@linxin666/dsh-client-ui-task-board 0.4.5 → 0.4.7

package/src/host-service.ts

@@ -1,16 +1,19 @@
 import type { TypertGateway } from '@deepseek-ai/dsh-api-gateway'
-import { nextRunAtMs } from './core/schedule.ts'
+import { DEFAULT_RUN_LAUNCH_WIDTH, normalizeRunLaunchWidth } from './core/launch-width.ts'
+import { DEFAULT_SESSION_POLL_SECONDS, normalizeSessionPollSeconds, sessionPollMs } from './core/poll-cadence.ts'
 import { reusableSessionId } from './core/session-reuse.ts'
+import { LaunchAdmissionQueue, type QueuedLaunch } from './host/launch-admission.ts'
 import { HostTaskLedger, type OpenedRun, type OpenExecutionReference } from './host-ledger.ts'
-import { HostExecutionRunner, SessionLaunchError, promptText, type SessionCommandDispatcher, type SessionSummary, type TaskBoardWorkspaceRegistry } from './host-runner.ts'
+import { HostExecutionRunner, SessionLaunchError, promptText, type GatewayPeer, type SessionCommandDispatcher, type SessionSummary, type TaskBoardWorkspaceRegistry } from './host-runner.ts'
 import { teammateName } from './core/subtask.ts'
 import { workspaceOwningSession } from './core/workspace-target.ts'
 import { PowerInhibitor } from './power-inhibitor.ts'
 import { TASK_BOARD_SCHEMA_VERSION, type TaskBoardAction, type TaskBoardEventPayload, type TaskBoardSnapshot } from './protocol.ts'
+import type { CardDefaults } from './core/card-defaults.ts'
 import { TaskBoardExtensionRegistry } from './host/extension-registry.ts'
 import type { TaskBoardExtension } from './core/extension.ts'
-import type { ExecutionOutcome, TaskStatus } from './core/tasks.ts'
-import { passedAttempt, resolveContract, verificationRequired, type ExecutionVerification, type ModelCatalogView, type VerificationContract, type VerificationSettings } from './core/verification.ts'
+import { isTaskPermission, normalizeTargetId, type ExecutionOutcome, type ScheduleMode, type TaskRecord, type TaskStatus } from './core/tasks.ts'
+import { passedAttempt, resolveContract, verificationNeverInvoked, verificationOnlyInvalid, verificationRequired, withAcceptanceDetailCleared, type ExecutionVerification, type ModelCatalogView, type VerificationContract, type VerificationSettings } from './core/verification.ts'
 import type { TaskPermission } from './core/handover.ts'
 
 /** One teammate the Host asks the Agent Teams service to spawn for a team run. */
@@ -43,8 +46,8 @@ export interface TaskBoardTeamDispatcher {
   spawn(input: TeamSpawnInput): Promise<TeamSpawnResult>
 }
 
-/** Session-roster poll cadence — the one recurring Host timer this service still holds. */
-const SESSION_POLL_MS = 5_000
+/** Ceiling for the roster-poll failure backoff: a broken session tree is retried at most once a minute. */
+const POLL_FAILURE_MAX_BACKOFF_MS = 60_000
 /**
  * How late an armed schedule fire may be before it counts as a resume rather
  * than a normal occurrence. The schedule timer is armed AT the next due
@@ -65,6 +68,60 @@ const MAX_TIMER_DELAY_MS = 2_147_483_647
  */
 const UNREADABLE_SETTLE_POLLS = 24
 
+/**
+ * Why a member of a run never started: the Host stopped while its launch was
+ * still waiting for an admission slot. Recorded rather than left open, so the
+ * card leaves the running column instead of waiting for the next Host start's
+ * interrupted-start recovery.
+ */
+const ABANDONED_LAUNCH_REASON = 'host stopped before this execution started'
+
+/**
+ * The acceptance contract one run group freezes, read once for the whole group.
+ *
+ * The board freezes an execution's acceptance contract BEFORE its session is
+ * prompted. Admission delays the launch, so reading these per execution would
+ * let a settings edit made while later members wait reach some members of one
+ * run and not others. Reading them once per run group — at the group's first
+ * admission, which is its root's — keeps the whole group on one contract and
+ * still freezes it before any member's session is prompted.
+ */
+interface FrozenRunContract {
+  settings: VerificationSettings
+  /** The GLOBAL native-/goal switch, resolved exactly once for the run group. */
+  globalGoalEnabled: boolean
+  /** The host model catalog the group's contracts resolve their route from. */
+  catalog: ModelCatalogView | undefined
+}
+
+/** Reads (or returns the already-read) contract of one run group. */
+type RunContractFreezer = () => Promise<FrozenRunContract>
+
+/**
+ * Why an enforced goal execution settled failed while its acceptance DID run:
+ * attempts were recorded and none of them passed. The judge answered about the
+ * work and the work did not pass.
+ */
+export const NO_MATCHING_PASS_VERIFICATION_REASON = 'goal 验收：本次执行没有匹配的验收通过记录（验收未运行、未通过或报告来自其他执行），按未验收判失败。'
+/**
+ * Why an enforced goal execution settled failed with ZERO acceptance records:
+ * the gate was never opened, so the judge never ran and nothing was ever judged
+ * (issue #1837). The root cause is a session that declared completion in prose
+ * instead of calling `update_goal(action: complete)` — a tool-adherence problem,
+ * NOT a quality verdict on the delivery — so this reason says so and keeps the
+ * two investigation directions apart.
+ */
+export const NEVER_INVOKED_VERIFICATION_REASON = 'goal 验收未触发：本次执行没有任何验收记录，验收门从未打开——执行会话没有调用 update_goal(action: complete) 来完成目标（常见于只在回复里宣告完成）。这不是质量判负：交付从未被裁判评估。'
+/**
+ * Why an enforced goal execution settled failed while its ONLY acceptance
+ * records are INVALID: the judge answered but could not locate its own
+ * rejection, so the board stopped calling it. This is NOT an evidence-backed
+ * quality veto — the requirement is explicit that such a run must not be
+ * described as one — but the execution still has no matching pass, so it ends
+ * for lack of one, and the reason names that precisely.
+ */
+export const INVALID_ONLY_VERIFICATION_REASON = 'goal 验收无效：本次执行只记录了无效验收（裁判未能给出与任务要求对应、且可定位到本次证据的否决依据），看板已停止调用裁判。这**不是**有证据的质量判负：验收本身不可用，本次运行因没有匹配的通过记录而结束。请检查验收环境与证据可见性，或用 task_board_manage(action=reset-verification) 清除记录的无效验收后重新完成目标。'
+
 /**
  * Provenance of one cron-triggered cascade: when the rule fired and the zone
  * its wall clock was read in. Passed into every launched prompt of that run so
@@ -73,14 +130,25 @@ const UNREADABLE_SETTLE_POLLS = 24
 export interface ScheduledRunContext {
   triggeredAt: number
   timeZone: string
-  cron: string
+  /** Whether this fire came from a recurring rule or a single planned instant. */
+  mode: ScheduleMode
+  /** Cron expression of a recurring rule; absent on a one-shot. */
+  cron?: string
 }
 
