@linxin666/dsh-client-ui-task-board 0.4.5 → 0.4.6

package/lib/types/host-ledger.d.ts

@@ -1,6 +1,6 @@
-import { type ExecutionOutcome, type ExecutionRecord, type TaskRecord } from './core/tasks.ts';
+import { type ExecutionOutcome, type ExecutionRecord, type ScheduleMode, type TaskRecord } from './core/tasks.ts';
 import { type TaskBoardAction, type TaskBoardSchedulerSnapshot } from './protocol.ts';
-import type { ExecutionVerification } from './core/verification.ts';
+import { type ExecutionVerification } from './core/verification.ts';
 import { type TaskPermission } from './core/handover.ts';
 export interface LedgerState {
     revision: number;
@@ -35,7 +35,10 @@ export interface OpenExecutionReference {
 /** Minimal value copy used by the Host scheduler. */
 export interface DueScheduleReference {
     readonly taskId: string;
-    readonly cron: string;
+    /** Whether this due rule is a recurring cron rule or a single planned instant. */
+    readonly mode: ScheduleMode;
+    /** Cron expression of a recurring rule; absent on a one-shot. */
+    readonly cron?: string;
     /** Zone this rule's wall clock is read in. */
     readonly timeZone: string;
     readonly nextRunAt: number;
@@ -44,6 +47,24 @@ export interface DueScheduleReference {
 export interface LedgerRuntimeView {
     readonly armedSchedules: number;
     readonly openExecutions: readonly OpenExecutionReference[];
+    /**
+     * Session ids of every open execution, including the ones
+     * {@link openExecutions} skips because their own outcome is already
+     * recorded. A caller that asks whether the board still observes any session
+     * must use this list: a deferred cascade parent is settled by its members,
+     * but it is still an open execution.
+     */
+    readonly openSessionIds: readonly string[];
+    /**
+     * Whether this document holds anything the session roster can still decide:
+     * an open execution that needs inspecting, or a card in the running column
+     * whose verdict may arrive from a settle this process never saw.
+     *
+     * A board with no running card, no open execution and no armed schedule has
+     * no use for the roster at all, which is what lets the Host poll stand down
+     * instead of re-reading every persisted session forever.
+     */
+    readonly needsSessionState: boolean;
 }
 /**
  * Best-effort single-letter process state ('R','S','D','Z',...) or undefined
@@ -125,7 +146,7 @@ export declare class HostTaskLedger {
     };
     state(): LedgerState;
     /**
-     * Runtime-only projection for the 5 s Host poll. It copies just primitive
+     * Runtime-only projection for the Host poll. It copies just primitive
      * identifiers and timestamps, never the complete task/execution history or
      * an authoritative mutable object from the ledger.
      */
@@ -152,9 +173,45 @@ export declare class HostTaskLedger {
     /**
      * Open the cascade one due schedule triggers: an empty array means nothing
      * ran (already running, or a participant whose elevated permission is still
-     * unconfirmed), and the rule rolls to its next occurrence either way.
+     * unconfirmed, a one-shot whose instant was missed, or an exhausted budget),
+     * and the rule's own state says which.
+     *
+     * The run budget is enforced HERE, inside the single ledger writer: a rule
+     * whose counter already reached its cap is stopped instead of opened, so no
+     * restart, repeated timer fire or re-arm can overrun it.
+     * @param taskId - the task whose rule came due.
+     * @param triggeredAt - the instant the occurrence came due.
+     * @returns the executions this occurrence opened.
+     */
+    openScheduled(taskId: string, triggeredAt: number): OpenedRun[];
+    /**
+     * Record a due occurrence that opened no execution: roll a recurring rule to
+     * its next occurrence (budget untouched), or stop it when there is none. A
+     * one-shot has no second occurrence, so it always stops here with the reason.
+     */
+    private skipOccurrence;
+    /** Apply a schedule-occurrence transition and persist it atomically. */
+    private progressSchedule;
+    /**
+     * Refund the one scheduled run an occurrence consumed before its launch
+     * failed without creating a session (see
+     * {@link applyScheduleRefund}). Called by the service on the failed-launch
+     * path only; a manual run and a launch that did reach a session are never
+     * refunded. A no-op for a task with no rule, so a failed cascade member does
+     * not touch anything.
