@linxin666/dsh-client-ui-task-board 0.4.5 → 0.4.7

package/src/core/controller.ts

@@ -16,7 +16,7 @@ import { hasOpenExecution, withStatus, type NewTaskInput, type TaskRecord, type
 import { applyArchiveTask, applyRestoreTask } from './use-cases/task-archive.ts'
 import { applyCreateTask } from './use-cases/task-create.ts'
 import { applyDeleteTask } from './use-cases/task-delete.ts'
-import { applyScheduleNextRun as applyScheduleRollForward, applySetSchedule } from './use-cases/task-schedule.ts'
+import { applyScheduleNextRun as applyScheduleRollForward, applySetSchedule, type SetSchedulePatch } from './use-cases/task-schedule.ts'
 import { resolveHostTimeZone } from './schedule.ts'
 import { applySetParent } from './use-cases/task-parent.ts'
 import { applyDeleteTag, applyRenameTag } from './use-cases/task-tag.ts'
@@ -127,6 +127,17 @@ export interface ExecutionModelOption {
   name?: string
   label?: string
   provider?: string
+  /**
+   * Reasoning metadata the adapter declares for this exact route. An effort
+   * picker is offered only while `supported`, and its choices are `efforts` —
+   * the ids the target model really accepts, so the UI never offers (or keeps)
+   * a level the model would reject. Absent means the deployment published no
+   * capability for this model; the card value is then left untouched.
+   */
+  reasoning?: {
+    supported: boolean
+    efforts?: readonly string[]
+  }
 }
 
 /** The execution-target option sets the UI feeds into the controller. */
@@ -141,7 +152,7 @@ export interface ExecutionOptionsSnapshot {
  * (revision/scheduler/power); a full snapshot also carries the deployment
  * constants the UI reads (session default permission, subtask depth).
  */
-export type HostMirror = Pick<TaskBoardSnapshot, 'revision' | 'scheduler' | 'power' | 'sessionDefaultPermission' | 'maxSubtaskDepth' | 'teamRunAvailable' | 'extensions'>
+export type HostMirror = Pick<TaskBoardSnapshot, 'revision' | 'scheduler' | 'power' | 'sessionDefaultPermission' | 'maxSubtaskDepth' | 'teamRunAvailable' | 'goalRunEnabled' | 'cardDefaults' | 'extensions'>
 
 /** Immutable controller snapshot for UI subscriptions. */
 export interface ControllerSnapshot {
@@ -318,6 +329,22 @@ export class BoardController {
     return await this.initializeRemote()
   }
 
+  /**
+   * Re-read the authoritative Host snapshot.
+   *
+   * The board's volatile deployment configuration — the new-card defaults among
+   * it — is republished the moment the settings document is written, but the SSE
+   * frame that republish emits carries the value as of BEFORE the write (the
+   * loader hands the update to the fiber while the new document is not yet
+   * visible to it), so a mirror that followed frames alone would stay one edit
+   * behind and the create dialog would prefill from the previous defaults for
+   * the rest of the session. The surface that owns the write asks for the
+   * snapshot again instead of trusting the frame.
+   */
+  refreshHostState(): void {
+    void this.refreshRemote()
+  }
+
   // --- view state -------------------------------------------------------------
 
   /**
@@ -407,7 +434,7 @@ export class BoardController {
 
   createTask(input: NewTaskInput): TaskRecord | undefined {
     const id = this.uuid()
-    const { task, tasks } = applyCreateTask(this.tasks, input, this.now(), id, this.mirrorDepth())
+    const { task, tasks } = applyCreateTask(this.tasks, input, this.now(), id, this.mirrorDepth(), undefined, this.hostState?.cardDefaults)
     if (task === undefined) return undefined
     this.tasks = [...tasks]
     this.persistAndNotify()
@@ -421,7 +448,7 @@ export class BoardController {
     // The preview must obey the SAME lineage gate the Host will: a browser-side
     // default of one level would reject a legal subtask-of-subtask before the
     // request is ever sent.
-    const preview = applyCreateTask(this.tasks, input, this.now(), id, this.mirrorDepth()).task
+    const preview = applyCreateTask(this.tasks, input, this.now(), id, this.mirrorDepth(), undefined, this.hostState?.cardDefaults).task
     if (preview === undefined) return undefined
     return await this.commitRemote({ kind: 'create', id, input }, id)
       ? this.tasks.find(task => task.id === id)
@@ -597,15 +624,17 @@ export class BoardController {
   // --- scheduling ---------------------------------------------------------------
 