 /**
- * Actions that can move an armed trigger. Only these re-arm the native timer;
- * an unrelated card edit leaves the pending fire untouched.
+ * Actions that can change the instant the schedule timer is armed at. Only
+ * these re-arm the native timer; an unrelated card edit leaves the pending fire
+ * untouched.
+ *
+ * The set is the write surface of a rule itself rather than a guess at the UI
+ * flows that reach it: `create` and `import` land a card that already carries
+ * an enabled rule (the new-task dialog and the one-time browser import),
+ * `set-schedule` edits one, and `delete`/`archive` drop one. `update` is
+ * deliberately absent — the update patch cannot carry a schedule — and neither
+ * can the run, move, lineage, permission, verification or label actions.
  */
-const SCHEDULE_WRITE_ACTIONS: ReadonlySet<TaskBoardAction['kind']> = new Set(['set-schedule', 'delete', 'archive'])
+const SCHEDULE_WRITE_ACTIONS: ReadonlySet<TaskBoardAction['kind']> = new Set(['create', 'import', 'set-schedule', 'delete', 'archive'])
 
 /**
  * The native timer face the Host arms through. The cordis `timer` service
@@ -106,6 +174,29 @@ const PROCESS_TIMERS: HostTimerFace = {
   },
 }
 
+/**
+ * The new-card defaults a snapshot publishes, or undefined when this
+ * deployment configures none. A target the board configures nothing for is
+ * omitted instead of published blank, so the browser can tell "no default
+ * model" from "a blank one" (only a hand-edited settings document can express
+ * the latter).
+ */
+function cardDefaultsOf(defaults: CardDefaults): TaskBoardSnapshot['cardDefaults'] {
+  const mode = normalizeTargetId(defaults.mode)
+  const permission = normalizeTargetId(defaults.permission)
+  const model = normalizeTargetId(defaults.model)
+  const reasoningEffort = normalizeTargetId(defaults.reasoningEffort)
+  const published: NonNullable<TaskBoardSnapshot['cardDefaults']> = {
+    ...(mode === undefined ? {} : { mode }),
+    // The snapshot publishes a permission the board's own vocabulary knows; an
+    // out-of-domain value is ignored here exactly as the create path ignores it.
+    ...(isTaskPermission(permission) ? { permission } : {}),
+    ...(model === undefined ? {} : { model }),
+    ...(reasoningEffort === undefined ? {} : { reasoningEffort }),
+  }
+  return Object.keys(published).length === 0 ? undefined : published
+}
+
 export class TaskBoardHostService {
   readonly ledger: HostTaskLedger
   readonly runner: HostExecutionRunner
@@ -113,6 +204,12 @@ export class TaskBoardHostService {
   private readonly listeners = new Set<() => void>()
   /** The one recurring timer: the session-roster poll. */
   private pollTimer: (() => void) | undefined
+  /** Cadence of the roster poll, in seconds (a settings field; see the config schema). */
+  private sessionPollSeconds = DEFAULT_SESSION_POLL_SECONDS
+  /** Pending delay that follows a failed poll pass, if one is armed. */
+  private pollBackoffTimer: (() => void) | undefined
+  /** Consecutive failed poll passes; doubles the next retry delay. */
+  private consecutivePollFailures = 0
   /** The armed schedule timer, if a trigger is pending. */
   private scheduleTimer: (() => void) | undefined
   /** The instant the armed schedule timer targets (ms epoch), for resume detection. */
@@ -121,12 +218,11 @@ export class TaskBoardHostService {
   private pollInFlight = false
   private active = true
   /**
-   * Ids the last roster poll saw as present and idle; undefined while the
-   * roster is unknown. Session reuse (issue #1419) requires this positive
-   * evidence, so a launch before the first successful poll mints a fresh
-   * conversation instead of prompting into a session it cannot see.
+   * Admission control for the session-creating half of a run: one board action
+   * opens a whole subtree, and this is what keeps the Host from asking DSH for
+   * every member's session at once (see {@link LaunchAdmissionQueue}).
    */
-  private idleSessionIds: ReadonlySet<string> | undefined
+  private readonly launches: LaunchAdmissionQueue
   /**
    * Consecutive unreadable-history polls per open execution (see
    * {@link noteUnreadableInspection}). Cleared as soon as an inspection
@@ -138,6 +234,16 @@ export class TaskBoardHostService {
   private readonly verificationCatalog: () => Promise<ModelCatalogView | undefined>
   private readonly team: TaskBoardTeamDispatcher | undefined
   private readonly timers: HostTimerFace
+  /** Live reader of the global native-/goal switch; frozen per execution. */
+  private readonly goalRunEnabled: () => boolean
+  /** Live reader of the deployment's new-card defaults (published and applied per create). */
+  private readonly cardDefaults: () => CardDefaults
+  /**
+   * Live reader of the run-launch admission width: how many launches may be in
+   * flight at once. Read at every admission, so a settings edit bounds the next