+     * @param taskId - the task whose occurrence is being refunded.
+     * @param now - clock instant (ms epoch).
+     */
+    refundScheduledOccurrence(taskId: string, now: number): void;
+    /**
+     * Boot / resume recovery: skip every occurrence that came due while the board
+     * was not running through it. A recurring rule rolls to its next future
+     * target; a one-shot whose instant has passed is stopped as missed, because
+     * there is no later occurrence left to run. Rendering the missed occurrence
+     * is deliberately not attempted: the ACL of a card that fired hours ago is
+     * stale, and the board's own recovery contract is "missed triggers are
+     * skipped, never replayed".
      */
-    openScheduled(taskId: string, nextRunAt: number | undefined, triggeredAt: number): OpenedRun[];
     skipMissed(now: number): void;
     setScheduler(patch: Partial<TaskBoardSchedulerSnapshot>): void;
     /**
@@ -169,6 +226,14 @@ export declare class HostTaskLedger {
     getTask(id: string): TaskRecord | undefined;
     saveTaskRecord(task: TaskRecord): void;
     private apply;
+    /**
+     * Whether a creation-time schedule request is usable. A one-shot must carry
+     * a whole-millisecond instant in the future; a recurring rule must carry a
+     * valid expression with a reachable occurrence and, when capped, a positive
+     * whole run budget. An unusable zone is refused rather than reinterpreted as
+     * the Host zone.
+     */
+    private validScheduleRequest;
     /**
      * The binding that makes a run illegal, if any.
      *
@@ -202,7 +267,9 @@ export declare class HostTaskLedger {
      * @param now - clock instant (ms epoch).
      * @param initiator - the DSH session that asked for the run (audit only).
      * @param rerun - true to reset the root to 'todo' before starting it.
-     * @param nextRunAt - when set, the root's schedule also rolls forward.
+     * @param progress - when set, this run was a due occurrence and the root's
+     *   rule is advanced (counter, next target, stop/skip record) in the same
+     *   atomic commit that opened the executions.
      */
     private startCascade;
     /**
@@ -248,6 +315,14 @@ export declare class HostTaskLedger {
      * @returns whether the document changed.
      */
     private closeTeamMembers;
+    /**
+     * Re-align every armed rule at load/import. A recurring rule is recomputed
+     * from the current instant; a one-shot is armed at its planned instant when
+     * that is still in the future, and stopped as missed once it has passed
+     * (there is no later occurrence to run). A recurring rule recomputed past an
+     * occurrence records the skip, so the board can show that a fire was passed
+     * over rather than silently rewinding.
+     */
     private repairSchedules;
     private reconcileInterruptedStarts;
     /**

package/lib/types/host-runner.d.ts

@@ -78,15 +78,16 @@ export interface PromptContext {
     /** True when those members run as teammates inside this session (Team Lead). */
     team?: boolean;
     /**
-     * Scheduled-run provenance: the instant the cron rule actually fired and the
-     * IANA zone its wall clock was read in. Present only for a cron-triggered
-     * run, so the model can resolve an unqualified date in the run's own terms
-     * instead of guessing from the Host clock (issue #1722).
+     * Scheduled-run provenance: the instant the rule actually fired, its kind,
+     * and the IANA zone its wall clock was read in. Present only for a
+     * timer-triggered run, so the model can resolve an unqualified date in the
+     * run's own terms instead of guessing from the Host clock (issue #1722).
      */
     schedule?: {
         triggeredAt: number;
         timeZone: string;
-        cron: string;
+        mode: 'cron' | 'once';
+        cron?: string;
     };
 }
 /**
@@ -144,6 +145,18 @@ export declare class HostExecutionRunner {
         promptContext?: PromptContext;
         onSession?: (sessionId: string) => void;
         onGoalArmed?: (armed: boolean) => void;
+        /**
+         * GLOBAL native /goal switch, resolved by the caller ONCE per execution and
+         * carried here so the decision is frozen for this launch.