   /**
-   * Update a task's schedule rule. A blank or invalid cron expression is
-   * rejected (returns false, state untouched). When the rule ends up enabled
-   * the next run instant is computed immediately; a disabled rule carries no
-   * next-run instant. Delegates the domain transition to the schedule use case.
+   * Update a task's schedule rule. An unusable plan (blank or invalid cron, a
+   * one-shot with no future instant, a non-positive run cap) is rejected
+   * (returns false, state untouched). When the rule ends up enabled the next
+   * run instant is computed immediately — a one-shot's next instant IS its
+   * planned instant — and a disabled rule carries none. Delegates the domain
+   * transition to the schedule use case.
    * @param id - the task to schedule.
    * @param patch - fields to change (absent fields keep their current value).
-   * @returns true when applied, false when rejected (invalid cron / unknown task).
+   * @returns true when applied, false when rejected (unknown task / unusable plan).
    */
-  setSchedule(id: string, patch: { enabled?: boolean; cron?: string; timeZone?: string | null }): boolean {
+  setSchedule(id: string, patch: SetSchedulePatch): boolean {
     // The Host zone is the fallback a rule with no stored zone follows: the
     // mirrored snapshot carries it, and a controller without a Host mirror
     // (pure client tests) falls back to the process zone.
@@ -802,17 +831,25 @@ export class BoardController {
   }
 
   /**
-   * Project a Host snapshot onto the browser's mirror. SSE frames and partial
-   * snapshots carry only the volatile subset (revision/scheduler/power), so the
-   * deployment constants the UI reads — the session-default permission the
-   * confirmation banner compares against and the subtask depth limit — are
-   * carried over from the last full snapshot instead of being dropped by a
-   * heartbeat frame.
+   * Project a Host snapshot onto the browser's mirror. Every snapshot the
+   * transport serves is a full document (bootstrap/state/action all answer
+   * `TaskBoardHostService.snapshot()`), so the deployment constants the UI reads
+   * — the session-default permission the confirmation banner compares against,
+   * the subtask depth limit, the platform switches and the extensions a provider
+   * published — are taken as published, carried over only where the snapshot
+   * itself omits the key.
    */
   private mirrorOf(snapshot: TaskBoardSnapshot): HostMirror {
     const sessionDefaultPermission = snapshot.sessionDefaultPermission ?? this.hostState?.sessionDefaultPermission
     const maxSubtaskDepth = snapshot.maxSubtaskDepth ?? this.hostState?.maxSubtaskDepth
     const teamRunAvailable = snapshot.teamRunAvailable ?? this.hostState?.teamRunAvailable
+    const goalRunEnabled = snapshot.goalRunEnabled ?? this.hostState?.goalRunEnabled
+    // The new-card defaults are NOT carried over: the Host publishes a target
+    // nothing configures by omitting it (protocol.ts states that explicitly), so
+    // an absent key means "this deployment configures none". Carrying the last
+    // value over would keep a CLEARED default alive in the create dialog, which
+    // is the mirror image of the staleness this key is re-read for.
+    const cardDefaults = snapshot.cardDefaults
     const extensions = snapshot.extensions ?? this.hostState?.extensions
     return {
       revision: snapshot.revision,
@@ -821,6 +858,8 @@ export class BoardController {
       ...(sessionDefaultPermission === undefined ? {} : { sessionDefaultPermission }),
       ...(maxSubtaskDepth === undefined ? {} : { maxSubtaskDepth }),
       ...(teamRunAvailable === undefined ? {} : { teamRunAvailable }),
+      ...(goalRunEnabled === undefined ? {} : { goalRunEnabled }),
+      ...(cardDefaults === undefined ? {} : { cardDefaults }),
       ...(extensions === undefined ? {} : { extensions }),
     }
   }