+   * launch without remounting the row. Absent means the default.
+   */
+  private readonly runLaunchWidth: () => number
   private lastPowerJson = ''
   private readonly now: () => number
   /** The deployment's workspaces, consulted to resolve a card that pins none. */
@@ -155,14 +261,36 @@ export class TaskBoardHostService {
     now?: () => number
     commandDispatcher?: SessionCommandDispatcher
     workspaceRegistry?: TaskBoardWorkspaceRegistry
+    /**
+     * The owner peer every gateway request the runner makes speaks for.
+     * Production passes the peer bound to the plugin fiber (see
+     * {@link createOwnerPeer}); absent is fine for tests and bare mounts,
+     * where the runner binds one to a fresh root context.
+     */
+    ownerPeer?: GatewayPeer
     /**
      * Permission baseline of the confirmation gate: a fixed value, or a live
      * resolver the board re-reads so a Host Settings change needs no remount.
      */
     sessionDefaultPermission?: TaskPermission | (() => TaskPermission)
     maxSubtaskDepth?: number
+    /**
+     * Live reader of the deployment's new-card defaults (volatile config reads).
+     * The board publishes them for the create dialog and re-reads them for every
+     * create that opts in, so a settings edit reaches the next created card
+     * without remounting the row. Absent means the deployment configures none.
+     */
+    cardDefaults?: () => CardDefaults
     team?: TaskBoardTeamDispatcher
     timers?: HostTimerFace
+    /**
+     * Live GLOBAL native /goal switch (a volatile config read). Read ONCE per
+     * execution, at launch, and carried by value from then on: a settings edit
+     * made while a run is in flight must not arm, disarm or otherwise change the
+     * goal/acceptance contract of that run. Absent means OFF, which is the
+     * default for every deployment that never configured it.
+     */
+    goalRunEnabled?: () => boolean
     /**
      * Live acceptance settings (volatile config reads). Absent keeps goal
      * acceptance OFF for every execution this service opens, which is what a
@@ -171,17 +299,29 @@ export class TaskBoardHostService {
     verificationSettings?: () => VerificationSettings
     /** The host model catalog the acceptance contract resolves its route from. */
     verificationCatalog?: () => Promise<ModelCatalogView | undefined>
+    /**
+     * Live admission width for run launches: the number of launches (one
+     * session creation and its prompt each) that may be in flight at once. Read
+     * per admission, so editing the setting bounds the next launch of a run that
+     * is still queueing. Absent means the default width.
+     */
+    runLaunchWidth?: () => number
   } = {}) {
     this.ledger = options.ledger ?? new HostTaskLedger(undefined, undefined, {
       sessionDefaultPermission: options.sessionDefaultPermission,
       maxSubtaskDepth: options.maxSubtaskDepth,
+      cardDefaults: options.cardDefaults,
     })
-    this.runner = new HostExecutionRunner(gateway, options.commandDispatcher, options.workspaceRegistry)
+    this.runner = new HostExecutionRunner(gateway, options.commandDispatcher, options.workspaceRegistry, undefined, options.ownerPeer)
     this.workspaceRegistry = options.workspaceRegistry
     this.team = options.team
     this.timers = options.timers ?? PROCESS_TIMERS
     this.power = options.power ?? new PowerInhibitor()
     this.now = options.now ?? Date.now
+    this.goalRunEnabled = options.goalRunEnabled ?? (() => false)
+    this.cardDefaults = options.cardDefaults ?? (() => ({}))
+    this.runLaunchWidth = options.runLaunchWidth ?? (() => DEFAULT_RUN_LAUNCH_WIDTH)
+    this.launches = new LaunchAdmissionQueue(() => normalizeRunLaunchWidth(this.runLaunchWidth()))
     this.verificationSettings = options.verificationSettings ?? (() => ({ enabled: false, model: '', reasoningEffort: '' }))
     this.verificationCatalog = options.verificationCatalog ?? (async () => undefined)
     this.extensions = new TaskBoardExtensionRegistry({
@@ -210,8 +350,11 @@ export class TaskBoardHostService {
   start(): void {
     if (this.disposed || this.pollTimer !== undefined) return
     this.syncPowerReasons()
-    this.pollTimer = this.timers.interval(() => { this.schedulePoll() }, SESSION_POLL_MS)
+    this.pollTimer = this.timers.interval(() => { this.schedulePoll() }, sessionPollMs(this.sessionPollSeconds))
     this.schedulePoll()
+    // Boot is also the cleanup catch-up point: an execution that passed before
+    // the Host stopped may still hold its detail (a crash, a failed write).
+    this.cleanupPendingAcceptanceDetail()
     // Boot is a recovery point: an occurrence armed while the Host was down is
     // not replayed, and each schedule rolls to its next future target. A
     // schedule the Board should have served while running is then armed
@@ -219,10 +362,30 @@ export class TaskBoardHostService {
     this.recoverSchedule()
   }
 
