dsh-taskboard 0.7.1 → 0.7.4

package/src/host/execution.ts

@@ -6,7 +6,8 @@
  * prompt is submitted as an ordinary user message, and the turn settlement
  * (turn/end reason) is folded back into the task's execution record.
  *
- * Every execution is a NEW session: clean context, no reuse of previous runs.
+ * Manual runs open fresh sessions; scheduled runs can resume their previous
+ * session while keeping separate execution records and settlement watchers.
  *
  * @module dsh-taskboard/host/execution
  */
@@ -16,7 +17,10 @@ import {
   effectivePrompt,
   newCommentId,
   newExecutionId,
+  nextCronTime,
   normalizeBody,
+  parseCron,
+  spawnNextCycle,
   type ExecutionRecord,
   type ExecutionRepoEvidence,
   type IsolationMode,
@@ -35,6 +39,8 @@ export const DEFAULT_MAX_CONCURRENT = 3
 
 /** Narrow agents face (the registry's create, structurally). */
 export interface AgentsFace {
+  /** Restore a compatible scheduled session; undefined means it is unavailable. */
+  resumeScheduled?(sessionId: string, options: Parameters<AgentsFace['create']>[0]): Promise<Awaited<ReturnType<AgentsFace['create']>> | undefined>
   create(options: {
     sessionId: string
     meta?: { cwd?: string; agentPreset?: string }
@@ -44,11 +50,15 @@ export interface AgentsFace {
   }): Promise<{
     agent: {
       id: string
+      /** Present on the real DSH agent; rechecked immediately before dispatch. */
+      readonly status?: 'idle' | 'running'
       followup(message: unknown): void
       inject(message: unknown): void
       whenIdle(): Promise<void>
     }
     dispose(): Promise<void>
+    /** Live sessions borrowed from another owner must survive cancelled startup. */
+    borrowed?: boolean
   }>
 }
 
@@ -269,15 +279,17 @@ export class ExecutionService {
    * releasing its run entry, so a success settlement can never race it into
    * the ledger and record a failed run as succeeded.
    */
-  private noteFailure(sessionId: string, message: string): Promise<void> {
+  private noteFailure(sessionId: string, message: string, executionId?: string): Promise<void> {
     // The failed session may already have committed work — collect the
     // evidence (best effort) BEFORE marking the execution failed (0.3.1).
-    const entry = [...this.runs.values()].find(e => e.sessionId === sessionId)
+    const match = [...this.runs.entries()].find(([id, e]) => e.sessionId === sessionId && (executionId === undefined || id === executionId))
+    if (match === undefined) return Promise.resolve()
+    const [failedId, entry] = match
     return this.collectEvidence(entry?.prepared).then(evidence =>
       this.deps.store.mutate('execution-recorded', (ledger) => {
         for (const task of ledger.tasks) {
           for (const execution of task.executions) {
-            if (execution.sessionId === sessionId && execution.outcome === 'running') {
+            if (execution.id === failedId && execution.outcome === 'running') {
               execution.outcome = 'failed'
               execution.error = message.slice(0, 500)
               execution.endedAt = this.deps.now()
@@ -355,7 +367,7 @@ export class ExecutionService {
     }
 
     const executionId = newExecutionId()
-    const sessionId = this.deps.mintSessionId?.() ?? `session-taskboard-${crypto.randomUUID()}`
+    let sessionId = this.deps.mintSessionId?.() ?? `session-taskboard-${crypto.randomUUID()}`
 
     // 0. Resolve code isolation (plan §3.2): explicit 'none' → zero git calls;
     //    'worktree' (also the omitted default) → prepare below, degrading to
@@ -372,7 +384,18 @@ export class ExecutionService {
         gate = `no task ${taskId}`
         return undefined
       }
-      if (target.status === 'in_progress') {
+      // A status may change after the scheduler selected/advanced the task.
+      // Recheck at the atomic execution gate so terminal tasks cannot be
+      // revived by that race. Only todo fires scheduled (periodic or one-
+      // shot); an in_review card is finished work and never refires — a
+      // periodic run's successor todo card carries the schedule onward.
+      // Manual reruns keep their existing semantics.
+      if (trigger === 'scheduled' && target.status !== 'todo') {
+        gate = `scheduled task is not actionable (${target.status})`
+        return undefined
+      }
+      if (target.status === 'in_progress' || target.executions.some(e => e.outcome === 'running')
+        || [...this.runs.values()].some(e => target.executions.some(x => x.sessionId === e.sessionId))) {
         gate = 'task is already in progress'
         return undefined
       }
@@ -400,45 +423,45 @@ export class ExecutionService {
     })
     if (gate !== undefined) return { ok: false, error: gate }
 
