZERO acceptance records:
+ * the gate was never opened, so the judge never ran and nothing was ever judged
+ * (issue #1837). The root cause is a session that declared completion in prose
+ * instead of calling `update_goal(action: complete)` — a tool-adherence problem,
+ * NOT a quality verdict on the delivery — so this reason says so and keeps the
+ * two investigation directions apart.
+ */
+export const NEVER_INVOKED_VERIFICATION_REASON = 'goal 验收未触发：本次执行没有任何验收记录，验收门从未打开——执行会话没有调用 update_goal(action: complete) 来完成目标（常见于只在回复里宣告完成）。这不是质量判负：交付从未被裁判评估。'
+/**
+ * Why an enforced goal execution settled failed while its ONLY acceptance
+ * records are INVALID: the judge answered but could not locate its own
+ * rejection, so the board stopped calling it. This is NOT an evidence-backed
+ * quality veto — the requirement is explicit that such a run must not be
+ * described as one — but the execution still has no matching pass, so it ends
+ * for lack of one, and the reason names that precisely.
+ */
+export const INVALID_ONLY_VERIFICATION_REASON = 'goal 验收无效：本次执行只记录了无效验收（裁判未能给出与任务要求对应、且可定位到本次证据的否决依据），看板已停止调用裁判。这**不是**有证据的质量判负：验收本身不可用，本次运行因没有匹配的通过记录而结束。请检查验收环境与证据可见性，或用 task_board_manage(action=reset-verification) 清除记录的无效验收后重新完成目标。'
+
 /**
  * Provenance of one cron-triggered cascade: when the rule fired and the zone
  * its wall clock was read in. Passed into every launched prompt of that run so
@@ -73,7 +98,10 @@ const UNREADABLE_SETTLE_POLLS = 24
 export interface ScheduledRunContext {
   triggeredAt: number
   timeZone: string
-  cron: string
+  /** Whether this fire came from a recurring rule or a single planned instant. */
+  mode: ScheduleMode
+  /** Cron expression of a recurring rule; absent on a one-shot. */
+  cron?: string
 }
 
 /**
@@ -113,6 +141,12 @@ export class TaskBoardHostService {
   private readonly listeners = new Set<() => void>()
   /** The one recurring timer: the session-roster poll. */
   private pollTimer: (() => void) | undefined
+  /** Cadence of the roster poll, in seconds (a settings field; see the config schema). */
+  private sessionPollSeconds = DEFAULT_SESSION_POLL_SECONDS
+  /** Pending delay that follows a failed poll pass, if one is armed. */
+  private pollBackoffTimer: (() => void) | undefined
+  /** Consecutive failed poll passes; doubles the next retry delay. */
+  private consecutivePollFailures = 0
   /** The armed schedule timer, if a trigger is pending. */
   private scheduleTimer: (() => void) | undefined
   /** The instant the armed schedule timer targets (ms epoch), for resume detection. */
@@ -120,13 +154,6 @@ export class TaskBoardHostService {
   private disposed = false
   private pollInFlight = false
   private active = true
-  /**
-   * Ids the last roster poll saw as present and idle; undefined while the
-   * roster is unknown. Session reuse (issue #1419) requires this positive
-   * evidence, so a launch before the first successful poll mints a fresh
-   * conversation instead of prompting into a session it cannot see.
-   */
-  private idleSessionIds: ReadonlySet<string> | undefined
   /**
    * Consecutive unreadable-history polls per open execution (see
    * {@link noteUnreadableInspection}). Cleared as soon as an inspection
@@ -138,6 +165,8 @@ export class TaskBoardHostService {
   private readonly verificationCatalog: () => Promise<ModelCatalogView | undefined>
   private readonly team: TaskBoardTeamDispatcher | undefined
   private readonly timers: HostTimerFace
+  /** Live reader of the global native-/goal switch; frozen per execution. */
+  private readonly goalRunEnabled: () => boolean
   private lastPowerJson = ''
   private readonly now: () => number
   /** The deployment's workspaces, consulted to resolve a card that pins none. */
@@ -163,6 +192,14 @@ export class TaskBoardHostService {
     maxSubtaskDepth?: number
     team?: TaskBoardTeamDispatcher
     timers?: HostTimerFace
+    /**
+     * Live GLOBAL native /goal switch (a volatile config read). Read ONCE per
+     * execution, at launch, and carried by value from then on: a settings edit
+     * made while a run is in flight must not arm, disarm or otherwise change the
+     * goal/acceptance contract of that run. Absent means OFF, which is the
+     * default for every deployment that never configured it.