package/src/core/launch-width.ts

@@ -0,0 +1,38 @@
+/**
+ * Run-launch admission width: the one bound on how many sessions this board
+ * starts at the same time.
+ *
+ * One board action opens a whole subtree, and a team run hands every member of
+ * it to the Lead at once, so without a bound the Host asks DSH for dozens of
+ * sessions in a single tick. The repository's own measured guidance caps heavy
+ * implementation subagents at three (docs/multi-agent-resources.md) and no
+ * runtime mechanism enforced it; this setting is that mechanism.
+ *
+ * The bounds and the default live here rather than in either half, exactly like
+ * the roster cadence: the settings card validates a draft against the same
+ * range the Host clamps a hand-edited configuration to, and a programmatic
+ * mount that names no width gets the default.
+ *
+ * @module dsh-task-board/core/launch-width
+ */
+
+/** Width used when neither the settings document nor the mount names one. */
+export const DEFAULT_RUN_LAUNCH_WIDTH = 3
+
+/** Narrowest accepted width: one launch at a time. */
+export const RUN_LAUNCH_WIDTH_MIN = 1
+
+/** Widest accepted width. */
+export const RUN_LAUNCH_WIDTH_MAX = 16
+
+/**
+ * Clamp a configured width into the supported range. A value the schema would
+ * refuse (non-finite, below the floor, above the ceiling) still leaves the
+ * board launching: an out-of-range setting never stalls a run.
+ * @param width - configured width, or undefined for the default.
+ * @returns the effective width.
+ */
+export function normalizeRunLaunchWidth(width: number | undefined): number {
+  if (width === undefined || !Number.isFinite(width)) return DEFAULT_RUN_LAUNCH_WIDTH
+  return Math.min(Math.max(Math.trunc(width), RUN_LAUNCH_WIDTH_MIN), RUN_LAUNCH_WIDTH_MAX)
+}

package/src/core/poll-cadence.ts

@@ -0,0 +1,41 @@
+/**
+ * Roster-poll cadence: the one recurring Host timer the board holds.
+ *
+ * The cadence is a user setting (seconds), so the bounds and the seconds to
+ * milliseconds conversion live here rather than in either half: the settings
+ * card validates a draft against the same range the Host clamps a hand-edited
+ * configuration to, and a programmatic mount that passes no cadence gets the
+ * default.
+ *
+ * @module dsh-task-board/core/poll-cadence
+ */
+
+/** Cadence used when neither the settings document nor the mount names one. */
+export const DEFAULT_SESSION_POLL_SECONDS = 5
+
+/** Shortest accepted cadence: a faster poll only burns CPU on the Host. */
+export const SESSION_POLL_MIN_SECONDS = 1
+
+/** Longest accepted cadence, five minutes. */
+export const SESSION_POLL_MAX_SECONDS = 300
+
+/**
+ * Clamp a configured cadence into the supported range. A value the schema
+ * would refuse (non-finite, below the floor, above the ceiling) still leaves
+ * the board polling: an out-of-range setting never disables the timer.
+ * @param seconds - configured cadence in seconds, or undefined for the default.
+ * @returns the effective cadence in seconds.
+ */
+export function normalizeSessionPollSeconds(seconds: number | undefined): number {
+  if (seconds === undefined || !Number.isFinite(seconds)) return DEFAULT_SESSION_POLL_SECONDS
+  return Math.min(Math.max(Math.trunc(seconds), SESSION_POLL_MIN_SECONDS), SESSION_POLL_MAX_SECONDS)
+}
+
+/**
+ * The cadence in the milliseconds the Host timer face takes.
+ * @param seconds - configured cadence in seconds, or undefined for the default.
+ * @returns the effective cadence in milliseconds.
+ */
+export function sessionPollMs(seconds: number | undefined): number {
+  return normalizeSessionPollSeconds(seconds) * 1_000
+}