+         *
+         * Frozen deliberately: a settings edit made while the run is in flight must
+         * not arm, disarm or otherwise change the goal/acceptance contract of a run
+         * already running. Absent means off — the default for every deployment that
+         * never touched the switch, including cards written before the option
+         * existed. A plain single turn is what an off switch produces; the task-level
+         * `goalRun` still applies on top of it (both must ASK for a goal).
+         */
+        goalEnabled?: boolean;
     }): Promise<string>;
     /**
      * Fail closed when a reused session records a different Agent preset than
@@ -182,11 +195,21 @@ export declare class HostExecutionRunner {
      * dsh's goal-round driver keeps starting continuation rounds until the agent
      * marks it complete (see {@link goalVerdict} for how the run settles).
      *
-     * Opt-out: a task whose `goalRun` is an explicit false runs one plain turn.
+     * Two switches gate the arming, and BOTH must ask for it:
+     * - the GLOBAL native-/goal switch (`goalEnabled`, default OFF), frozen when
+     *   this execution started; and
+     * - the task's own `goalRun` (absent means off, only an explicit true opts
+     *   the card into a goal run).
+     *
      * A refusal (no command dispatcher, no `/goal` command in this cohort, an
-     * objective the command rejects) is reported and the run continues as that
-     * plain turn: the task was asked to run, and a missing goal mode must not
-     * lose the work.
+     * objective the command rejects) is reported and the run continues as a plain
+     * turn: the task was asked to run, and a missing goal mode must not lose the
+     * work.
+     * @param sessionId - the session to arm in.
+     * @param task - the task being run.
+     * @param context - the run's prompt context.
+     * @param goalEnabled - the GLOBAL switch, frozen for this execution.
+     * @returns whether `/goal` was really armed.
      */
     private armGoal;
     /**

package/lib/types/host-service.d.ts

@@ -5,6 +5,7 @@ import { PowerInhibitor } from './power-inhibitor.ts';
 import { type TaskBoardAction, type TaskBoardEventPayload, type TaskBoardSnapshot } from './protocol.ts';
 import { TaskBoardExtensionRegistry } from './host/extension-registry.ts';
 import type { TaskBoardExtension } from './core/extension.ts';
+import type { ScheduleMode } from './core/tasks.ts';
 import { type ModelCatalogView, type VerificationContract, type VerificationSettings } from './core/verification.ts';
 import type { TaskPermission } from './core/handover.ts';
 /** One teammate the Host asks the Agent Teams service to spawn for a team run. */
@@ -34,6 +35,30 @@ export interface TeamSpawnResult {
 export interface TaskBoardTeamDispatcher {
     spawn(input: TeamSpawnInput): Promise<TeamSpawnResult>;
 }
+/**
+ * Why an enforced goal execution settled failed while its acceptance DID run:
+ * attempts were recorded and none of them passed. The judge answered about the
+ * work and the work did not pass.
+ */
+export declare const NO_MATCHING_PASS_VERIFICATION_REASON = "goal \u9A8C\u6536\uFF1A\u672C\u6B21\u6267\u884C\u6CA1\u6709\u5339\u914D\u7684\u9A8C\u6536\u901A\u8FC7\u8BB0\u5F55\uFF08\u9A8C\u6536\u672A\u8FD0\u884C\u3001\u672A\u901A\u8FC7\u6216\u62A5\u544A\u6765\u81EA\u5176\u4ED6\u6267\u884C\uFF09\uFF0C\u6309\u672A\u9A8C\u6536\u5224\u5931\u8D25\u3002";
+/**
+ * Why an enforced goal execution settled failed with ZERO acceptance records:
+ * the gate was never opened, so the judge never ran and nothing was ever judged
+ * (issue #1837). The root cause is a session that declared completion in prose
+ * instead of calling `update_goal(action: complete)` — a tool-adherence problem,
+ * NOT a quality verdict on the delivery — so this reason says so and keeps the
+ * two investigation directions apart.