+     */
+    goalRunEnabled?: () => boolean
     /**
      * Live acceptance settings (volatile config reads). Absent keeps goal
      * acceptance OFF for every execution this service opens, which is what a
@@ -182,6 +219,7 @@ export class TaskBoardHostService {
     this.timers = options.timers ?? PROCESS_TIMERS
     this.power = options.power ?? new PowerInhibitor()
     this.now = options.now ?? Date.now
+    this.goalRunEnabled = options.goalRunEnabled ?? (() => false)
     this.verificationSettings = options.verificationSettings ?? (() => ({ enabled: false, model: '', reasoningEffort: '' }))
     this.verificationCatalog = options.verificationCatalog ?? (async () => undefined)
     this.extensions = new TaskBoardExtensionRegistry({
@@ -210,8 +248,11 @@ export class TaskBoardHostService {
   start(): void {
     if (this.disposed || this.pollTimer !== undefined) return
     this.syncPowerReasons()
-    this.pollTimer = this.timers.interval(() => { this.schedulePoll() }, SESSION_POLL_MS)
+    this.pollTimer = this.timers.interval(() => { this.schedulePoll() }, sessionPollMs(this.sessionPollSeconds))
     this.schedulePoll()
+    // Boot is also the cleanup catch-up point: an execution that passed before
+    // the Host stopped may still hold its detail (a crash, a failed write).
+    this.cleanupPendingAcceptanceDetail()
     // Boot is a recovery point: an occurrence armed while the Host was down is
     // not replayed, and each schedule rolls to its next future target. A
     // schedule the Board should have served while running is then armed
@@ -219,10 +260,30 @@ export class TaskBoardHostService {
     this.recoverSchedule()
   }
 
-  setConfiguration(active: boolean, preventIdleSleep: boolean): void {
+  /**
+   * Apply the live configuration. The roster cadence is re-read on every
+   * commit, so a settings edit takes effect without a restart; the poll is
+   * scheduled at the new cadence immediately rather than waiting out the old
+   * interval.
+   * @param active - the board's master switch.
+   * @param preventIdleSleep - whether the board holds an idle-sleep assertion.
+   * @param sessionPollSeconds - roster-poll cadence in seconds (clamped).
+   */
+  setConfiguration(active: boolean, preventIdleSleep: boolean, sessionPollSeconds?: number): void {
     const resumed = !this.active && active
     this.active = active
     this.preventIdleSleep = preventIdleSleep
+    const cadence = normalizeSessionPollSeconds(sessionPollSeconds)
+    const retimed = this.pollTimer !== undefined && cadence !== this.sessionPollSeconds
+    this.sessionPollSeconds = cadence
+    if (retimed) {
+      // The recurring timer was armed at the old cadence: replace it and take
+      // the next pass now, so the new interval starts from this commit.
+      this.pollTimer?.()
+      this.pollTimer = this.timers.interval(() => { this.schedulePoll() }, sessionPollMs(this.sessionPollSeconds))
+      this.clearPollBackoff()
+      this.schedulePoll()
+    }
     if (resumed) {
       const current = this.power.snapshot()
       this.power.updateReasons({
@@ -258,6 +319,10 @@ export class TaskBoardHostService {
       sessionDefaultPermission: this.ledger.sessionDefaultPermission,
       maxSubtaskDepth: this.ledger.maxSubtaskDepth,
       teamRunAvailable: this.team !== undefined,
+      // The GLOBAL native-/goal switch is published live for the UI, but the
+      // service freezes its own read at launch: this mirror is for the FORM
+      // (enable/disable + explanation), never for a run already in flight.