package/src/core/reasoning-effort.ts

@@ -0,0 +1,92 @@
+/**
+ * Which reasoning effort one execution may actually send.
+ *
+ * The rule lives here, in one pure place, so the launch path cannot drift from
+ * what the picker promises: an effort is sent ONLY for the exact model route
+ * whose adapter declares that id. An unsupported value is dropped rather than
+ * passed through — the Host validates the selection against the same
+ * capability (`resolveCallConfig` rejects an unsupported effort) and the whole
+ * model selection would fail with it. An absent effort stays absent: the SDK
+ * then materializes the model's own default, which is exactly what "inherit
+ * the model" means.
+ *
+ * A card that pins a bare model id also gets its provider resolved here: the
+ * session wire contract requires `provider` (ModelSelection), so the catalog is
+ * the only place that can complete the documented `provider/model` or model-id
+ * pin.
+ */
+import type { CatalogModel, ModelCatalogView } from './verification.ts'
+
+/** One execution route an effort resolves against: `provider/model`, or a bare model id. */
+export interface ReasoningRoute {
+  provider?: string
+  model: string
+}
+
+/** The catalog entry a route names, once the catalog can complete it. */
+export interface DeclaredReasoningRoute {
+  provider: string
+  model: string
+  /** The adapter's reasoning metadata; absent when it exposes none. */
+  reasoning?: CatalogModel['reasoning']
+}
+
+/** What one card's effort resolves to for one route. */
+export interface ReasoningEffortDecision {
+  /** The effort to send; absent means "send none". */
+  effort?: string
+  /** The card's own value when it will NOT be sent. */
+  dropped?: string
+}
+
+/** Trim one optional effort: blank text means "not set", like every other pinned target. */
+export function normalizeReasoningEffort(value: string | undefined): string | undefined {
+  const trimmed = value?.trim()
+  return trimmed === undefined || trimmed === '' ? undefined : trimmed
+}
+
+/**
+ * Complete one route through the host catalog: a qualified route must match its
+ * provider group, and a bare model id matches the first group carrying it —
+ * which is the provider the request then names.
+ * @param catalog - the host model catalog, when this deployment serves one.
+ * @param route - the route as the card pins it.
+ * @returns the completed route with its reasoning metadata, or undefined when
+ *   the catalog declares no such model.
+ */
+export function declaredRoute(
+  catalog: ModelCatalogView | undefined,
+  route: ReasoningRoute,
+): DeclaredReasoningRoute | undefined {
+  const groups = catalog?.groups ?? []
+  const matched = route.provider === undefined || route.provider === ''
+    ? groups.find(group => group.models.some(model => model.id === route.model))
+    : groups.find(group => group.id === route.provider)
+  const model = matched?.models.find(candidate => candidate.id === route.model)
+  if (matched === undefined || model === undefined) return undefined
+  return {
+    provider: matched.id,
+    model: model.id,
+    ...(model.reasoning === undefined ? {} : { reasoning: model.reasoning }),
+  }
+}
+
+/**
+ * Resolve the effort one execution sends.
+ * @param requested - the card's stored effort (absent or blank = inherit).
+ * @param catalog - the host model catalog, when this deployment serves one.
+ * @param route - the route the execution will actually run at.
+ * @returns the effort to send, or the dropped value that will not be sent.
+ */
+export function resolveReasoningEffort(
+  requested: string | undefined,
+  catalog: ModelCatalogView | undefined,
+  route: ReasoningRoute | undefined,
+): ReasoningEffortDecision {
+  const effort = normalizeReasoningEffort(requested)
+  if (effort === undefined) return {}
+  if (route === undefined) return { dropped: effort }
+  const declared = declaredRoute(catalog, route)
+  const supported = declared?.reasoning?.efforts.some(option => option.id === effort) === true
+  return supported ? { effort } : { dropped: effort }
+}