+ */
+export declare const NEVER_INVOKED_VERIFICATION_REASON = "goal \u9A8C\u6536\u672A\u89E6\u53D1\uFF1A\u672C\u6B21\u6267\u884C\u6CA1\u6709\u4EFB\u4F55\u9A8C\u6536\u8BB0\u5F55\uFF0C\u9A8C\u6536\u95E8\u4ECE\u672A\u6253\u5F00\u2014\u2014\u6267\u884C\u4F1A\u8BDD\u6CA1\u6709\u8C03\u7528 update_goal(action: complete) \u6765\u5B8C\u6210\u76EE\u6807\uFF08\u5E38\u89C1\u4E8E\u53EA\u5728\u56DE\u590D\u91CC\u5BA3\u544A\u5B8C\u6210\uFF09\u3002\u8FD9\u4E0D\u662F\u8D28\u91CF\u5224\u8D1F\uFF1A\u4EA4\u4ED8\u4ECE\u672A\u88AB\u88C1\u5224\u8BC4\u4F30\u3002";
+/**
+ * Why an enforced goal execution settled failed while its ONLY acceptance
+ * records are INVALID: the judge answered but could not locate its own
+ * rejection, so the board stopped calling it. This is NOT an evidence-backed
+ * quality veto — the requirement is explicit that such a run must not be
+ * described as one — but the execution still has no matching pass, so it ends
+ * for lack of one, and the reason names that precisely.
+ */
+export declare const INVALID_ONLY_VERIFICATION_REASON = "goal \u9A8C\u6536\u65E0\u6548\uFF1A\u672C\u6B21\u6267\u884C\u53EA\u8BB0\u5F55\u4E86\u65E0\u6548\u9A8C\u6536\uFF08\u88C1\u5224\u672A\u80FD\u7ED9\u51FA\u4E0E\u4EFB\u52A1\u8981\u6C42\u5BF9\u5E94\u3001\u4E14\u53EF\u5B9A\u4F4D\u5230\u672C\u6B21\u8BC1\u636E\u7684\u5426\u51B3\u4F9D\u636E\uFF09\uFF0C\u770B\u677F\u5DF2\u505C\u6B62\u8C03\u7528\u88C1\u5224\u3002\u8FD9**\u4E0D\u662F**\u6709\u8BC1\u636E\u7684\u8D28\u91CF\u5224\u8D1F\uFF1A\u9A8C\u6536\u672C\u8EAB\u4E0D\u53EF\u7528\uFF0C\u672C\u6B21\u8FD0\u884C\u56E0\u6CA1\u6709\u5339\u914D\u7684\u901A\u8FC7\u8BB0\u5F55\u800C\u7ED3\u675F\u3002\u8BF7\u68C0\u67E5\u9A8C\u6536\u73AF\u5883\u4E0E\u8BC1\u636E\u53EF\u89C1\u6027\uFF0C\u6216\u7528 task_board_manage(action=reset-verification) \u6E05\u9664\u8BB0\u5F55\u7684\u65E0\u6548\u9A8C\u6536\u540E\u91CD\u65B0\u5B8C\u6210\u76EE\u6807\u3002";
 /**
  * Provenance of one cron-triggered cascade: when the rule fired and the zone
  * its wall clock was read in. Passed into every launched prompt of that run so
@@ -42,7 +67,10 @@ export interface TaskBoardTeamDispatcher {
 export interface ScheduledRunContext {
     triggeredAt: number;
     timeZone: string;
-    cron: string;
+    /** Whether this fire came from a recurring rule or a single planned instant. */
+    mode: ScheduleMode;
+    /** Cron expression of a recurring rule; absent on a one-shot. */
+    cron?: string;
 }
 /**
  * The native timer face the Host arms through. The cordis `timer` service
@@ -62,6 +90,12 @@ export declare class TaskBoardHostService {
     private readonly listeners;
     /** The one recurring timer: the session-roster poll. */
     private pollTimer;
+    /** Cadence of the roster poll, in seconds (a settings field; see the config schema). */
+    private sessionPollSeconds;
+    /** Pending delay that follows a failed poll pass, if one is armed. */
+    private pollBackoffTimer;
+    /** Consecutive failed poll passes; doubles the next retry delay. */
+    private consecutivePollFailures;
     /** The armed schedule timer, if a trigger is pending. */
     private scheduleTimer;
     /** The instant the armed schedule timer targets (ms epoch), for resume detection. */
@@ -69,13 +103,6 @@ export declare class TaskBoardHostService {
     private disposed;
     private pollInFlight;
     private active;
-    /**
-     * Ids the last roster poll saw as present and idle; undefined while the
-     * roster is unknown. Session reuse (issue #1419) requires this positive
-     * evidence, so a launch before the first successful poll mints a fresh
-     * conversation instead of prompting into a session it cannot see.