+      goalRunEnabled: this.goalRunEnabled(),
       ...(Object.keys(published).length === 0 ? {} : { extensions: published }),
     }
   }
@@ -411,6 +476,7 @@ export class TaskBoardHostService {
     this.disposed = true
     this.extensions.dispose()
     this.clearScheduleTimer()
+    this.clearPollBackoff()
     this.pollTimer?.()
     this.pollTimer = undefined
     this.power.dispose()
@@ -419,12 +485,14 @@ export class TaskBoardHostService {
   }
 
   private async launch(opened: OpenedRun, others: readonly OpenedRun[] = [], schedule?: ScheduledRunContext): Promise<void> {
+    /** The session this launch attached to the execution, once it exists. */
+    let attached: string | undefined
     try {
       // A team run always mints a fresh Lead session: teammates are immutable
       // children of that session, so reusing an older one would collide on
       // their names and orphan the previous team.
       const team = opened.task.teamRun === true
-      const reuseSessionId = team ? undefined : reusableSessionId(opened.task, this.idleSessionIds)
+      const reuseSessionId = team ? undefined : await this.reuseSessionFor(opened.task)
       // Both modes tell the launched agent what else this run opens; only a team
       // run names teammates, because only then does this session own them.
       const peers = others.length === 0 ? undefined : others.map(other => ({
@@ -445,6 +513,13 @@ export class TaskBoardHostService {
       // same contract from an OFF switch: the board-wide switch decides the
       // default, the card decides this execution, and both are read here.
       const settings = this.verificationSettings()
+      // The GLOBAL native-/goal switch is read ONCE here and carried by value
+      // for the whole execution: a settings edit after this point can only
+      // affect executions that start later.
+      const globalGoalEnabled = this.goalRunEnabled() === true
+      // The card must ASK for the goal run: the option is off by default, so an
+      // absent value is a plain turn exactly like an explicit false.
+      const goalEnabled = globalGoalEnabled && opened.task.goalRun === true
       // The card's opt-out is a DISTINCT reason, not the board switch: the
       // report must be able to say which of the two turned the gate off.
       const skippedBy: ExecutionVerification['applicability'] = opened.task.skipVerification === true ? 'skipped' : 'disabled'
@@ -452,16 +527,28 @@ export class TaskBoardHostService {
         { ...settings, enabled: settings.enabled && opened.task.skipVerification !== true },
         await this.verificationCatalog(),
       )
+      // An execution that will not become a goal run can never fire the
+      // completion gate, so it is marked with the reason that actually applied:
+      // the global switch being off is its OWN reason, distinct from this run
+      // simply not becoming a goal run (the card never opted in, or a refused or
+      // unavailable /goal command), and it must never read as an accepted run.
+      // The reason names which switch withheld the goal: the GLOBAL master
+      // switch (this board never arms /goal) is a different fact from the card's
+      // own goal option staying off — which is the default, so it is what an
+      // untouched card gets.
+      const notArmed: ExecutionVerification['applicability'] = globalGoalEnabled ? 'goal-unavailable' : 'goal-disabled'
       const initial: ExecutionVerification = {
         contract,
         attempts: [],
-        applicability: team ? 'team-member' : !contract.enabled ? skippedBy : 'goal-unavailable',
+        applicability: team ? 'team-member' : !contract.enabled ? skippedBy : notArmed,
       }
       this.ledger.setVerification(opened.task.id, opened.execution.id, initial)
-      let attached: string | undefined
       const sessionId = await this.runner.launch(opened.task, {
         ...(reuseSessionId === undefined ? {} : { reuseSessionId }),
         ...(promptContext === undefined ? {} : { promptContext }),
+        // The frozen global switch travels with the launch, so the runner's
+        // arming decision is exactly the one made above.
+        goalEnabled,
         // Bind the session to the execution before the prompt is queued, so the
         // completion gate can never observe the agent without its binding.
         onSession: (id) => {
@@ -471,14 +558,22 @@ export class TaskBoardHostService {
         onGoalArmed: (armed) => {
           this.setApplicability(opened.task.id, opened.execution.id, team
             ? 'team-member'
-            : !contract.enabled ? skippedBy : armed ? 'enforced' : 'goal-unavailable')
+            : !contract.enabled ? skippedBy : armed ? 'enforced' : notArmed)
         },
       })
       if (attached === undefined) this.ledger.attachSession(opened.task.id, opened.execution.id, sessionId)
       if (team) for (const teammate of others) this.scheduleTeammate(teammate, sessionId)
     } catch (error) {
-      if (error instanceof SessionLaunchError) {
-        this.ledger.attachSession(opened.task.id, opened.execution.id, error.sessionId)
+      const launchedSession = error instanceof SessionLaunchError ? error.sessionId : undefined
+      if (launchedSession !== undefined) {
+        this.ledger.attachSession(opened.task.id, opened.execution.id, launchedSession)
+      }
+      // A scheduled occurrence that failed before any session existed created
+      // no real execution: refund the run it consumed and record why, so a
+      // failed launch can never silently spend the user's run budget. A manual
+      // run, and a launch that DID reach a session, are never refunded.