package/src/core/store.ts

@@ -10,7 +10,7 @@
  * localStorage backend.
  */
 import { isValidCron, isValidTimeZone } from './schedule.ts'
-import { isTaskPermission, isTaskStatus, normalizeTags, normalizeTargetId, type ScheduleRule, type TaskFreeze, type TaskRecord, type TaskPermission, type TaskStatus } from './tasks.ts'
+import { SCHEDULE_STOP_REASONS, isTaskPermission, isTaskStatus, normalizeTags, normalizeTargetId, type ScheduleRule, type ScheduleStopReason, type TaskFreeze, type TaskRecord, type TaskPermission, type TaskStatus } from './tasks.ts'
 import { isExecutionOutcome } from './subtask.ts'
 import type { TaskHandover } from './handover.ts'
 import { sanitizeFreezeSnapshot } from './freeze-snapshot.ts'
@@ -68,6 +68,7 @@ function isTaskRecordShape(value: unknown): value is Omit<TaskRecord, 'status'>
   if (record.parentId !== undefined && typeof record.parentId !== 'string') return false
   if (record.workspaceId !== undefined && typeof record.workspaceId !== 'string') return false
   if (record.mode !== undefined && typeof record.mode !== 'string') return false
+  if (record.reasoningEffort !== undefined && typeof record.reasoningEffort !== 'string') return false
   if (record.permission !== undefined && typeof record.permission !== 'string') return false
   if (record.integrations !== undefined && (typeof record.integrations !== 'object' || record.integrations === null || Array.isArray(record.integrations))) return false
   if (record.hidden !== undefined && typeof record.hidden !== 'boolean') return false
@@ -87,6 +88,10 @@ function isTaskRecordShape(value: unknown): value is Omit<TaskRecord, 'status'>
     if (entry.initiatedBy !== undefined && typeof entry.initiatedBy !== 'string') return false
     if (entry.frozenBy !== undefined && typeof entry.frozenBy !== 'string') return false
     if (entry.frozenAt !== undefined && typeof entry.frozenAt !== 'number') return false
+    // An external-outcome marker is optional in BOTH directions: a ledger
+    // written before the field existed carries none, and a non-boolean value
+    // is dropped by the repair below rather than trusted as provenance.
+    if (entry.external !== undefined && typeof entry.external !== 'boolean') return false
     // The acceptance block is repaired like every other optional field: an
     // unusable one is dropped, which can only make the board MORE strict.
     if (entry.verification !== undefined && normalizeVerification(entry.verification) === undefined) return false
@@ -104,29 +109,73 @@ function normalizeStatus(status: unknown): TaskStatus {
   return isTaskStatus(status) ? status : 'todo'
 }
 
+/** A persisted ms timestamp, kept only when it is a usable finite number. */
+function optionalInstant(value: unknown): number | undefined {
+  return typeof value === 'number' && Number.isFinite(value) ? value : undefined
+}
+
+/** A persisted positive-integer run cap, or undefined for unlimited/repair. */
+function optionalRunCap(value: unknown): number | undefined {
+  return typeof value === 'number' && Number.isInteger(value) && value >= 1 ? value : undefined
+}
+
+/** A persisted stop reason, kept only when it names a reason this build knows. */
+function optionalStopReason(value: unknown): ScheduleStopReason | undefined {
+  return typeof value === 'string' && SCHEDULE_STOP_REASONS.includes(value as ScheduleStopReason)
+    ? value as ScheduleStopReason
+    : undefined
+}
+
 /**
- * Repair a persisted schedule rule: drop rules without a usable cron string,
- * coerce booleans/numbers, and leave `nextRunAt`/`lastTriggeredAt` undefined
- * when missing (a fresh recompute or the next tick fixes them).
+ * Repair a persisted schedule rule. Both modes are repaired field by field and
+ * a rule that carries no usable plan is dropped (the task row survives):
+ * a recurring rule without a well-formed 5-field cron, or a one-shot without a
+ * finite planned instant. A rule written before `mode` existed is a cron rule.
  */
 function normalizeSchedule(schedule: unknown): ScheduleRule | undefined {
   if (typeof schedule !== 'object' || schedule === null) return undefined
   const rule = schedule as Record<string, unknown>
+  // A stored zone survives only when this runtime can resolve it; an unusable
+  // name is dropped (the rule then follows the Host zone) instead of being
+  // kept to fail every later resolve.
+  const timeZone = typeof rule.timeZone === 'string' && isValidTimeZone(rule.timeZone) ? rule.timeZone : undefined
+  const runCountValue = rule.runCount
+  const runCount = typeof runCountValue === 'number' && Number.isInteger(runCountValue) && runCountValue >= 0
+    ? runCountValue
+    : 0
+  const endedAt = optionalInstant(rule.endedAt)
+  const endedReason = optionalStopReason(rule.endedReason)
+  const skippedAt = optionalInstant(rule.skippedAt)
+  const skippedReason = optionalStopReason(rule.skippedReason)
+  const common = {
+    enabled: rule.enabled === true,
+    ...(timeZone === undefined ? {} : { timeZone }),
+    nextRunAt: optionalInstant(rule.nextRunAt),
+    lastTriggeredAt: optionalInstant(rule.lastTriggeredAt),
+    runCount,
+    ...(endedAt === undefined ? {} : { endedAt }),
+    ...(endedReason === undefined ? {} : { endedReason }),
+    ...(skippedAt === undefined ? {} : { skippedAt }),
+    ...(skippedReason === undefined ? {} : { skippedReason }),
+  }
+  if (rule.mode === 'once') {
+    const at = optionalInstant(rule.at)
+    // A one-shot with no instant can never fire; drop it rather than keep a
+    // rule the scheduler would have to interpret.
+    if (at === undefined) return undefined
+    return { ...common, mode: 'once', at }
+  }
   // Reject (drop) a schedule whose cron is not a well-formed 5-field
   // expression: a malformed rule would otherwise linger as a never-firing
   // schedule instead of being dropped for later repair.
   if (typeof rule.cron !== 'string') return undefined
   if (rule.cron.trim() === '' || !isValidCron(rule.cron)) return undefined
-  // A stored zone survives only when this runtime can resolve it; an unusable
-  // name is dropped (the rule then follows the Host zone) instead of being
-  // kept to fail every later resolve.
-  const timeZone = typeof rule.timeZone === 'string' && isValidTimeZone(rule.timeZone) ? rule.timeZone : undefined
+  const maxRuns = optionalRunCap(rule.maxRuns)
   return {
-    enabled: rule.enabled === true,
+    ...common,
+    mode: 'cron',
     cron: rule.cron,
-    ...(timeZone === undefined ? {} : { timeZone }),
-    nextRunAt: typeof rule.nextRunAt === 'number' ? rule.nextRunAt : undefined,
-    lastTriggeredAt: typeof rule.lastTriggeredAt === 'number' ? rule.lastTriggeredAt : undefined,
+    ...(maxRuns === undefined ? {} : { maxRuns }),
   }
 }
 