-    // 1b. Worktree preparation (fail-soft): any failure degrades this run to
-    //     the original directory with an isolationNote — the ledger and the
-    //     execution pipeline itself never fail over git. 0.6.3: preparation
-    //     builds a whole-workspace MIRROR (root repo + nested repos); a plain
-    //     single-repo workspace keeps the legacy record shape everywhere.
     let isolationNote: string | undefined
     let prepared: PreparedMirror | undefined
-    if (isolation === 'worktree') {
-      if (this.deps.git === undefined) {
-        isolationNote = 'git 集成不可用，已在原目录执行'
-        await this.patchExecution(executionId, { isolation: 'none', isolationNote, branch: undefined, worktreePath: undefined, baseCommit: undefined })
-      } else {
-        const outcome = await prepareMirror(
-          { git: this.deps.git, scanner: this.deps.scanner ?? createRepoScanner() },
-          { workspacePath: workspace.path, taskId: task.id, branch, reuse: options?.reuseWorktree === true },
-        )
-        if ('mirror' in outcome) {
-          prepared = outcome.mirror
-          await this.pinBranches(task, prepared)
-          // Persist the isolation facts of the run (branch is already on the
-          // record from the gate mutation). The root repo keeps the legacy
-          // flat fields; non-legacy mirrors also record per-repo entries.
-          const root = prepared.repos[0]
-          await this.patchExecution(executionId, {
-            worktreePath: root?.worktreePath,
-            baseCommit: root?.baseCommit,
-            ...(!isLegacySingle(prepared)
-              ? { repos: prepared.repos.map(r => ({ repo: r.repo, branch: r.branch, worktreePath: r.worktreePath, baseCommit: r.baseCommit })) }
-              : {}),
-          })
-        } else {
-          isolationNote = outcome.note
-          // Degraded run: clear the optimistic worktree markers.
+
+    // Check reusable sessions before resetting any scheduled worktree.
+    const prepareIsolation = async (): Promise<void> => {
+      if (isolation === 'worktree') {
+        if (this.deps.git === undefined) {
+          isolationNote = 'git 集成不可用，已在原目录执行'
           await this.patchExecution(executionId, { isolation: 'none', isolationNote, branch: undefined, worktreePath: undefined, baseCommit: undefined })
+        } else {
+          const outcome = await prepareMirror(
+            { git: this.deps.git, scanner: this.deps.scanner ?? createRepoScanner() },
+            { workspacePath: workspace.path, taskId: task.id, branch, reuse: options?.reuseWorktree === true },
+          )
+          if ('mirror' in outcome) {
+            prepared = outcome.mirror
+            await this.pinBranches(task, prepared)
+            // Persist the isolation facts of the run (branch is already on the
+            // record from the gate mutation). The root repo keeps the legacy
+            // flat fields; non-legacy mirrors also record per-repo entries.
+            const root = prepared.repos[0]
+            await this.patchExecution(executionId, {
+              worktreePath: root?.worktreePath,
+              baseCommit: root?.baseCommit,
+              ...(!isLegacySingle(prepared)
+                ? { repos: prepared.repos.map(r => ({ repo: r.repo, branch: r.branch, worktreePath: r.worktreePath, baseCommit: r.baseCommit })) }
+                : {}),
+            })
+          } else {
+            isolationNote = outcome.note
+            // Degraded run: clear the optimistic worktree markers.
+            await this.patchExecution(executionId, { isolation: 'none', isolationNote, branch: undefined, worktreePath: undefined, baseCommit: undefined })
+          }
         }
       }
     }
+    if (trigger !== 'scheduled') await prepareIsolation()
 