+      if (schedule !== undefined && attached === undefined && launchedSession === undefined) {
+        this.ledger.refundScheduledOccurrence(opened.task.id, this.now())
       }
       this.settleAndNotify(opened.task.id, opened.execution.id, 'failed', error instanceof Error ? error.message : String(error))
     }
@@ -520,21 +615,42 @@ export class TaskBoardHostService {
     }
   }
 
-  private async pollSessions(): Promise<void> {
-    if (this.disposed) return
-    if (!this.active && this.ledger.runtimeView().openExecutions.length === 0) return
+  /**
+   * One roster pass, and whether it could read the session tree.
+   *
+   * The board reads the DSH session roster only while it has something the
+   * roster can decide: an execution to inspect, or a card parked in the running
+   * column whose verdict may arrive from a settle this process never saw. That
+   * gate is what removes the cost the reporter measured — `session/list`
+   * rebuilds every persisted session row (string conversion, object allocation,
+   * a stat per record), and an idle board with no tasks was paying it every few
+   * seconds forever.
+   * @returns whether the roster was readable (an idle pass counts as readable).
+   */
+  private async pollSessions(): Promise<boolean> {
+    if (this.disposed) return true
+    const runtime = this.ledger.runtimeView()
+    if (!this.active) {
+      // A disabled board still settles the runs it opened before it was
+      // switched off, and re-reads the roster while a card sits in the running
+      // column. With neither, the poll is a no-op.
+      if (runtime.openExecutions.length === 0 && runtime.armedSchedules === 0) return true
+    } else if (!runtime.needsSessionState) {
+      // Idle board: nothing to reconcile and nothing to count. Keep the last
+      // power reading (a stale count only delays the release of the idle-sleep
+      // assertion, never starts one) and stand down.
+      return true
+    }
     const running = await this.runner.listRunning()
     const previous = this.power.snapshot()
     if (!running.known) {
-      this.idleSessionIds = undefined
       this.power.updateReasons({
         runningSessions: previous.runningSessions,
-        armedSchedules: this.ledger.armedScheduleCount(),
+        armedSchedules: runtime.armedSchedules,
         sessionStateKnown: false,
       })
-      return
+      return false
     }
-    this.idleSessionIds = new Set(running.items.filter(item => !item.running).map(item => item.sessionId))
     // Fold whatever the board can already decide before spending inspection
     // RPCs: a team run whose Lead recorded its verdict, and any lineage whose
     // members are all settled. Idempotent, so an already folded board is free.
@@ -543,15 +659,44 @@ export class TaskBoardHostService {
     this.emitStatusChanges(foldedBefore)
     // Read after the RPC so executions attached while it was in flight are
     // included in this pass, matching the former full-state snapshot timing.
-    const runtime = this.ledger.runtimeView()
+    const current = this.ledger.runtimeView()
     this.power.updateReasons({
       runningSessions: running.count,
-      armedSchedules: runtime.armedSchedules,
+      armedSchedules: current.armedSchedules,
       sessionStateKnown: true,
     })
     // No unconditional emit here: real changes already emit through the
     // ledger subscription (settles) and the gated power listener above.
-    await this.reconcileExecutions(running.items, runtime.openExecutions)
+    await this.reconcileExecutions(running.items, current.openExecutions)
+    return true
+  }
+
+  /**
+   * The session a run may continue in, for a card that opted into reuse
+   * (issue #1419). Reuse requires positive evidence that the previous session
+   * is present and idle, and that evidence must be read for THIS launch: an
+   * idle board no longer polls, so a roster cached from an earlier pass could
+   * be hours old — either refusing a session that has been idle all along, or
+   * prompting into one that started running since. A card that did not opt in
+   * reads no roster at all, and a read that fails mints a fresh conversation
+   * exactly as an unknown roster always did.