@@ -210,18 +259,23 @@ export function parseLedger(raw: string | null): TaskRecord[] {
       // A malformed acceptance block is dropped rather than dropping the
       // execution record: the board then treats that run as unverified.
       verification: normalizeVerification(execution.verification),
+      external: execution.external === true ? true : undefined,
     }))
     // Execution targets are normalized like the schedule: blank strings
     // clear the pin and unknown permission strings from a future version
     // fall back to the session default instead of dropping the row.
     task.workspaceId = normalizeTargetId(row.workspaceId)
     task.mode = normalizeTargetId(row.mode)
+    // The effort is repaired like the other execution-target strings: blank text
+    // from a hand-edited document clears the pin instead of dropping the row,
+    // and the card then runs at its model's own default level.
+    task.reasoningEffort = normalizeTargetId(row.reasoningEffort)
     task.archivedAt = typeof row.archivedAt === 'number' && Number.isFinite(row.archivedAt) ? row.archivedAt : undefined
     task.permission = isTaskPermission(row.permission) ? row.permission as TaskPermission : undefined
     task.reuseSession = row.reuseSession === true ? true : undefined
-    // The goal opt-in is stored only when it is OFF: absent means the default
-    // (start each run with /goal), so a hand-edited true normalizes back to it.
-    task.goalRun = row.goalRun === false ? false : undefined
+    // The goal opt-in is stored only when it is ON: absent means the default
+    // (one plain turn per run), so a hand-edited false normalizes back to it.
+    task.goalRun = row.goalRun === true ? true : undefined
     // The acceptance opt-out is stored only when it is ON: absent inherits the
     // board-wide switch, so a hand-edited false normalizes back to inherit.
     task.skipVerification = row.skipVerification === true ? true : undefined

package/src/core/subtask.ts

@@ -183,9 +183,12 @@ export function checkParentLink(
 
 /**
  * The tasks one run request opens executions for: the requested task first,
- * then its on-board descendants within the configured depth. Archived tasks
- * never run; a participant that already has an open execution is skipped by
- * the caller, which cannot start it twice.
+ * then its on-board descendants within the configured depth. This is the
+ * SHAPE of a cascade — every walk that must see the whole tree (settlement,
+ * archive/restore, the running lock) reads it. The run path filters it with
+ * {@link joinsCascadeRun}: archived tasks never run, a participant that already
+ * has an open execution is skipped by the caller, which cannot start it twice,
+ * and a finished descendant is left alone.
  */
 export function cascadeTargets(
   tasks: readonly TaskRecord[],
@@ -197,6 +200,27 @@ export function cascadeTargets(
   return [root, ...descendantTasks(tasks, rootId, maxSubtaskDepth)]
 }
 
