@linxin666/dsh-client-ui-task-board 0.4.5 → 0.4.6

package/src/index.ts

@@ -21,6 +21,17 @@ import { TaskBoardHostService, type HostTimerFace, type TaskBoardTeamDispatcher
 import { parseTaskDraft, TaskParseError } from './host-ai.ts'
 import { TASK_PERMISSIONS, isTaskPermission, type TaskPermission } from './core/tasks.ts'
 import { DEFAULT_SUBTASK_DEPTH, SUBTASK_DEPTH_MAX, SUBTASK_DEPTH_MIN } from './core/subtask.ts'
+import { DEFAULT_SESSION_POLL_SECONDS, SESSION_POLL_MAX_SECONDS, SESSION_POLL_MIN_SECONDS } from './core/poll-cadence.ts'
+import {
+  DEFAULT_VERIFICATION_BUDGET_SECONDS,
+  DEFAULT_VERIFICATION_CALL_TIMEOUT_SECONDS,
+  VERIFICATION_BUDGET_MAX_SECONDS,
+  VERIFICATION_BUDGET_MIN_SECONDS,
+  VERIFICATION_CALL_TIMEOUT_MAX_SECONDS,
+  VERIFICATION_CALL_TIMEOUT_MIN_SECONDS,
+  verificationBudgetMs,
+  verificationCallTimeoutMs,
+} from './core/verification-budget.ts'
 import { DEFAULT_SESSION_PERMISSION } from './core/handover.ts'
 import { buildTaskBoardTools, TASK_BOARD_TOOL_NAMES } from './host/agent-tools.ts'
 import { PLUGIN_TOOL_SECTION_ORDERS, visibleToolText } from './tool-surface.ts'
@@ -88,12 +99,35 @@ export interface Config {
    * of the root task opens, so the ceiling is deliberately small.
    */
   maxSubtaskDepth?: Volatile<number>
+  /**
+   * How often, in seconds, the Host re-reads the DSH session roster while the
+   * board has something to reconcile: a running card, an open execution, or an
+   * active provider extension. An idle board with none of those does not poll
+   * at all, so this cadence only bounds how quickly a running card settles.
+   */
+  sessionPollSeconds?: Volatile<number>
   /**
    * Continuable-subagent provider the Agent Teams service uses to compose a
    * teammate. Matches the Agent Teams tool plugin's `freshProvider` default;
    * only team-mode runs use it.
    */
   teamProvider?: string
+  /**
+   * GLOBAL native /goal switch (default OFF), the master control over whether
+   * this board starts a run with dsh's built-in /goal at all. A run uses native
+   * /goal only when THIS is on AND the task's own `goalRun` is not off; while
+   * it is off every task runs one plain turn.
+   *
+   * The value is frozen when an execution starts, so toggling it only affects
+   * executions that begin afterwards and never re-writes a task's stored
+   * `goalRun` preference. A run that consequently does not execute native
+   * /goal is marked as such (its acceptance applicability is `goal-disabled`)
+   * and is never reported as a passed goal acceptance or failed for lacking a
+   * completion call. Independent of `goalVerification`; acceptance governs the
+   * completing call of a goal-form run, this switch governs whether the run
+   * becomes a goal run.
+   */
+  goalRunEnabled?: Volatile<boolean>
   /**
    * Goal acceptance for executions this board starts (default ON). When on,
    * update_goal(action: complete) inside a task execution is refused until an
@@ -119,6 +153,23 @@ export interface Config {
    * sent, and the fallback to the model's own default is reported.
    */
   goalVerificationReasoningEffort?: Volatile<string>
+  /**
+   * Ceiling of ONE judge request of a goal acceptance, in seconds
+   * (30..600, default 150). One acceptance issues six judge requests (three
+   * criteria times two rounds), so a ceiling that is too small turns a slow but
+   * healthy judge route into a wall of timeouts, and every timeout was charged
+   * as an acceptance anomaly. Raise it for a reasoning model reading a long
+   * trace.
+   */
+  goalVerificationCallTimeoutSeconds?: Volatile<number>
+  /**
+   * Total ceiling of ONE goal acceptance attempt, in seconds (120..1800,
+   * default eight times the per-call default). Keep it at or above
+   * `goalVerificationCallTimeoutSeconds` times six or an acceptance can never
+   * finish: the attempt then ends early with a budget stop that judges nothing
+   * and spends no acceptance budget.
+   */
+  goalVerificationBudgetSeconds?: Volatile<number>
 }
 