+   * @param task - the task about to run.
+   * @returns the session id to continue in, or undefined for a fresh session.
+   */
+  private async reuseSessionFor(task: TaskRecord): Promise<string | undefined> {
+    if (task.reuseSession !== true) return undefined
+    let running: Awaited<ReturnType<HostExecutionRunner['listRunning']>>
+    try {
+      running = await this.runner.listRunning()
+    } catch (error) {
+      // A read that failed is an unknown roster, and an unknown roster never
+      // reuses; the launch itself must not fail over the reuse probe.
+      this.notePollFailure()
+      safeConsoleError('[dsh-task-board] session roster read for session reuse failed; starting a fresh session', error)
+      return undefined
+    }
+    if (!running.known) return undefined
+    return reusableSessionId(task, new Set(running.items.filter(item => !item.running).map(item => item.sessionId)))
   }
 
   /** Reuse the session list this poll already fetched: one list RPC per tick, not 1 + E. */
@@ -588,11 +733,20 @@ export class TaskBoardHostService {
         // be mistaken for a verified success. Only a matching pass record
         // settles this execution as succeeded.
         if (result.outcome === 'succeeded' && verificationRequired(verification) && passedAttempt(verification) === undefined) {
+          // Two different failures share this branch, and they send the reader
+          // in opposite directions: attempts on record mean the judge ran and
+          // the work did not pass, while zero attempts mean the gate never
+          // opened at all (issue #1837) — the session narrated completion
+          // instead of calling `update_goal(action: complete)`.
           this.settleAndNotify(
             execution.taskId,
             execution.executionId,
             'failed',
-            'goal 验收：本次执行没有匹配的验收通过记录（验收未运行、未通过或报告来自其他执行），按未验收判失败。',
+            verificationNeverInvoked(verification)
+              ? NEVER_INVOKED_VERIFICATION_REASON
+              : verificationOnlyInvalid(verification)
+                ? INVALID_ONLY_VERIFICATION_REASON
+                : NO_MATCHING_PASS_VERIFICATION_REASON,
           )
           continue
         }
@@ -636,6 +790,73 @@ export class TaskBoardHostService {
       outcome,
       ...(error === undefined ? {} : { error }),
     })
+    // The pass record and the settlement are DURABLE by this point (both are in
+    // the ledger above), so the acceptance-only detail may now be cleaned. A
+    // cleanup failure is recorded against the execution and retried on the next
+    // Host start; it never revokes the pass this settlement just wrote.
+    if (outcome === 'succeeded') this.cleanupAcceptanceDetail(taskId, executionId)
+  }
+
+  /**
+   * Remove one execution's acceptance-only detail after it PASSED and settled.
+   *
+   * Deliberately narrow: only the acceptance mechanism's own per-attempt
+   * material (findings, invalid diagnostics, the bulky judge side) is removed,
+   * and only for THIS execution, keyed by its own id in the ledger it belongs
+   * to. No user file, task artifact, raw session history or other execution's
+   * record is read or written. Idempotent by the record's own state, and it
+   * clearly never touches a run that did not pass (the caller's guard) — a
+   * failed or invalid execution keeps everything a repair or a review needs.
+   * @param taskId - the task whose execution settled.
+   * @param executionId - the settled execution.
+   */
+  private cleanupAcceptanceDetail(taskId: string, executionId: string): void {
+    const execution = this.ledger.getTask(taskId)?.executions.find(entry => entry.id === executionId)
+    const verification = execution?.verification
+    // Only an execution with a REAL pass record is cleaned. An execution whose
+    // acceptance never ran (no block) or was disabled/skipped has nothing this
+    // mechanism created, and a failed one must keep its evidence.
+    if (verification === undefined || passedAttempt(verification) === undefined) return
+    if (verification.cleanup?.state === 'cleaned') return
+    try {
+      const cleaned = withAcceptanceDetailCleared(verification, this.now())
+      if (cleaned === undefined) return
+      this.ledger.setVerification(taskId, executionId, cleaned)
+    } catch (error) {
+      // Record the failure so the UI can say the cleanup is pending and the
+      // Host retries it at start; the pass itself is untouched.