-  setConfiguration(active: boolean, preventIdleSleep: boolean): void {
+  /**
+   * Apply the live configuration. The roster cadence is re-read on every
+   * commit, so a settings edit takes effect without a restart; the poll is
+   * scheduled at the new cadence immediately rather than waiting out the old
+   * interval.
+   * @param active - the board's master switch.
+   * @param preventIdleSleep - whether the board holds an idle-sleep assertion.
+   * @param sessionPollSeconds - roster-poll cadence in seconds (clamped).
+   */
+  setConfiguration(active: boolean, preventIdleSleep: boolean, sessionPollSeconds?: number): void {
     const resumed = !this.active && active
     this.active = active
     this.preventIdleSleep = preventIdleSleep
+    const cadence = normalizeSessionPollSeconds(sessionPollSeconds)
+    const retimed = this.pollTimer !== undefined && cadence !== this.sessionPollSeconds
+    this.sessionPollSeconds = cadence
+    if (retimed) {
+      // The recurring timer was armed at the old cadence: replace it and take
+      // the next pass now, so the new interval starts from this commit.
+      this.pollTimer?.()
+      this.pollTimer = this.timers.interval(() => { this.schedulePoll() }, sessionPollMs(this.sessionPollSeconds))
+      this.clearPollBackoff()
+      this.schedulePoll()
+    }
     if (resumed) {
       const current = this.power.snapshot()
       this.power.updateReasons({
@@ -249,6 +412,7 @@ export class TaskBoardHostService {
   snapshot(): TaskBoardSnapshot {
     const state = this.ledger.state()
     const published = this.extensions.published()
+    const cardDefaults = cardDefaultsOf(this.cardDefaults())
     return {
       schemaVersion: TASK_BOARD_SCHEMA_VERSION,
       revision: state.revision,
@@ -258,6 +422,14 @@ export class TaskBoardHostService {
       sessionDefaultPermission: this.ledger.sessionDefaultPermission,
       maxSubtaskDepth: this.ledger.maxSubtaskDepth,
       teamRunAvailable: this.team !== undefined,
+      // The GLOBAL native-/goal switch is published live for the UI, but the
+      // service freezes its own read at launch: this mirror is for the FORM
+      // (enable/disable + explanation), never for a run already in flight.
+      goalRunEnabled: this.goalRunEnabled(),
+      // The new-card defaults are published live for the same reason the switch
+      // is: the create dialog prefills from them, and each creating session
+      // re-reads them for the create it submits.
+      ...(cardDefaults === undefined ? {} : { cardDefaults }),
       ...(Object.keys(published).length === 0 ? {} : { extensions: published }),
     }
   }
@@ -362,9 +534,11 @@ export class TaskBoardHostService {
     }
     const result = this.ledger.applyRequest(requestId, this.withInheritedWorkspace(action, initiator), initiator)
     if (result.runs !== undefined) this.dispatchRuns(result.runs)
-    // A committed schedule write (create / update / toggle / delete) moves the
-    // nearest trigger; re-arm on every action so a newly enabled schedule fires
-    // at its own instant without waiting for the previous target to elapse.
+    // A committed write that can move a rule moves the nearest trigger;
+    // re-arm from the ledger so a created or edited schedule fires at its own
+    // instant instead of waiting out whatever target was armed before it. The
+    // re-arm is derived from the ledger, so a write that moved nothing leaves
+    // the pending fire exactly as it was.
     if (SCHEDULE_WRITE_ACTIONS.has(action.kind)) this.refreshSchedule()
     this.emitStatusChanges(before, initiator)
     if (action.kind === 'delete') this.extensions.emitTaskDeleted({ taskId: action.taskId })
@@ -409,8 +583,17 @@ export class TaskBoardHostService {
 
   dispose(): void {
     this.disposed = true
+    // Launches still waiting for a slot can never start now: settle them so
+    // their cards leave the running column here, instead of waiting for the
+    // next Host start's interrupted-start recovery. Launches already in flight
+    // are left to finish — their session may already exist.
+    const abandoned = this.launches.drain()
+    if (abandoned.length > 0) {
+      safeConsoleError(`[dsh-task-board] ${abandoned.length} run member(s) were still waiting for a launch slot when the Host stopped; each is settled as cancelled`)
+    }
     this.extensions.dispose()
     this.clearScheduleTimer()
+    this.clearPollBackoff()
     this.pollTimer?.()
     this.pollTimer = undefined
     this.power.dispose()
@@ -418,13 +601,15 @@ export class TaskBoardHostService {
     this.listeners.clear()
   }
 