-     */
-    private idleSessionIds;
     /**
      * Consecutive unreadable-history polls per open execution (see
      * {@link noteUnreadableInspection}). Cleared as soon as an inspection
@@ -87,6 +114,8 @@ export declare class TaskBoardHostService {
     private readonly verificationCatalog;
     private readonly team;
     private readonly timers;
+    /** Live reader of the global native-/goal switch; frozen per execution. */
+    private readonly goalRunEnabled;
     private lastPowerJson;
     private readonly now;
     /** The deployment's workspaces, consulted to resolve a card that pins none. */
@@ -111,6 +140,14 @@ export declare class TaskBoardHostService {
         maxSubtaskDepth?: number;
         team?: TaskBoardTeamDispatcher;
         timers?: HostTimerFace;
+        /**
+         * Live GLOBAL native /goal switch (a volatile config read). Read ONCE per
+         * execution, at launch, and carried by value from then on: a settings edit
+         * made while a run is in flight must not arm, disarm or otherwise change the
+         * goal/acceptance contract of that run. Absent means OFF, which is the
+         * default for every deployment that never configured it.
+         */
+        goalRunEnabled?: () => boolean;
         /**
          * Live acceptance settings (volatile config reads). Absent keeps goal
          * acceptance OFF for every execution this service opens, which is what a
@@ -121,7 +158,16 @@ export declare class TaskBoardHostService {
         verificationCatalog?: () => Promise<ModelCatalogView | undefined>;
     });
     start(): void;
-    setConfiguration(active: boolean, preventIdleSleep: boolean): void;
+    /**
+     * Apply the live configuration. The roster cadence is re-read on every
+     * commit, so a settings edit takes effect without a restart; the poll is
+     * scheduled at the new cadence immediately rather than waiting out the old
+     * interval.
+     * @param active - the board's master switch.
+     * @param preventIdleSleep - whether the board holds an idle-sleep assertion.
+     * @param sessionPollSeconds - roster-poll cadence in seconds (clamped).
+     */
+    setConfiguration(active: boolean, preventIdleSleep: boolean, sessionPollSeconds?: number): void;
     snapshot(): TaskBoardSnapshot;
     /**
      * Admit one external provider. Idempotent by extension id; the returned
@@ -193,7 +239,32 @@ export declare class TaskBoardHostService {
      * Lead's cascade verdict.
      */
     private spawnTeammate;
+    /**
+     * One roster pass, and whether it could read the session tree.
+     *
+     * The board reads the DSH session roster only while it has something the
+     * roster can decide: an execution to inspect, or a card parked in the running
+     * column whose verdict may arrive from a settle this process never saw. That
+     * gate is what removes the cost the reporter measured — `session/list`
+     * rebuilds every persisted session row (string conversion, object allocation,
+     * a stat per record), and an idle board with no tasks was paying it every few
+     * seconds forever.
+     * @returns whether the roster was readable (an idle pass counts as readable).
+     */
     private pollSessions;
+    /**
+     * The session a run may continue in, for a card that opted into reuse
+     * (issue #1419). Reuse requires positive evidence that the previous session
+     * is present and idle, and that evidence must be read for THIS launch: an
+     * idle board no longer polls, so a roster cached from an earlier pass could
+     * be hours old — either refusing a session that has been idle all along, or
+     * prompting into one that started running since. A card that did not opt in
+     * reads no roster at all, and a read that fails mints a fresh conversation
+     * exactly as an unknown roster always did.
+     * @param task - the task about to run.
+     * @returns the session id to continue in, or undefined for a fresh session.
+     */
+    private reuseSessionFor;
     /** Reuse the session list this poll already fetched: one list RPC per tick, not 1 + E. */
     private reconcileExecutions;
     /**
@@ -206,6 +277,30 @@ export declare class TaskBoardHostService {
      * each streak is logged, so the Host log names the session.