+      const attempts = (verification.cleanup?.attempts ?? 0) + 1
+      this.ledger.setVerification(taskId, executionId, {
+        ...verification,
+        cleanup: {
+          state: 'failed',
+          attempts,
+          startedAt: verification.cleanup?.startedAt ?? this.now(),
+          lastError: error instanceof Error ? error.message : String(error),
+          audit: verification.cleanup?.audit ?? [],
+        },
+      })
+      safeConsoleError('[dsh-task-board] acceptance-detail cleanup failed; it is retried on the next Host start', error)
+    }
+  }
+
+  /**
+   * Catch-up pass: clean the acceptance detail of every execution that PASSED
+   * and settled but whose cleanup did not finish (a crash, a failed write, a
+   * Host killed mid-cleanup).
+   *
+   * The same bounds as any other cleanup apply — only a real pass record on a
+   * settled execution is touched — so this can never delete material belonging
+   * to an execution that did not pass, and never a user file.
+   */
+  private cleanupPendingAcceptanceDetail(): void {
+    for (const task of this.ledger.allTasks()) {
+      for (const execution of task.executions) {
+        if (execution.endedAt === undefined) continue
+        if (execution.result !== 'succeeded') continue
+        this.cleanupAcceptanceDetail(task.id, execution.id)
+      }
+    }
   }
 
   private noteUnreadableInspection(execution: OpenExecutionReference, reason: string | undefined): void {
@@ -717,10 +938,16 @@ export class TaskBoardHostService {
     }
     const before = this.statusMap()
     for (const schedule of this.ledger.dueSchedules(now)) {
-      const next = nextRunAtMs(schedule.cron, schedule.nextRunAt, schedule.timeZone)
+      // The ledger owns both the budget gate and the next target: it refuses a
+      // rule that already spent its runs and stops a one-shot as it fires.
       this.dispatchRuns(
-        this.ledger.openScheduled(schedule.taskId, next, now),
-        { triggeredAt: now, timeZone: schedule.timeZone, cron: schedule.cron },
+        this.ledger.openScheduled(schedule.taskId, now),
+        {
+          triggeredAt: now,
+          timeZone: schedule.timeZone,
+          mode: schedule.mode,
+          ...(schedule.cron === undefined ? {} : { cron: schedule.cron }),
+        },
       )
     }
     this.emitStatusChanges(before)
@@ -769,11 +996,47 @@ export class TaskBoardHostService {
   private schedulePoll(): void {
     if (this.pollInFlight || this.disposed) return
     this.pollInFlight = true
-    void this.pollSessions().catch(error => {
+    void this.pollSessions().then((rosterReadable) => {
+      // A pass that could not read the roster is a failure even though it
+      // resolved: the board knows no more about its sessions than before.
+      if (rosterReadable) this.consecutivePollFailures = 0
+      else this.notePollFailure()
+    }).catch(error => {
+      this.notePollFailure()
       safeConsoleError('[dsh-task-board] session polling failed', error)
     }).finally(() => { this.pollInFlight = false })
   }
 
+  /**
+   * Count one failed pass and arm the retry that follows it.
+   *
+   * A session tree that is down is retried on a doubling delay instead of
+   * hammering it on the fixed cadence: the heartbeat would otherwise repeat
+   * every failure — and every retry inside {@link HostExecutionRunner.listRunning}
+   * — at exactly the interval the reporter measured.
+   */
+  private notePollFailure(): void {
+    this.consecutivePollFailures += 1
+    this.armPollBackoff()
+  }
+
+  /** Arm the retry that follows a failed pass, doubling up to the ceiling. */
+  private armPollBackoff(): void {
+    if (this.disposed) return
+    this.pollBackoffTimer?.()
+    const delay = Math.min(sessionPollMs(this.sessionPollSeconds) * 2 ** Math.min(this.consecutivePollFailures, 8), POLL_FAILURE_MAX_BACKOFF_MS)
+    this.pollBackoffTimer = this.timers.timeout(() => {
+      this.pollBackoffTimer = undefined
+      this.schedulePoll()
+    }, delay)
+  }
+
+  /** Drop a pending retry; the next regular tick takes over. */
+  private clearPollBackoff(): void {
+    this.pollBackoffTimer?.()
+    this.pollBackoffTimer = undefined
+  }
+
   /**
    * Re-arm from the ledger's current targets. Callers that just changed a
    * schedule (the host routes, the agent tools) invoke this after the write