-  private async launch(opened: OpenedRun, others: readonly OpenedRun[] = [], schedule?: ScheduledRunContext): Promise<void> {
+  private async launch(opened: OpenedRun, others: readonly OpenedRun[] = [], schedule?: ScheduledRunContext, freezeContract?: RunContractFreezer): Promise<void> {
+    /** The session this launch attached to the execution, once it exists. */
+    let attached: string | undefined
     try {
       // A team run always mints a fresh Lead session: teammates are immutable
       // children of that session, so reusing an older one would collide on
       // their names and orphan the previous team.
       const team = opened.task.teamRun === true
-      const reuseSessionId = team ? undefined : reusableSessionId(opened.task, this.idleSessionIds)
+      const reuseSessionId = team ? undefined : await this.reuseSessionFor(opened.task)
       // Both modes tell the launched agent what else this run opens; only a team
       // run names teammates, because only then does this session own them.
       const peers = others.length === 0 ? undefined : others.map(other => ({
@@ -444,24 +629,50 @@ export class TaskBoardHostService {
       // retrofit the rule that will judge it. A card that opted out resolves the
       // same contract from an OFF switch: the board-wide switch decides the
       // default, the card decides this execution, and both are read here.
-      const settings = this.verificationSettings()
+      //
+      // The read is the run GROUP's when the queue handed one down: admission
+      // delays a member's launch, so a per-execution read would let a settings
+      // edit made while later members wait reach some members of one run and not
+      // others. One group, one contract — and still frozen before the group's
+      // first session is prompted.
+      const { settings, globalGoalEnabled, catalog } = await (freezeContract ?? (() => this.freezeRunContract()))()
+      // The GLOBAL native-/goal switch is read ONCE per run group and carried by
+      // value for the whole execution: a settings edit after this point can only
+      // affect executions that start later.
+      // The card must ASK for the goal run: the option is off by default, so an
+      // absent value is a plain turn exactly like an explicit false.
+      const goalEnabled = globalGoalEnabled && opened.task.goalRun === true
       // The card's opt-out is a DISTINCT reason, not the board switch: the
       // report must be able to say which of the two turned the gate off.
       const skippedBy: ExecutionVerification['applicability'] = opened.task.skipVerification === true ? 'skipped' : 'disabled'
       const contract = resolveContract(
         { ...settings, enabled: settings.enabled && opened.task.skipVerification !== true },
-        await this.verificationCatalog(),
+        catalog,
       )
+      // An execution that will not become a goal run can never fire the
+      // completion gate, so it is marked with the reason that actually applied:
+      // the global switch being off is its OWN reason, distinct from this run
+      // simply not becoming a goal run (the card never opted in, or a refused or
+      // unavailable /goal command), and it must never read as an accepted run.
+      // The reason names which switch withheld the goal: the GLOBAL master
+      // switch (this board never arms /goal) is a different fact from the card's
+      // own goal option staying off — which is the default, so it is what an
+      // untouched card gets.
+      const notArmed: ExecutionVerification['applicability'] = globalGoalEnabled ? 'goal-unavailable' : 'goal-disabled'
       const initial: ExecutionVerification = {
         contract,
         attempts: [],
-        applicability: team ? 'team-member' : !contract.enabled ? skippedBy : 'goal-unavailable',
+        applicability: team ? 'team-member' : !contract.enabled ? skippedBy : notArmed,
       }
       this.ledger.setVerification(opened.task.id, opened.execution.id, initial)
-      let attached: string | undefined
       const sessionId = await this.runner.launch(opened.task, {
         ...(reuseSessionId === undefined ? {} : { reuseSessionId }),
         ...(promptContext === undefined ? {} : { promptContext }),
+        // The frozen global switch travels with the launch, so the runner's
+        // arming decision is exactly the one made above.
+        goalEnabled,
+        // The same catalog snapshot the acceptance contract was frozen from.
+        catalog,
         // Bind the session to the execution before the prompt is queued, so the
         // completion gate can never observe the agent without its binding.
         onSession: (id) => {
@@ -471,23 +682,75 @@ export class TaskBoardHostService {
         onGoalArmed: (armed) => {
           this.setApplicability(opened.task.id, opened.execution.id, team
             ? 'team-member'
-            : !contract.enabled ? skippedBy : armed ? 'enforced' : 'goal-unavailable')
+            : !contract.enabled ? skippedBy : armed ? 'enforced' : notArmed)
         },
       })
       if (attached === undefined) this.ledger.attachSession(opened.task.id, opened.execution.id, sessionId)
       if (team) for (const teammate of others) this.scheduleTeammate(teammate, sessionId)
     } catch (error) {
-      if (error instanceof SessionLaunchError) {
-        this.ledger.attachSession(opened.task.id, opened.execution.id, error.sessionId)
+      const launchedSession = error instanceof SessionLaunchError ? error.sessionId : undefined
+      if (launchedSession !== undefined) {
+        this.ledger.attachSession(opened.task.id, opened.execution.id, launchedSession)
+      }
+      // A scheduled occurrence that failed before any session existed created
+      // no real execution: refund the run it consumed and record why, so a
+      // failed launch can never silently spend the user's run budget. A manual
+      // run, and a launch that DID reach a session, are never refunded.
+      if (schedule !== undefined && attached === undefined && launchedSession === undefined) {
+        this.refundUnstartedSchedule(opened.task.id)
       }
       this.settleAndNotify(opened.task.id, opened.execution.id, 'failed', error instanceof Error ? error.message : String(error))
     }
   }
 
+  /**
+   * Read the acceptance contract one run group freezes, in the order the board
+   * has always read it: the acceptance settings, then the global native-/goal
+   * switch, then the model catalog that both resolves the contract's route and
+   * decides the reasoning effort the session may be given.
+   */
+  private async freezeRunContract(): Promise<FrozenRunContract> {
+    const settings = this.verificationSettings()
+    const globalGoalEnabled = this.goalRunEnabled() === true
+    const catalog = await this.verificationCatalog()
+    return { settings, globalGoalEnabled, catalog }
+  }
+
+  /**
+   * A {@link RunContractFreezer} that reads once and hands the SAME value to
+   * every later caller of one run group. A read that fails is not cached: the
+   * next member reads again, exactly as a per-execution read would have.
+   */
+  private contractFreezerForRunGroup(): RunContractFreezer {
+    let pending: Promise<FrozenRunContract> | undefined
+    return () => {
+      pending ??= this.freezeRunContract().catch((error: unknown) => {
+        pending = undefined
+        throw error
+      })
+      return pending
+    }
+  }
+
+  /**
+   * Give back the occurrence a launch consumed, for a launch that never reached
+   * a session: a failed launch, or one the Host abandoned while it was still
+   * waiting for an admission slot. A manual run, and a launch that DID reach a
+   * session, are never refunded.
+   */
+  private refundUnstartedSchedule(taskId: string): void {
+    this.ledger.refundScheduledOccurrence(taskId, this.now())
+    // The refund runs after the fire already armed the next target, and a
+    // refunded occurrence can restore one the fire had just cleared (a rule
+    // that spent its last run). Re-arm so the restored occurrence is served
+    // at its own instant rather than lost until some unrelated write.
+    this.refreshSchedule()
+  }
+
   private scheduleTeammate(opened: OpenedRun, leadSessionId: string): void {
-    void this.spawnTeammate(opened, leadSessionId).catch(error => {
+    this.enqueueLaunch(opened, () => this.spawnTeammate(opened, leadSessionId).catch(error => {
       safeConsoleError('[dsh-task-board] teammate spawn settlement failed', error)
-    })
+    }))
   }
 