      */
     private settleAndNotify;
+    /**
+     * Remove one execution's acceptance-only detail after it PASSED and settled.
+     *
+     * Deliberately narrow: only the acceptance mechanism's own per-attempt
+     * material (findings, invalid diagnostics, the bulky judge side) is removed,
+     * and only for THIS execution, keyed by its own id in the ledger it belongs
+     * to. No user file, task artifact, raw session history or other execution's
+     * record is read or written. Idempotent by the record's own state, and it
+     * clearly never touches a run that did not pass (the caller's guard) — a
+     * failed or invalid execution keeps everything a repair or a review needs.
+     * @param taskId - the task whose execution settled.
+     * @param executionId - the settled execution.
+     */
+    private cleanupAcceptanceDetail;
+    /**
+     * Catch-up pass: clean the acceptance detail of every execution that PASSED
+     * and settled but whose cleanup did not finish (a crash, a failed write, a
+     * Host killed mid-cleanup).
+     *
+     * The same bounds as any other cleanup apply — only a real pass record on a
+     * settled execution is touched — so this can never delete material belonging
+     * to an execution that did not pass, and never a user file.
+     */
+    private cleanupPendingAcceptanceDetail;
     private noteUnreadableInspection;
     /** Drop the armed schedule timer and forget its target. */
     private clearScheduleTimer;
@@ -249,6 +344,19 @@ export declare class TaskBoardHostService {
     private setApplicability;
     private scheduleLaunch;
     private schedulePoll;
+    /**
+     * Count one failed pass and arm the retry that follows it.
+     *
+     * A session tree that is down is retried on a doubling delay instead of
+     * hammering it on the fixed cadence: the heartbeat would otherwise repeat
+     * every failure — and every retry inside {@link HostExecutionRunner.listRunning}
+     * — at exactly the interval the reporter measured.
+     */
+    private notePollFailure;
+    /** Arm the retry that follows a failed pass, doubling up to the ceiling. */
+    private armPollBackoff;
+    /** Drop a pending retry; the next regular tick takes over. */
+    private clearPollBackoff;
     /**
      * Re-arm from the ledger's current targets. Callers that just changed a
      * schedule (the host routes, the agent tools) invoke this after the write

package/lib/types/index.d.ts

@@ -62,12 +62,35 @@ export interface Config {
      * of the root task opens, so the ceiling is deliberately small.
      */
     maxSubtaskDepth?: Volatile<number>;
+    /**
+     * How often, in seconds, the Host re-reads the DSH session roster while the
+     * board has something to reconcile: a running card, an open execution, or an
+     * active provider extension. An idle board with none of those does not poll
+     * at all, so this cadence only bounds how quickly a running card settles.
+     */
+    sessionPollSeconds?: Volatile<number>;
     /**
      * Continuable-subagent provider the Agent Teams service uses to compose a
      * teammate. Matches the Agent Teams tool plugin's `freshProvider` default;
      * only team-mode runs use it.
      */
     teamProvider?: string;
+    /**
+     * GLOBAL native /goal switch (default OFF), the master control over whether
+     * this board starts a run with dsh's built-in /goal at all. A run uses native
+     * /goal only when THIS is on AND the task's own `goalRun` is not off; while
+     * it is off every task runs one plain turn.
+     *
+     * The value is frozen when an execution starts, so toggling it only affects
+     * executions that begin afterwards and never re-writes a task's stored
+     * `goalRun` preference. A run that consequently does not execute native
+     * /goal is marked as such (its acceptance applicability is `goal-disabled`)
+     * and is never reported as a passed goal acceptance or failed for lacking a
+     * completion call. Independent of `goalVerification`; acceptance governs the
+     * completing call of a goal-form run, this switch governs whether the run
+     * becomes a goal run.
+     */
+    goalRunEnabled?: Volatile<boolean>;
     /**
      * Goal acceptance for executions this board starts (default ON). When on,
      * update_goal(action: complete) inside a task execution is refused until an
@@ -93,6 +116,23 @@ export interface Config {
      * sent, and the fallback to the model's own default is reported.