+/**
+ * Whether a cascade member takes part in a new run.
+ *
+ * The task the user ran is always a member: the request names that card, and
+ * the operator asked for it to run whatever its column says. A descendant does
+ * not join once it sits in the `done` column — its work is finished, so running
+ * the parent again is a run of the parent, never a second execution of work
+ * that is already done. The rule keys on the column alone, so it covers both a
+ * subtask that ran and one an operator moved to done by hand, and it holds for
+ * every trigger: a manual run, a re-run, and a due occurrence of a schedule.
+ * A card whose own schedule is enabled settles back into `todo`, so a scheduled
+ * subtask stays a participant; to make a finished one run again, move it back
+ * to `todo` or run it on its own.
+ * @param task - the candidate member.
+ * @param rootId - the task the run request named.
+ * @returns false when this member is left alone by the run.
+ */
+export function joinsCascadeRun(task: TaskRecord, rootId: string): boolean {
+  return task.id === rootId || task.status !== 'done'
+}
+
 /** One still-open execution belonging to a cascade run group. */
 export interface OpenCascadeChild {
   taskId: string
@@ -263,11 +287,12 @@ export function effectiveTaskPermission(task: TaskRecord): TaskRecord['permissio
 /**
  * Resolve the execution targets a (sub)task actually runs with: its own value
  * wins, and an unset target inherits the nearest ancestor up to the root.
- * Workspace, agent preset and model inherit the ancestor's PIN only — a
- * handover bundle is a per-card continuation artefact and is never inherited.
- * The permission inherits the ancestor's EFFECTIVE binding, and its human
- * confirmation travels with it, so a subtask of an already-confirmed elevated
- * card is runnable while a subtask's own unconfirmed binding stays gated.
+ * Workspace, agent preset, model and reasoning effort inherit the ancestor's
+ * PIN only — a handover bundle is a per-card continuation artefact and is never
+ * inherited. The permission inherits the ancestor's EFFECTIVE binding, and its
+ * human confirmation travels with it, so a subtask of an already-confirmed
+ * elevated card is runnable while a subtask's own unconfirmed binding stays
+ * gated.
  */
 /**
  * The immutable teammate name for one team-mode member. Teammate names are
@@ -317,13 +342,22 @@ export function resolveExecutionTargets(
 ): TaskRecord {
   if (task.parentId === undefined) return task
   const chain = [task, ...ancestorChain(tasks, task).slice(0, maxSubtaskDepth)]
-  const first = (key: 'workspaceId' | 'mode' | 'model'): string | undefined => {
-    for (const candidate of chain) {
+  const first = (key: 'workspaceId' | 'mode' | 'model' | 'reasoningEffort', candidates: readonly TaskRecord[]): string | undefined => {
+    for (const candidate of candidates) {
       const value = candidate[key]
       if (value !== undefined) return value
     }
     return undefined
   }
+  // The model pin is the boundary of the effort: an effort is only ever taken
+  // from the card the model came from, or from the card that pinned it below
+  // that one. A card with a model of its own thus sends NO effort when it stores
+  // none — the model's own default — instead of quietly running at an ancestor
+  // level chosen for a different model, even when both models declare that
+  // level. A card with no model of its own still inherits the nearest model
+  // together with the nearest level pinned at or below it.
+  const boundary = chain.findIndex(candidate => candidate.model !== undefined)
+  const effortChain = boundary === -1 ? chain : chain.slice(0, boundary + 1)
   const own = effectiveTaskPermission(task)
   // An own binding (pin or handover) keeps its own confirmation stamp; only an
   // absent one borrows the ancestor's binding AND that ancestor's stamp.
@@ -332,9 +366,10 @@ export function resolveExecutionTargets(
     : undefined
   return {
     ...task,
-    workspaceId: first('workspaceId'),
-    mode: first('mode'),
-    model: first('model'),
+    workspaceId: first('workspaceId', chain),
+    mode: first('mode', chain),
+    model: first('model', chain),
+    reasoningEffort: first('reasoningEffort', effortChain),
     permission: own ?? (owner === undefined ? undefined : effectiveTaskPermission(owner)),
     permissionConfirmedAt: own === undefined ? owner?.permissionConfirmedAt : task.permissionConfirmedAt,
   }