   /**
@@ -520,21 +783,42 @@ export class TaskBoardHostService {
     }
   }
 
-  private async pollSessions(): Promise<void> {
-    if (this.disposed) return
-    if (!this.active && this.ledger.runtimeView().openExecutions.length === 0) return
+  /**
+   * One roster pass, and whether it could read the session tree.
+   *
+   * The board reads the DSH session roster only while it has something the
+   * roster can decide: an execution to inspect, or a card parked in the running
+   * column whose verdict may arrive from a settle this process never saw. That
+   * gate is what removes the cost the reporter measured — `session/list`
+   * rebuilds every persisted session row (string conversion, object allocation,
+   * a stat per record), and an idle board with no tasks was paying it every few
+   * seconds forever.
+   * @returns whether the roster was readable (an idle pass counts as readable).
+   */
+  private async pollSessions(): Promise<boolean> {
+    if (this.disposed) return true
+    const runtime = this.ledger.runtimeView()
+    if (!this.active) {
+      // A disabled board still settles the runs it opened before it was
+      // switched off, and re-reads the roster while a card sits in the running
+      // column. With neither, the poll is a no-op.
+      if (runtime.openExecutions.length === 0 && runtime.armedSchedules === 0) return true
+    } else if (!runtime.needsSessionState) {
+      // Idle board: nothing to reconcile and nothing to count. Keep the last
+      // power reading (a stale count only delays the release of the idle-sleep
+      // assertion, never starts one) and stand down.
+      return true
+    }
     const running = await this.runner.listRunning()
     const previous = this.power.snapshot()
     if (!running.known) {
-      this.idleSessionIds = undefined
       this.power.updateReasons({
         runningSessions: previous.runningSessions,
-        armedSchedules: this.ledger.armedScheduleCount(),
+        armedSchedules: runtime.armedSchedules,
         sessionStateKnown: false,
       })
-      return
+      return false
     }
-    this.idleSessionIds = new Set(running.items.filter(item => !item.running).map(item => item.sessionId))
     // Fold whatever the board can already decide before spending inspection
     // RPCs: a team run whose Lead recorded its verdict, and any lineage whose
     // members are all settled. Idempotent, so an already folded board is free.
@@ -543,15 +827,44 @@ export class TaskBoardHostService {
     this.emitStatusChanges(foldedBefore)
     // Read after the RPC so executions attached while it was in flight are
     // included in this pass, matching the former full-state snapshot timing.
-    const runtime = this.ledger.runtimeView()
+    const current = this.ledger.runtimeView()
     this.power.updateReasons({
       runningSessions: running.count,
-      armedSchedules: runtime.armedSchedules,
+      armedSchedules: current.armedSchedules,
       sessionStateKnown: true,
     })
     // No unconditional emit here: real changes already emit through the
     // ledger subscription (settles) and the gated power listener above.
-    await this.reconcileExecutions(running.items, runtime.openExecutions)
+    await this.reconcileExecutions(running.items, current.openExecutions)
+    return true
+  }
+
+  /**
+   * The session a run may continue in, for a card that opted into reuse
+   * (issue #1419). Reuse requires positive evidence that the previous session
+   * is present and idle, and that evidence must be read for THIS launch: an
+   * idle board no longer polls, so a roster cached from an earlier pass could
+   * be hours old — either refusing a session that has been idle all along, or
+   * prompting into one that started running since. A card that did not opt in
+   * reads no roster at all, and a read that fails mints a fresh conversation
+   * exactly as an unknown roster always did.
+   * @param task - the task about to run.
+   * @returns the session id to continue in, or undefined for a fresh session.
+   */
+  private async reuseSessionFor(task: TaskRecord): Promise<string | undefined> {
+    if (task.reuseSession !== true) return undefined
+    let running: Awaited<ReturnType<HostExecutionRunner['listRunning']>>
+    try {
+      running = await this.runner.listRunning()
+    } catch (error) {
+      // A read that failed is an unknown roster, and an unknown roster never
+      // reuses; the launch itself must not fail over the reuse probe.
+      this.notePollFailure()
+      safeConsoleError('[dsh-task-board] session roster read for session reuse failed; starting a fresh session', error)
+      return undefined
+    }
+    if (!running.known) return undefined
+    return reusableSessionId(task, new Set(running.items.filter(item => !item.running).map(item => item.sessionId)))
   }
 