 /**
@@ -152,14 +203,22 @@ export interface ConfigInput {
   sessionDefaultPermission?: TaskPermission
   /** Subtask depth limit, 1..3. */
   maxSubtaskDepth?: number
+  /** Roster-poll cadence in seconds while the board has work to reconcile. */
+  sessionPollSeconds?: number
   /** Continuable-subagent provider the Agent Teams service composes a teammate from. */
   teamProvider?: string
+  /** Global native /goal switch; default off, frozen per execution. */
+  goalRunEnabled?: boolean
   /** Goal acceptance switch. */
   goalVerification?: boolean
   /** Judge model route for goal acceptance; blank inherits the host default. */
   goalVerificationModel?: string
   /** Judge reasoning effort; blank inherits the host default. */
   goalVerificationReasoningEffort?: string
+  /** Ceiling of one judge request of a goal acceptance, in seconds. */
+  goalVerificationCallTimeoutSeconds?: number
+  /** Total ceiling of one goal acceptance attempt, in seconds. */
+  goalVerificationBudgetSeconds?: number
 }
 
 export const Config: z<ConfigInput, Config> = z.object({
@@ -170,15 +229,26 @@ export const Config: z<ConfigInput, Config> = z.object({
   proxyTokenEnv: z.string().min(1).default(DEFAULT_PROXY_TOKEN_ENV),
   sessionDefaultPermission: z.union(TASK_PERMISSIONS),
   maxSubtaskDepth: z.number().min(SUBTASK_DEPTH_MIN).max(SUBTASK_DEPTH_MAX).default(DEFAULT_SUBTASK_DEPTH).volatile(),
+  sessionPollSeconds: z.number().min(SESSION_POLL_MIN_SECONDS).max(SESSION_POLL_MAX_SECONDS).default(DEFAULT_SESSION_POLL_SECONDS).volatile(),
   teamProvider: z.string().min(1).default(DEFAULT_TEAM_PROVIDER),
+  goalRunEnabled: z.boolean().default(false).volatile(),
   goalVerification: z.boolean().default(true).volatile(),
   goalVerificationModel: z.string().default('').volatile(),
   goalVerificationReasoningEffort: z.string().default('').volatile(),
+  goalVerificationCallTimeoutSeconds: z.number().min(VERIFICATION_CALL_TIMEOUT_MIN_SECONDS).max(VERIFICATION_CALL_TIMEOUT_MAX_SECONDS).default(DEFAULT_VERIFICATION_CALL_TIMEOUT_SECONDS).volatile(),
+  goalVerificationBudgetSeconds: z.number().min(VERIFICATION_BUDGET_MIN_SECONDS).max(VERIFICATION_BUDGET_MAX_SECONDS).default(DEFAULT_VERIFICATION_BUDGET_SECONDS).volatile(),
 })
 
 /** Schema default for the goal-acceptance switch, re-read for hand-built contexts. */
 export const DEFAULT_GOAL_VERIFICATION = true
 