-    // 2. Create the fresh agent+session inside the task's project, carrying
+    // 2. Create or resume the agent+session inside the task's project, carrying
     //    the pinned model — or the deployment default when unpinned (the
     //    persona template renders {{model}}, so the session always needs one).
     //    The session cwd is ALWAYS the project root: DSH's session model
@@ -463,9 +486,10 @@ export class ExecutionService {
       return { ok: false, error: `preset composition failed: ${message}` }
     }
     let handle: Awaited<ReturnType<AgentsFace['create']>>
+    let sessionReuseKey: string | undefined
     try {
       const model = task.model ?? this.deps.defaultModel?.()
-      handle = await this.deps.agents.create({
+      const createOptions: Parameters<AgentsFace['create']>[0] = {
         sessionId,
         meta: {
           cwd: workspace.path,
@@ -479,7 +503,22 @@ export class ExecutionService {
           },
         } : {}),
         ...(composition !== undefined ? { setup: composition.setup } : {}),
-      })
+      }
+      // Persist the effective settings, including resolved defaults. Never
+      // continue history under a different project, model, preset or boundary.
+      sessionReuseKey = JSON.stringify([
+        task.workspaceId, workspace.path, composition?.agentPreset ?? null,
+        model?.provider ?? null, model?.model ?? null, model?.reasoningEffort ?? null,
+        task.permission ?? DEFAULT_PERMISSION, isolation,
+      ])
+      const previous = trigger === 'scheduled'
+        ? [...task.executions].reverse().find(e => e.trigger === 'scheduled' && e.sessionId !== undefined)
+        : undefined
+      const resumed = previous?.sessionReuseKey === sessionReuseKey && previous.sessionId !== undefined
+        ? await this.deps.agents.resumeScheduled?.(previous.sessionId, createOptions)
+        : undefined
+      handle = resumed ?? await this.deps.agents.create(createOptions)
+      sessionId = handle.agent.id
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error)
       await this.patchExecution(executionId, { outcome: 'failed', error: message.slice(0, 500), endedAt: this.deps.now() })
@@ -489,6 +528,8 @@ export class ExecutionService {
       return { ok: false, error: message }
     }
 
+    if (trigger === 'scheduled') await prepareIsolation()
+
     // R3: the startup path above awaited seconds of git + agent work. A
     // cancel() that landed inside that window already settled the execution
     // (cancelled + task back to todo) — with nothing registered in `runs`,
@@ -499,7 +540,7 @@ export class ExecutionService {
     const stillRunning = await this.deps.store.read(ledger =>
       ledger.tasks.some(t => t.executions.some(e => e.id === executionId && e.outcome === 'running')))
     if (!stillRunning) {
-      await handle.dispose().catch(() => { /* best effort */ })
+      if (!handle.borrowed) await handle.dispose().catch(() => { /* best effort */ })
       // S1: do not leave the startup artifacts behind a cancelled run either.
       await this.cleanupMirror(prepared, workspace.path)
       return { ok: false, error: 'cancelled during startup' }
@@ -523,7 +564,26 @@ export class ExecutionService {
     } catch { /* cosmetic */ }
 
     // 4. Record the session id (execution is really started now).
-    await this.patchExecution(executionId, { sessionId })
+    await this.deps.store.mutate('execution-recorded', ledger => {
+      const target = ledger.tasks.find(t => t.id === taskId)
+      const execution = target?.executions.find(e => e.id === executionId && e.outcome === 'running')
+      if (target === undefined || execution === undefined) return undefined
+      Object.assign(execution, { sessionId, ...(trigger === 'scheduled' ? { sessionReuseKey } : {}) })
+      target.claimedBy = sessionId
+      return [target]
+    })
+
+    // Attach/ledger writes above may yield to manual activity or cancellation.
+    // Do not inject a scheduled prompt into an already running conversation.
+    const current = this.deps.store.get(taskId)?.executions.find(e => e.id === executionId)
+    if (current?.outcome !== 'running' || handle.agent.status === 'running') {
+      if (!handle.borrowed) await handle.dispose().catch(() => { /* best effort */ })
+      if (current?.outcome === 'running') {
+        await this.patchExecution(executionId, { outcome: 'failed', error: 'scheduled session is busy', endedAt: this.deps.now() })
+        await this.revertProgress(taskId)
+      }
+      return { ok: false, error: current?.outcome === 'running' ? 'scheduled session is busy' : 'cancelled during startup' }
+    }
 