   /** Reuse the session list this poll already fetched: one list RPC per tick, not 1 + E. */
@@ -588,11 +901,20 @@ export class TaskBoardHostService {
         // be mistaken for a verified success. Only a matching pass record
         // settles this execution as succeeded.
         if (result.outcome === 'succeeded' && verificationRequired(verification) && passedAttempt(verification) === undefined) {
+          // Two different failures share this branch, and they send the reader
+          // in opposite directions: attempts on record mean the judge ran and
+          // the work did not pass, while zero attempts mean the gate never
+          // opened at all (issue #1837) — the session narrated completion
+          // instead of calling `update_goal(action: complete)`.
           this.settleAndNotify(
             execution.taskId,
             execution.executionId,
             'failed',
-            'goal 验收：本次执行没有匹配的验收通过记录（验收未运行、未通过或报告来自其他执行），按未验收判失败。',
+            verificationNeverInvoked(verification)
+              ? NEVER_INVOKED_VERIFICATION_REASON
+              : verificationOnlyInvalid(verification)
+                ? INVALID_ONLY_VERIFICATION_REASON
+                : NO_MATCHING_PASS_VERIFICATION_REASON,
           )
           continue
         }
@@ -636,6 +958,73 @@ export class TaskBoardHostService {
       outcome,
       ...(error === undefined ? {} : { error }),
     })
+    // The pass record and the settlement are DURABLE by this point (both are in
+    // the ledger above), so the acceptance-only detail may now be cleaned. A
+    // cleanup failure is recorded against the execution and retried on the next
+    // Host start; it never revokes the pass this settlement just wrote.
+    if (outcome === 'succeeded') this.cleanupAcceptanceDetail(taskId, executionId)
+  }
+
+  /**
+   * Remove one execution's acceptance-only detail after it PASSED and settled.
+   *
+   * Deliberately narrow: only the acceptance mechanism's own per-attempt
+   * material (findings, invalid diagnostics, the bulky judge side) is removed,
+   * and only for THIS execution, keyed by its own id in the ledger it belongs
+   * to. No user file, task artifact, raw session history or other execution's
+   * record is read or written. Idempotent by the record's own state, and it
+   * clearly never touches a run that did not pass (the caller's guard) — a
+   * failed or invalid execution keeps everything a repair or a review needs.
+   * @param taskId - the task whose execution settled.
+   * @param executionId - the settled execution.
+   */
+  private cleanupAcceptanceDetail(taskId: string, executionId: string): void {
+    const execution = this.ledger.getTask(taskId)?.executions.find(entry => entry.id === executionId)
+    const verification = execution?.verification
+    // Only an execution with a REAL pass record is cleaned. An execution whose
+    // acceptance never ran (no block) or was disabled/skipped has nothing this
+    // mechanism created, and a failed one must keep its evidence.
+    if (verification === undefined || passedAttempt(verification) === undefined) return
+    if (verification.cleanup?.state === 'cleaned') return
+    try {
+      const cleaned = withAcceptanceDetailCleared(verification, this.now())
+      if (cleaned === undefined) return
+      this.ledger.setVerification(taskId, executionId, cleaned)
+    } catch (error) {
+      // Record the failure so the UI can say the cleanup is pending and the
+      // Host retries it at start; the pass itself is untouched.
+      const attempts = (verification.cleanup?.attempts ?? 0) + 1
+      this.ledger.setVerification(taskId, executionId, {
+        ...verification,
+        cleanup: {
+          state: 'failed',
+          attempts,
+          startedAt: verification.cleanup?.startedAt ?? this.now(),
+          lastError: error instanceof Error ? error.message : String(error),
+          audit: verification.cleanup?.audit ?? [],
+        },
+      })
+      safeConsoleError('[dsh-task-board] acceptance-detail cleanup failed; it is retried on the next Host start', error)
+    }
+  }
+
+  /**
+   * Catch-up pass: clean the acceptance detail of every execution that PASSED
+   * and settled but whose cleanup did not finish (a crash, a failed write, a
+   * Host killed mid-cleanup).
+   *
+   * The same bounds as any other cleanup apply — only a real pass record on a
+   * settled execution is touched — so this can never delete material belonging
+   * to an execution that did not pass, and never a user file.
+   */
+  private cleanupPendingAcceptanceDetail(): void {
+    for (const task of this.ledger.allTasks()) {
+      for (const execution of task.executions) {
+        if (execution.endedAt === undefined) continue
+        if (execution.result !== 'succeeded') continue
+        this.cleanupAcceptanceDetail(task.id, execution.id)
+      }
+    }
   }
 
   private noteUnreadableInspection(execution: OpenExecutionReference, reason: string | undefined): void {
@@ -717,10 +1106,16 @@ export class TaskBoardHostService {
     }
     const before = this.statusMap()
     for (const schedule of this.ledger.dueSchedules(now)) {
-      const next = nextRunAtMs(schedule.cron, schedule.nextRunAt, schedule.timeZone)
+      // The ledger owns both the budget gate and the next target: it refuses a
+      // rule that already spent its runs and stops a one-shot as it fires.
       this.dispatchRuns(
-        this.ledger.openScheduled(schedule.taskId, next, now),
-        { triggeredAt: now, timeZone: schedule.timeZone, cron: schedule.cron },
+        this.ledger.openScheduled(schedule.taskId, now),
+        {
+          triggeredAt: now,
+          timeZone: schedule.timeZone,
+          mode: schedule.mode,
+          ...(schedule.cron === undefined ? {} : { cron: schedule.cron }),
+        },
       )
     }
     this.emitStatusChanges(before)
@@ -739,14 +1134,22 @@ export class TaskBoardHostService {
    * member then launches on its own so one refused participant cannot hold the
    * others back. A team run's members are spawned inside the root's Lead
    * session instead, once that session exists.
+   *
+   * Every launch of one run set goes through the admission queue, which admits
+   * at most `runLaunchWidth` of them at a time — the whole subtree still opens,
+   * members just enter the running column in batches. Order inside the group is
+   * the order they are enqueued here, so the root's session always exists before
+   * any member's, and one member's launch settling (or failing) is what admits
+   * the next. All members share the one contract this group freezes.
    */
   private dispatchRuns(runs: readonly OpenedRun[], schedule?: ScheduledRunContext): void {
     if (runs.length === 0) return
     const root = runs.find(run => run.dispatch !== 'teammate') ?? runs[0]
     const others = runs.filter(run => run !== root)
-    this.scheduleLaunch(root, others, schedule)
+    const freezeContract = this.contractFreezerForRunGroup()
+    this.scheduleLaunch(root, others, schedule, freezeContract)
     for (const run of others) {
-      if (run.dispatch !== 'teammate') this.scheduleLaunch(run, [], schedule)
+      if (run.dispatch !== 'teammate') this.scheduleLaunch(run, [], schedule, freezeContract)
     }
   }
 