+/**
+ * Schema default for the GLOBAL native-/goal switch, re-read for hand-built
+ * contexts. Deliberately false: a deployment that never configured it (and
+ * every card written before the option existed) runs plain single turns.
+ */
+export const DEFAULT_GOAL_RUN = false
+
 declare module '@deepseek-ai/cordis' {
   interface Events {
     /**
@@ -419,6 +489,8 @@ function applyImpl(ctx: Context, config?: Config): void {
   const preventIdleSleep = (): boolean => readConfigField(config?.preventIdleSleep, false)
   /** Current subtask depth limit (read live: the settings card edits it in place). */
   const maxSubtaskDepth = (): number => readConfigField(config?.maxSubtaskDepth, DEFAULT_SUBTASK_DEPTH)
+  /** Current roster-poll cadence in seconds (read live: the settings card edits it in place). */
+  const sessionPollSeconds = (): number => readConfigField(config?.sessionPollSeconds, DEFAULT_SESSION_POLL_SECONDS)
   /**
    * The baseline the permission confirmation gate judges against: the row's own
    * `sessionDefaultPermission` when the deployment pins one, otherwise the Host's
@@ -435,6 +507,15 @@ function applyImpl(ctx: Context, config?: Config): void {
     model: readConfigField(config?.goalVerificationModel, ''),
     reasoningEffort: readConfigField(config?.goalVerificationReasoningEffort, ''),
   })
+  /**
+   * The acceptance time ceilings, read live: raising one must unblock a card
+   * whose acceptance is stuck on a slow judge route without a remount, so
+   * these deliberately are NOT frozen into the per-execution contract.
+   */
+  const verificationCallTimeoutMsLive = (): number =>
+    verificationCallTimeoutMs(readConfigField(config?.goalVerificationCallTimeoutSeconds, DEFAULT_VERIFICATION_CALL_TIMEOUT_SECONDS))
+  const verificationBudgetMsLive = (): number =>
+    verificationBudgetMs(readConfigField(config?.goalVerificationBudgetSeconds, DEFAULT_VERIFICATION_BUDGET_SECONDS))
   // The catalog reader needs the service, and the service needs the reader;
   // the reader only runs after start(), so a late holder is enough.
   let hostForCatalog: TaskBoardHostService | undefined
@@ -442,10 +523,17 @@ function applyImpl(ctx: Context, config?: Config): void {
     const runner = hostForCatalog?.runner
     return runner === undefined ? undefined : normalizeCatalog(await runner.modelCatalog())
   }
+  /**
+   * Live reader of the GLOBAL native-/goal switch. The service calls it exactly
+   * once per execution and carries the value, so a settings edit only reaches
+   * executions that start afterwards.
+   */
+  const goalRunEnabled = (): boolean => readConfigField(config?.goalRunEnabled, DEFAULT_GOAL_RUN)
   const host = new TaskBoardHostService(ctx.typertGateway, {
     workspaceRegistry: ctx.workspaceRegistry,
     sessionDefaultPermission,
     maxSubtaskDepth: maxSubtaskDepth(),
+    goalRunEnabled,
     verificationSettings,
     verificationCatalog,
     timers: resolveHostTimers(ctx),
@@ -461,7 +549,7 @@ function applyImpl(ctx: Context, config?: Config): void {
   hostForCatalog = host
   // Configuration before start(): a disabled row must not take the first
   // scheduler tick, which would roll schedules the board is not running.
-  host.setConfiguration(enabled(), preventIdleSleep())
+  host.setConfiguration(enabled(), preventIdleSleep(), sessionPollSeconds())
   host.start()
 
   // External providers. The board publishes its registration service so any
@@ -543,6 +631,8 @@ function applyImpl(ctx: Context, config?: Config): void {
         // deployment records it; the acceptance degrades to the trajectory alone
         // when it does not.
         workspaceChanges: () => probeWorkspaceChanges(ctx),
+        callTimeoutMs: verificationCallTimeoutMsLive,
+        budgetMs: verificationBudgetMsLive,
         logger: {
           warn: (message: string, ...rest: unknown[]) => {
             const logger = (ctx as { logger?: { warn?: (...args: unknown[]) => void } }).logger
@@ -586,7 +676,7 @@ function applyImpl(ctx: Context, config?: Config): void {
   }, 'task-board: host ledger, scheduler, and routes')
 
   let disposeSection: (() => void) | undefined
-  let applied: { enabled: boolean; announceToAgent: boolean; preventIdleSleep: boolean; maxSubtaskDepth: number } | undefined
+  let applied: { enabled: boolean; announceToAgent: boolean; preventIdleSleep: boolean; maxSubtaskDepth: number; sessionPollSeconds: number } | undefined
 
   // Apply the current values to the host service and the announcement. A
   // commit that changes nothing visible is a no-op, so following a coarse
@@ -594,13 +684,19 @@ function applyImpl(ctx: Context, config?: Config): void {
   // under one disposer: re-registering first tears the old one down so a
   // duplicate-name registration never throws.
   const sync = (): void => {
-    const next = { enabled: enabled(), announceToAgent: announceToAgent(), preventIdleSleep: preventIdleSleep(), maxSubtaskDepth: maxSubtaskDepth() }
-    if (applied !== undefined && applied.enabled === next.enabled && applied.announceToAgent === next.announceToAgent && applied.preventIdleSleep === next.preventIdleSleep && applied.maxSubtaskDepth === next.maxSubtaskDepth) {
+    const next = {
+      enabled: enabled(),
+      announceToAgent: announceToAgent(),
+      preventIdleSleep: preventIdleSleep(),
+      maxSubtaskDepth: maxSubtaskDepth(),
+      sessionPollSeconds: sessionPollSeconds(),
+    }
+    if (applied !== undefined && applied.enabled === next.enabled && applied.announceToAgent === next.announceToAgent && applied.preventIdleSleep === next.preventIdleSleep && applied.maxSubtaskDepth === next.maxSubtaskDepth && applied.sessionPollSeconds === next.sessionPollSeconds) {
       return
     }
     applied = next
     host.ledger.setMaxSubtaskDepth(next.maxSubtaskDepth)
-    host.setConfiguration(next.enabled, next.preventIdleSleep)
+    host.setConfiguration(next.enabled, next.preventIdleSleep, next.sessionPollSeconds)
     setToolsEnabled(next.enabled)
     if (disposeSection !== undefined) {
       disposeSection()