      */
     goalVerificationReasoningEffort?: Volatile<string>;
+    /**
+     * Ceiling of ONE judge request of a goal acceptance, in seconds
+     * (30..600, default 150). One acceptance issues six judge requests (three
+     * criteria times two rounds), so a ceiling that is too small turns a slow but
+     * healthy judge route into a wall of timeouts, and every timeout was charged
+     * as an acceptance anomaly. Raise it for a reasoning model reading a long
+     * trace.
+     */
+    goalVerificationCallTimeoutSeconds?: Volatile<number>;
+    /**
+     * Total ceiling of ONE goal acceptance attempt, in seconds (120..1800,
+     * default eight times the per-call default). Keep it at or above
+     * `goalVerificationCallTimeoutSeconds` times six or an acceptance can never
+     * finish: the attempt then ends early with a budget stop that judges nothing
+     * and spends no acceptance budget.
+     */
+    goalVerificationBudgetSeconds?: Volatile<number>;
 }
 /**
  * Continuable-subagent provider for fresh teammates, matching the Agent Teams
@@ -124,18 +164,32 @@ export interface ConfigInput {
     sessionDefaultPermission?: TaskPermission;
     /** Subtask depth limit, 1..3. */
     maxSubtaskDepth?: number;
+    /** Roster-poll cadence in seconds while the board has work to reconcile. */
+    sessionPollSeconds?: number;
     /** Continuable-subagent provider the Agent Teams service composes a teammate from. */
     teamProvider?: string;
+    /** Global native /goal switch; default off, frozen per execution. */
+    goalRunEnabled?: boolean;
     /** Goal acceptance switch. */
     goalVerification?: boolean;
     /** Judge model route for goal acceptance; blank inherits the host default. */
     goalVerificationModel?: string;
     /** Judge reasoning effort; blank inherits the host default. */
     goalVerificationReasoningEffort?: string;
+    /** Ceiling of one judge request of a goal acceptance, in seconds. */
+    goalVerificationCallTimeoutSeconds?: number;
+    /** Total ceiling of one goal acceptance attempt, in seconds. */
+    goalVerificationBudgetSeconds?: number;
 }
 export declare const Config: z<ConfigInput, Config>;
 /** Schema default for the goal-acceptance switch, re-read for hand-built contexts. */
 export declare const DEFAULT_GOAL_VERIFICATION = true;
+/**
+ * Schema default for the GLOBAL native-/goal switch, re-read for hand-built
+ * contexts. Deliberately false: a deployment that never configured it (and
+ * every card written before the option existed) runs plain single turns.
+ */
+export declare const DEFAULT_GOAL_RUN = false;
 declare module '@deepseek-ai/cordis' {
     interface Events {
         /**

package/lib/types/protocol.d.ts

@@ -1,22 +1,36 @@
 import type { TaskUpdatePatch } from './core/use-cases/task-update.ts';
+import type { SetSchedulePatch } from './core/use-cases/task-schedule.ts';
 import { type NewTaskInput, type TaskPermission, type TaskRecord, type TaskStatus } from './core/tasks.ts';
 import { type TaskBoardExtensionPayload } from './core/extension.ts';
 import { type ModelCatalogView, type VerificationContract, type VerificationSettings } from './core/verification.ts';
-export declare const TASK_BOARD_SCHEMA_VERSION: 5;
-/** Ledger documents written before v5; loaded once and migrated on startup. */
-export declare const TASK_BOARD_LEGACY_SCHEMA_VERSION: 4;
+export declare const TASK_BOARD_SCHEMA_VERSION: 6;
+/** Ledger documents written before v6; loaded once and migrated on startup. */
+export declare const TASK_BOARD_LEGACY_SCHEMA_VERSION: 5;
+/** Ledger documents written before v5; migrated through the v5 normalization too. */
+export declare const TASK_BOARD_PRE_ACCEPTANCE_SCHEMA_VERSION: 4;
 /** Ledger documents written before v4; migrated through the v4 normalization too. */
 export declare const TASK_BOARD_OLDER_SCHEMA_VERSION: 3;
 /** Ledger documents written before v3; migrated through every later normalization too. */
 export declare const TASK_BOARD_OLDEST_SCHEMA_VERSION: 2;
 /**
- * Every older generation the loader migrates in place. v5 only ADDS the
- * per-execution acceptance block, so the migration is the normalization pass
- * that re-validates each row; a document from any listed generation upgrades
- * losslessly.