@@ -760,20 +1163,104 @@ export class TaskBoardHostService {
     this.ledger.setVerification(taskId, executionId, { ...verification, applicability })
   }
 
-  private scheduleLaunch(opened: OpenedRun, others: readonly OpenedRun[] = [], schedule?: ScheduledRunContext): void {
-    void this.launch(opened, others, schedule).catch(error => {
+  private scheduleLaunch(opened: OpenedRun, others: readonly OpenedRun[] = [], schedule?: ScheduledRunContext, freezeContract?: RunContractFreezer): void {
+    this.enqueueLaunch(opened, () => this.launch(opened, others, schedule, freezeContract).catch(error => {
       safeConsoleError('[dsh-task-board] execution launch settlement failed', error)
-    })
+    }), schedule)
+  }
+
+  /**
+   * Hand one launch to the admission queue, or abandon it on the spot when the
+   * Host is already stopping: a queue entry created after {@link dispose} would
+   * otherwise never be drained, and its card would sit in the running column
+   * until the next Host start recovered it.
+   */
+  private enqueueLaunch(opened: OpenedRun, start: () => Promise<void>, schedule?: ScheduledRunContext): void {
+    const launch: QueuedLaunch = {
+      groupId: opened.execution.runGroupId ?? opened.task.id,
+      start: async () => {
+        // Waiting for a slot is time the execution can be settled in: a manual
+        // settle, or a team run folded onto its Lead's verdict, can close a
+        // member's execution before it ever started. Starting it then would
+        // create a session no execution is watching, so a launch whose
+        // execution is already closed is dropped instead.
+        if (!this.isExecutionOpen(opened)) return
+        await start()
+      },
+      abandon: () => this.abandonQueuedRun(opened, schedule),
+    }
+    if (this.disposed) {
+      launch.abandon()
+      return
+    }
+    this.launches.enqueue(launch)
+  }
+
+  /** Whether one opened execution is still open in the ledger. */
+  private isExecutionOpen(opened: OpenedRun): boolean {
+    const execution = this.ledger.getTask(opened.task.id)?.executions.find(entry => entry.id === opened.execution.id)
+    return execution !== undefined && execution.endedAt === undefined
+  }
+
+  /**
+   * Take one launch that never started out of the running column.
+   *
+   * Settled as CANCELLED, not failed: nothing about the run's work went wrong —
+   * the Host stopped before the launch got a slot, which is exactly what the
+   * next start's interrupted-start recovery records for an execution that never
+   * reached a session. A scheduled occurrence that never reached a session is
+   * refunded on the same terms as any other pre-session failure, so a run the
+   * Host never started cannot silently spend the user's run budget.
+   */
+  private abandonQueuedRun(opened: OpenedRun, schedule?: ScheduledRunContext): void {
+    if (schedule !== undefined) this.refundUnstartedSchedule(opened.task.id)
+    this.settleAndNotify(opened.task.id, opened.execution.id, 'cancelled', ABANDONED_LAUNCH_REASON)
   }
 
   private schedulePoll(): void {
     if (this.pollInFlight || this.disposed) return
     this.pollInFlight = true
-    void this.pollSessions().catch(error => {
+    void this.pollSessions().then((rosterReadable) => {
+      // A pass that could not read the roster is a failure even though it
+      // resolved: the board knows no more about its sessions than before.
+      if (rosterReadable) this.consecutivePollFailures = 0
+      else this.notePollFailure()
+    }).catch(error => {
+      this.notePollFailure()
       safeConsoleError('[dsh-task-board] session polling failed', error)
     }).finally(() => { this.pollInFlight = false })
   }
 
+  /**
+   * Count one failed pass and arm the retry that follows it.
+   *
+   * A session tree that is down is retried on a doubling delay instead of
+   * hammering it on the fixed cadence: the heartbeat would otherwise repeat
+   * every failure — and every retry inside {@link HostExecutionRunner.listRunning}
+   * — at exactly the interval the reporter measured.
+   */
+  private notePollFailure(): void {
+    this.consecutivePollFailures += 1
+    this.armPollBackoff()
+  }
+
+  /** Arm the retry that follows a failed pass, doubling up to the ceiling. */
+  private armPollBackoff(): void {
+    if (this.disposed) return
+    this.pollBackoffTimer?.()
+    const delay = Math.min(sessionPollMs(this.sessionPollSeconds) * 2 ** Math.min(this.consecutivePollFailures, 8), POLL_FAILURE_MAX_BACKOFF_MS)
+    this.pollBackoffTimer = this.timers.timeout(() => {
+      this.pollBackoffTimer = undefined
+      this.schedulePoll()
+    }, delay)
+  }
+
+  /** Drop a pending retry; the next regular tick takes over. */
+  private clearPollBackoff(): void {
+    this.pollBackoffTimer?.()
+    this.pollBackoffTimer = undefined
+  }
+
   /**
    * Re-arm from the ledger's current targets. Callers that just changed a
    * schedule (the host routes, the agent tools) invoke this after the write