package/src/protocol.ts

@@ -1,5 +1,6 @@
 import type { TaskUpdatePatch } from './core/use-cases/task-update.ts'
-import { TAG_NAME_MAX_LENGTH, isTaskPermission, isTaskStatus, isTaskTagList, type NewTaskInput, type TaskPermission, type TaskRecord, type TaskStatus } from './core/tasks.ts'
+import type { SetSchedulePatch } from './core/use-cases/task-schedule.ts'
+import { SCHEDULE_STOP_REASONS, TAG_NAME_MAX_LENGTH, isTaskPermission, isTaskStatus, isTaskTagList, type NewTaskInput, type ScheduleStopReason, type TaskPermission, type TaskRecord, type TaskStatus } from './core/tasks.ts'
 import { parseLedger } from './core/store.ts'
 import { isValidTimeZone } from './core/schedule.ts'
 import { sanitizeFreezeSnapshot, type FreezeSnapshot } from './core/freeze-snapshot.ts'
@@ -10,26 +11,42 @@ import { normalizeVerification, type ModelCatalogView, type VerificationContract
 /** Freeze payload carried by create/update actions after the gate (redacted in place). */
 type FreezePayload = FreezeSnapshot & { redacted?: boolean; frozenBy?: string }
 
-export const TASK_BOARD_SCHEMA_VERSION = 5 as const
-/** Ledger documents written before v5; loaded once and migrated on startup. */
-export const TASK_BOARD_LEGACY_SCHEMA_VERSION = 4 as const
+export const TASK_BOARD_SCHEMA_VERSION = 6 as const
+/** Ledger documents written before v6; loaded once and migrated on startup. */
+export const TASK_BOARD_LEGACY_SCHEMA_VERSION = 5 as const
+/** Ledger documents written before v5; migrated through the v5 normalization too. */
+export const TASK_BOARD_PRE_ACCEPTANCE_SCHEMA_VERSION = 4 as const
 /** Ledger documents written before v4; migrated through the v4 normalization too. */
 export const TASK_BOARD_OLDER_SCHEMA_VERSION = 3 as const
 /** Ledger documents written before v3; migrated through every later normalization too. */
 export const TASK_BOARD_OLDEST_SCHEMA_VERSION = 2 as const
 /**
- * Every older generation the loader migrates in place. v5 only ADDS the
- * per-execution acceptance block, so the migration is the normalization pass
- * that re-validates each row; a document from any listed generation upgrades
- * losslessly.
+ * The last generation whose rules still need the Host zone stamped on them at
+ * migration: v4 introduced the stored zone but a rule written without one must
+ * stop following a later TZ change. A v5 rule already carries its zone (or
+ * deliberately follows the Host), so it is NOT stamped again.
+ */
+export const TASK_BOARD_ZONE_STAMP_SCHEMA_VERSION = 4 as const
+/**
+ * Every older generation the loader migrates in place. v5 only added the
+ * per-execution acceptance block and v6 only added the scheduling mode and run
+ * budget, so the migration is the normalization pass that re-validates each
+ * row; a document from any listed generation upgrades losslessly.
  */
 export const TASK_BOARD_MIGRATABLE_SCHEMA_VERSIONS: readonly number[] = [
   TASK_BOARD_LEGACY_SCHEMA_VERSION,
+  TASK_BOARD_PRE_ACCEPTANCE_SCHEMA_VERSION,
   TASK_BOARD_OLDER_SCHEMA_VERSION,
   TASK_BOARD_OLDEST_SCHEMA_VERSION,
 ]
 export const TASK_BOARD_API_PREFIX = '/api/task-board'
 
+/** Longest accepted caller identity on an external outcome record. */
+export const EXTERNAL_INITIATOR_MAX_LENGTH = 200
+
+/** Longest accepted free-text summary on an external outcome record. */
+export const EXTERNAL_SUMMARY_MAX_LENGTH = 1_000
+
 export type PowerPhase = 'disabled' | 'idle' | 'acquiring' | 'active' | 'error' | 'unsupported'
 