+ * The last generation whose rules still need the Host zone stamped on them at
+ * migration: v4 introduced the stored zone but a rule written without one must
+ * stop following a later TZ change. A v5 rule already carries its zone (or
+ * deliberately follows the Host), so it is NOT stamped again.
+ */
+export declare const TASK_BOARD_ZONE_STAMP_SCHEMA_VERSION: 4;
+/**
+ * Every older generation the loader migrates in place. v5 only added the
+ * per-execution acceptance block and v6 only added the scheduling mode and run
+ * budget, so the migration is the normalization pass that re-validates each
+ * row; a document from any listed generation upgrades losslessly.
  */
 export declare const TASK_BOARD_MIGRATABLE_SCHEMA_VERSIONS: readonly number[];
 export declare const TASK_BOARD_API_PREFIX = "/api/task-board";
+/** Longest accepted caller identity on an external outcome record. */
+export declare const EXTERNAL_INITIATOR_MAX_LENGTH = 200;
+/** Longest accepted free-text summary on an external outcome record. */
+export declare const EXTERNAL_SUMMARY_MAX_LENGTH = 1000;
 export type PowerPhase = 'disabled' | 'idle' | 'acquiring' | 'active' | 'error' | 'unsupported';
 export interface TaskBoardPowerSnapshot {
     platform: string;
@@ -52,6 +66,14 @@ export interface TaskBoardSnapshot {
      * into team execution (Team Lead session plus one teammate per subtask).
      */
     teamRunAvailable?: boolean;
+    /**
+     * Live GLOBAL native-/goal switch. The browser uses it to disable the
+     * task-level option (and explain that the global switch must be turned on
+     * first) WITHOUT rewriting anyone's stored per-task preference; the Host
+     * freezes its own read per execution, so this mirror never governs a run in
+     * flight.
+     */
+    goalRunEnabled?: boolean;
     /**
      * Read-only summaries published by running extensions, keyed by extension id.
      * The board forwards them verbatim; it never interprets their shape.
@@ -124,14 +146,30 @@ export type TaskBoardAction = {
 } | {
     kind: 'settle';
     taskId: string;
+}
+/** Clear the acceptance anomalies recorded on a card's open execution (issue #1828). */
+ | {
+    kind: 'reset-verification';
+    taskId: string;
+}
+/**
+ * Record an outcome an agent OUTSIDE the Host produced (issue #1826).
+ *
+ * It writes a real execution record, so the terminal column and the run
+ * history both derive from that one record instead of a bare column edit.
+ * `cancelled` is deliberately absent: nothing outside a DSH session may
+ * claim the Host closed a run, and `running` must stay Host-only.
+ */
+ | {
+    kind: 'record-external-outcome';
+    taskId: string;
+    result: 'succeeded' | 'failed';
+    initiatedBy: string;
+    summary?: string;
 } | {
     kind: 'set-schedule';
     taskId: string;
-    patch: {
-        enabled?: boolean;
-        cron?: string;
-        timeZone?: string | null;
-    };
+    patch: SetSchedulePatch;
 } | {
     kind: 'run';
     taskId: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-client-ui-task-board",
   "description": "Host-authoritative task board for the DSH Web GUI with real session execution, Host cron scheduling, and optional cross-platform idle-sleep protection; mounted without DSH source changes.",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "icon": "icon.svg",
   "type": "module",
   "main": "lib/index.js",
@@ -11,10 +11,6 @@
       "types": "./lib/types/index.d.ts",
       "default": "./lib/index.js"
     },
-    "./invariant": {
-      "types": "./lib/types/invariant.d.ts",
-      "default": "./lib/invariant.js"
-    },
     "./client": {
       "types": "./lib/types/client/index.d.ts",
       "default": "./lib/client.js"
@@ -101,7 +97,7 @@
     "url": "https://github.com/zhu1090093659/dsh-web.git"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json && tsdown",
+    "build": "tsc -b tsconfig.build.json && tsdown",
     "bundle": "tsdown",
     "watch": "tsdown --watch",
     "typecheck": "tsc --noEmit",