 export interface TaskBoardPowerSnapshot {
@@ -68,6 +85,14 @@ export interface TaskBoardSnapshot {
    * into team execution (Team Lead session plus one teammate per subtask).
    */
   teamRunAvailable?: boolean
+  /**
+   * Live GLOBAL native-/goal switch. The browser uses it to disable the
+   * task-level option (and explain that the global switch must be turned on
+   * first) WITHOUT rewriting anyone's stored per-task preference; the Host
+   * freezes its own read per execution, so this mirror never governs a run in
+   * flight.
+   */
+  goalRunEnabled?: boolean
   /**
    * Read-only summaries published by running extensions, keyed by extension id.
    * The board forwards them verbatim; it never interprets their shape.
@@ -139,7 +164,18 @@ export type TaskBoardAction =
   | { kind: 'archive'; taskId: string }
   | { kind: 'restore'; taskId: string }
   | { kind: 'settle'; taskId: string }
-  | { kind: 'set-schedule'; taskId: string; patch: { enabled?: boolean; cron?: string; timeZone?: string | null } }
+  /** Clear the acceptance anomalies recorded on a card's open execution (issue #1828). */
+  | { kind: 'reset-verification'; taskId: string }
+  /**
+   * Record an outcome an agent OUTSIDE the Host produced (issue #1826).
+   *
+   * It writes a real execution record, so the terminal column and the run
+   * history both derive from that one record instead of a bare column edit.
+   * `cancelled` is deliberately absent: nothing outside a DSH session may
+   * claim the Host closed a run, and `running` must stay Host-only.
+   */
+  | { kind: 'record-external-outcome'; taskId: string; result: 'succeeded' | 'failed'; initiatedBy: string; summary?: string }
+  | { kind: 'set-schedule'; taskId: string; patch: SetSchedulePatch }
   | { kind: 'run'; taskId: string }
   | { kind: 'rerun'; taskId: string }
   | { kind: 'confirm-permission'; taskId: string }
@@ -187,19 +223,48 @@ function optionalFiniteNumber(value: unknown): boolean {
   return value === undefined || (typeof value === 'number' && Number.isFinite(value))
 }
 
+/** Whether a stop-reason field names a reason this build understands. */
+function validStopReason(value: unknown): boolean {
+  return value === undefined || (typeof value === 'string' && SCHEDULE_STOP_REASONS.includes(value as ScheduleStopReason))
+}
+
+/**
+ * Whether an imported schedule rule is structurally usable. A one-shot must
+ * carry its planned instant and a recurring rule its cron expression; the
+ * counter and stop record are optional (a rule written before them simply has
+ * none), but a value that IS present must be usable so the import cannot smuggle
+ * a rule the scheduler would misread.
+ */
+function validImportedSchedule(value: unknown): boolean {
+  const schedule = record(value)
+  if (schedule === undefined || typeof schedule.enabled !== 'boolean') return false
+  if (schedule.mode !== undefined && schedule.mode !== 'cron' && schedule.mode !== 'once') return false
+  if (schedule.mode === 'once') {
+    if (typeof schedule.at !== 'number' || !Number.isFinite(schedule.at)) return false
+  } else if (typeof schedule.cron !== 'string') {
+    return false
+  }
+  if (schedule.cron !== undefined && typeof schedule.cron !== 'string') return false
+  if (schedule.at !== undefined && (typeof schedule.at !== 'number' || !Number.isFinite(schedule.at))) return false
+  if (schedule.maxRuns !== undefined
+    && (typeof schedule.maxRuns !== 'number' || !Number.isInteger(schedule.maxRuns) || schedule.maxRuns < 1)) return false
+  if (schedule.runCount !== undefined
+    && (typeof schedule.runCount !== 'number' || !Number.isInteger(schedule.runCount) || schedule.runCount < 0)) return false
+  if (!optionalFiniteNumber(schedule.nextRunAt) || !optionalFiniteNumber(schedule.lastTriggeredAt)) return false
+  if (!optionalFiniteNumber(schedule.endedAt) || !optionalFiniteNumber(schedule.skippedAt)) return false
+  if (!validStopReason(schedule.endedReason) || !validStopReason(schedule.skippedReason)) return false
+  if (schedule.timeZone !== undefined
+    && (typeof schedule.timeZone !== 'string' || !isValidTimeZone(schedule.timeZone))) return false
+  return true
+}
+
 function validImportedKnownFields(value: Record<string, unknown>): boolean {
   // Tags are validated (not repaired) on the import path: an imported task
   // must carry a well-formed list or none at all, so a hand-edited export
   // cannot smuggle a malformed tag past the gate.
   if (value.tags !== undefined && !isTaskTagList(value.tags)) return false
   if (value.integrations !== undefined && normalizeTaskIntegrations(value.integrations) === undefined) return false
-  if (value.schedule !== undefined) {
-    const schedule = record(value.schedule)
-    if (schedule === undefined || typeof schedule.enabled !== 'boolean' || typeof schedule.cron !== 'string') return false
-    if (!optionalFiniteNumber(schedule.nextRunAt) || !optionalFiniteNumber(schedule.lastTriggeredAt)) return false
-    if (schedule.timeZone !== undefined
-      && (typeof schedule.timeZone !== 'string' || !isValidTimeZone(schedule.timeZone))) return false
-  }
+  if (value.schedule !== undefined && !validImportedSchedule(value.schedule)) return false
   if (value.executions !== undefined) {
     if (!Array.isArray(value.executions)) return false
     for (const item of value.executions) {
@@ -209,6 +274,10 @@ function validImportedKnownFields(value: Record<string, unknown>): boolean {
       if (!optionalFiniteNumber(execution.endedAt) || !optionalString(execution.error)) return false
       if (execution.result !== undefined && !['succeeded', 'failed', 'cancelled'].includes(String(execution.result))) return false
       if (execution.initiatedBy !== undefined && typeof execution.initiatedBy !== 'string') return false
+      // An imported external marker is accepted (it is a declaration an
+      // operator made about their own board), but it is still just a boolean:
+      // the acceptance block below is what must never arrive from an import.
+      if (execution.external !== undefined && typeof execution.external !== 'boolean') return false
       if (execution.frozenBy !== undefined && typeof execution.frozenBy !== 'string') return false
       if (execution.frozenAt !== undefined && typeof execution.frozenAt !== 'number') return false
       // A well-formed acceptance block may be imported for inspection, but the
@@ -241,20 +310,17 @@ function importedTask(value: unknown): TaskRecord | undefined {
       result: execution.result,
       error: execution.error,
       ...(execution.initiatedBy === undefined ? {} : { initiatedBy: execution.initiatedBy }),
+      ...(execution.external === true ? { external: true } : {}),
       ...(execution.frozenAt === undefined ? {} : { frozenAt: execution.frozenAt }),
       ...(execution.frozenBy === undefined ? {} : { frozenBy: execution.frozenBy }),
       // 安全门（对抗场景 d）：验收报告是 Host 的判定，不接受 import 携带——
       // 一条伪造的通过记录会让导入的执行被当成已验收。
     })),
-    ...(task.schedule === undefined ? {} : {
-      schedule: {
-        enabled: task.schedule.enabled,
-        cron: task.schedule.cron,
-        ...(task.schedule.timeZone === undefined ? {} : { timeZone: task.schedule.timeZone }),
-        nextRunAt: task.schedule.nextRunAt,
-        lastTriggeredAt: task.schedule.lastTriggeredAt,
-      },
-    }),
+    // The rule was already reconstructed field by field by parseLedger (which
+    // is what drops an unknown or malformed field), so the import keeps that
+    // normalized shape: mode, planned instant, run counter and stop record all
+    // travel with it.
+    ...(task.schedule === undefined ? {} : { schedule: { ...task.schedule } }),
     // The lineage link rides the import; the Host repairs a link whose parent
     // is missing from the merged ledger instead of trusting the export.
     ...(task.parentId === undefined ? {} : { parentId: task.parentId }),
@@ -321,8 +387,13 @@ function createInput(value: unknown): value is NewTaskInput {
   if (input.handover !== undefined && handoverPayload(input.handover) === undefined) return false
   if (input.schedule !== undefined) {
     const schedule = record(input.schedule)
-    if (schedule === undefined || !exactKeys(schedule, ['enabled', 'cron', 'timeZone'])) return false
-    if (typeof schedule.enabled !== 'boolean' || typeof schedule.cron !== 'string') return false
+    if (schedule === undefined || !exactKeys(schedule, ['enabled', 'mode', 'cron', 'at', 'timeZone', 'maxRuns'])) return false
+    if (typeof schedule.enabled !== 'boolean') return false
+    if (schedule.mode !== undefined && schedule.mode !== 'cron' && schedule.mode !== 'once') return false
+    if (schedule.cron !== undefined && typeof schedule.cron !== 'string') return false
+    if (schedule.at !== undefined && (typeof schedule.at !== 'number' || !Number.isInteger(schedule.at))) return false
+    if (schedule.maxRuns !== undefined
+      && (typeof schedule.maxRuns !== 'number' || !Number.isInteger(schedule.maxRuns) || schedule.maxRuns < 1)) return false
     if (schedule.timeZone !== undefined
       && (typeof schedule.timeZone !== 'string' || !isValidTimeZone(schedule.timeZone))) return false
   }
@@ -365,13 +436,21 @@ function isTagName(value: unknown): value is string {
 function schedulePatch(value: unknown): boolean {
   const patch = record(value)
   return patch !== undefined
-    && exactKeys(patch, ['enabled', 'cron', 'timeZone'])
+    && exactKeys(patch, ['enabled', 'mode', 'cron', 'at', 'timeZone', 'maxRuns'])
     && (patch.enabled === undefined || typeof patch.enabled === 'boolean')
+    && (patch.mode === undefined || patch.mode === 'cron' || patch.mode === 'once')
     && (patch.cron === undefined || typeof patch.cron === 'string')
+    // A one-shot's planned instant is a whole millisecond: a fractional or
+    // non-numeric value would make the armed target ambiguous.
+    && (patch.at === undefined || (typeof patch.at === 'number' && Number.isInteger(patch.at)))
     // `null` clears the stored zone back to the Host zone; an unknown name is
     // rejected here so the Host never has to guess at an unusable zone.
     && (patch.timeZone === undefined || patch.timeZone === null
       || (typeof patch.timeZone === 'string' && isValidTimeZone(patch.timeZone)))
+    // `null` clears the run cap back to unlimited; any other value must be a
+    // positive whole number of runs.
+    && (patch.maxRuns === undefined || patch.maxRuns === null
+      || (typeof patch.maxRuns === 'number' && Number.isInteger(patch.maxRuns) && patch.maxRuns >= 1))
 }
 
 export function parseActionEnvelope(value: unknown): TaskBoardActionEnvelope | undefined {
@@ -472,11 +551,36 @@ function parseEnvelopeAction(value: unknown): TaskBoardActionEnvelope | undefine
         },
       }
     }
+    case 'record-external-outcome': {
+      if (!exactKeys(action, ['kind', 'taskId', 'result', 'initiatedBy', 'summary'])) return undefined
+      if (taskId === undefined) return undefined
+      // Only a real outside verdict is accepted: `running` is Host-only and
+      // `cancelled` is the Host's own bookkeeping for a run it closed.
+      if (action.result !== 'succeeded' && action.result !== 'failed') return undefined
+      if (typeof action.initiatedBy !== 'string') return undefined
+      const initiatedBy = action.initiatedBy.trim()
+      // The caller must be identifiable: an unattributed external outcome is
+      // the same 'state without history' the record exists to avoid.
+      if (initiatedBy === '' || initiatedBy.length > EXTERNAL_INITIATOR_MAX_LENGTH) return undefined
+      if (action.summary !== undefined && typeof action.summary !== 'string') return undefined
+      const summary = typeof action.summary === 'string' ? action.summary.trim().slice(0, EXTERNAL_SUMMARY_MAX_LENGTH) : ''
+      return {
+        requestId: envelope.requestId,
+        action: {
+          kind: 'record-external-outcome',
+          taskId,
+          result: action.result,
+          initiatedBy,
+          ...(summary === '' ? {} : { summary }),
+        },
+      }
+    }
     case 'confirm-permission':
     case 'delete':
     case 'archive':
     case 'restore':
     case 'settle':
+    case 'reset-verification':
     case 'run':
     case 'rerun':
       if (!exactKeys(action, ['kind', 'taskId'])) return undefined

package/lib/invariant.js

@@ -1,6 +0,0 @@
-//#region src/invariant.ts
-/** Invariant companion plugin (no assertions — nothing to check at runtime). */
-/** Provides no assertions: the board owns no cross-package runtime invariants. */
-function apply() {}
-//#endregion
-export { apply };

package/lib/types/client/board-card-seat.d.ts

@@ -1,34 +0,0 @@
-/**
- * Board-owned variant of the family plugin-card seat that can declare child
- * slots on the registration.
- *
- * The shared `installPluginCard` helper owns seat selection but cannot forward
- * a `children` declaration, and the task board's settings card declares the
- * `task-board.settings.section` seat a provider renders into. This wrapper
- * reuses the shared seat decision (`familyGroupLoaded` and the two seat keys)
- * and adds the declaration; it should collapse back into the shared helper once
- * that helper accepts children.
- *
- * @module dsh-task-board/client/board-card-seat
- */
-import { type PluginCardContext } from './plugin-card-seat.ts';
-/** One board card contribution, with the child seats it declares. */
-export interface BoardCardSeat {
-    bundle: string;
-    id: string;
-    order?: number;
-    label?: () => string;
-    locale: string;
-    /** Child slots this entry declares and renders. */
-    children: Record<string, unknown>;
-    inject?: () => object;
-    component: unknown;
-}
-/**
- * Contribute the board's settings card to the seat this host renders, declaring
- * the child slots it owns. Mirrors the shared helper's reconcile discipline: the
- * entry moves when the family group appears, and is never in two seats at once.
- * @param ctx - client context (its slot registry decides the seat).
- * @param seat - the card contribution and its children declaration.
- */
-export declare function installBoardCard(ctx: PluginCardContext, seat: BoardCardSeat): void;

package/lib/types/invariant.d.ts

@@ -1,3 +0,0 @@
-/** Invariant companion plugin (no assertions — nothing to check at runtime). */
-/** Provides no assertions: the board owns no cross-package runtime invariants. */
-export declare function apply(): void;

package/src/client/board-card-seat.ts

@@ -1,102 +0,0 @@
-/**
- * Board-owned variant of the family plugin-card seat that can declare child
- * slots on the registration.
- *
- * The shared `installPluginCard` helper owns seat selection but cannot forward
- * a `children` declaration, and the task board's settings card declares the
- * `task-board.settings.section` seat a provider renders into. This wrapper
- * reuses the shared seat decision (`familyGroupLoaded` and the two seat keys)
- * and adds the declaration; it should collapse back into the shared helper once
- * that helper accepts children.
- *
- * @module dsh-task-board/client/board-card-seat
- */
-import {
-  FAMILY_PLUGIN_CARD_SEAT,
-  OFFICIAL_PLUGIN_CARD_SEAT,
-  familyGroupLoaded,
-  type PluginCardContext,
-} from './plugin-card-seat.ts'
-
-/** One board card contribution, with the child seats it declares. */
-export interface BoardCardSeat {
-  bundle: string
-  id: string
-  order?: number
-  label?: () => string
-  locale: string
-  /** Child slots this entry declares and renders. */
-  children: Record<string, unknown>
-  inject?: () => object
-  component: unknown
-}
-
-function warnRefusedSeat(seat: string, error: unknown): void {
-  try {
-    console.warn(`[dsh-web] plugin card registration into "${seat}" was refused; the card will not render`, error)
-  } catch {
-    // Best-effort console write; a failed warning must not break the plugin.
-  }
-}
-
-/**
- * Contribute the board's settings card to the seat this host renders, declaring
- * the child slots it owns. Mirrors the shared helper's reconcile discipline: the
- * entry moves when the family group appears, and is never in two seats at once.
- * @param ctx - client context (its slot registry decides the seat).
- * @param seat - the card contribution and its children declaration.
- */
-export function installBoardCard(ctx: PluginCardContext, seat: BoardCardSeat): void {
-  const slots = ctx.slots
-  const component = seat.component as never
-  const inject = seat.inject as never
-
-  let dispose: (() => void) | undefined
-  let current: string | undefined
-  let reconciling = false
-
-  const reconcile = (): void => {
-    if (reconciling) return
-    const target = familyGroupLoaded(ctx) ? FAMILY_PLUGIN_CARD_SEAT : OFFICIAL_PLUGIN_CARD_SEAT
-    if (current === target) return
-    reconciling = true
-    const previous = dispose
-    dispose = undefined
-    current = undefined
-    previous?.()
-    try {
-      dispose = slots.register((target === FAMILY_PLUGIN_CARD_SEAT
-        ? {
-          name: FAMILY_PLUGIN_CARD_SEAT,
-          id: seat.id,
-          ...(seat.order === undefined ? {} : { order: seat.order }),
-          ...(seat.label === undefined ? {} : { label: seat.label }),
-          locale: seat.locale,
-          children: seat.children,
-          ...(seat.inject === undefined ? {} : { inject }),
-        }
-        : {
-          name: OFFICIAL_PLUGIN_CARD_SEAT,
-          key: seat.bundle,
-          locale: seat.locale,
-          children: seat.children,
-          ...(seat.inject === undefined ? {} : { inject }),
-        }) as never, component) as () => void
-      current = target
-    } catch (error) {
-      warnRefusedSeat(target, error)
-    } finally {
-      reconciling = false
-    }
-  }
-
-  if (typeof ctx.on === 'function') {
-    try {
-      ctx.on('slots/changed', () => { reconcile() })
-    } catch {
-      // An event seat that refuses the subscription leaves the initial
-      // decision in place; the card still renders in the seat chosen below.
-    }
-  }
-  reconcile()
-}

package/src/invariant.ts

@@ -1,4 +0,0 @@
-/** Invariant companion plugin (no assertions — nothing to check at runtime). */
-
-/** Provides no assertions: the board owns no cross-package runtime invariants. */
-export function apply(): void {}