     // 5. Submit the opening pair and settle on quiescence (turn/end errors
     //    were already folded by the listener). Two messages, ONE turn:
@@ -551,6 +611,7 @@ export class ExecutionService {
     //    when the session did NOT follow the handoff protocol — auto-move the
     //    card to in_review with a system comment.
     const settle = (): void => {
+      if (!this.runs.has(executionId)) return
       this.runs.delete(executionId)
       void this.settleExecution(executionId, sessionId, prepared)
     }
@@ -562,7 +623,7 @@ export class ExecutionService {
     // succeeded (and auto-moved to in_review). Now only the failure
     // settlement writes, and the run entry is released after it commits.
     void handle.agent.whenIdle().then(settle, () => {
-      this.noteFailure(sessionId, 'agent did not reach quiescence')
+      this.noteFailure(sessionId, 'agent did not reach quiescence', executionId)
         .then(() => { this.runs.delete(executionId) })
         .catch(() => { this.runs.delete(executionId) })
     })
@@ -594,7 +655,7 @@ export class ExecutionService {
             delete t.claimedAt
           }
           if (t.status === 'in_progress') {
-            const commented = t.comments.some(c => c.threadId === sessionId)
+            const commented = t.comments.some(c => c.threadId === sessionId && c.createdAt >= (execution.startedAt ?? 0))
             t.comments.push({
               id: newCommentId(),
               body: normalizeBody(commented
@@ -607,6 +668,38 @@ export class ExecutionService {
             t.status = 'in_review'
             t.updatedAt = now
             t.updatedBy = { kind: 'system' }
+            // Periodic scheduled success (定期执行): the finished card stays
+            // here for acceptance while a fresh todo card minted from it
+            // carries the cron onward. The cron is consumed either way so
+            // the in_review card can never refire.
+            if (execution.trigger === 'scheduled' && t.execution.cron !== undefined) {
+              const match = parseCron(t.execution.cron)
+              const next = match === null ? undefined : nextCronTime(match, now) ?? undefined
+              if (next !== undefined) {
+                const successor = spawnNextCycle(t, executionId, now)
+                t.execution = { mode: 'claim' }
+                t.comments.push({
+                  id: newCommentId(),
+                  body: normalizeBody(`[系统] 定期任务本轮执行完毕，定时已由新待办卡 ${successor.id} 承接，请审查本卡后验收。`),
+                  systemKey: 'sys.periodicHandoff',
+                  systemParams: { nextTaskId: successor.id },
+                  version: 1,
+                  createdAt: now,
+                })
+                ledger.tasks.push(successor)
+                return [t, successor]
+              }
+              // Dead cron (no match within the scan window): consume it with
+              // a comment instead of letting the handoff die silently.
+              t.execution = { mode: 'claim' }
+              t.comments.push({
+                id: newCommentId(),
+                body: normalizeBody('[系统] 定期表达式已无未来触发时间，本轮结束后定时停用；如需继续请重新设置。'),
+                systemKey: 'sys.cronDead',
+                version: 1,
+                createdAt: now,
+              })
+            }
           }
           return [t]
         }
@@ -861,4 +954,4 @@ export class ExecutionService {
       return undefined
     })
   }
-}
+}

package/src/host/routes.ts

@@ -139,7 +139,7 @@ function normalizeTemplateSpec(raw: unknown, now: number): TaskTemplate['task']
   if (presetId !== undefined && presetId.trim().length > 0) spec.presetId = presetId.trim()
   if (permission !== undefined && permission.trim().length > 0) spec.permission = asPermission(permission)
   if (e.execution !== undefined) {
-    spec.execution = normalizeExecution(e.execution as { mode?: string; cron?: string }, now)
+    spec.execution = normalizeExecution(e.execution as { mode?: string; cron?: string; runAt?: unknown }, now)
   }
   if (e.model !== undefined) spec.model = normalizeModel(e.model)
   if (e.checklist !== undefined) {
@@ -651,7 +651,7 @@ export function registerTaskboardRoutes(ctx: Context, options: TaskboardRoutesOp
           if (status !== 'backlog' && status !== 'todo') {
             throw new Error('Error: invalid_transition: a new task must start as backlog or todo')
           }
-          const execution = normalizeExecution((body.execution as { mode?: string; cron?: string } | undefined) ?? {}, options.now())
+          const execution = normalizeExecution((body.execution as { mode?: string; cron?: string; runAt?: unknown } | undefined) ?? {}, options.now())
           const model = body.model === undefined ? undefined : checkModel(body.model, options.modelProviders)
           const isolationRaw = str(body, 'isolation')
           // 0.5.0: an omitted isolation is MATERIALIZED from the board
@@ -747,7 +747,7 @@ export function registerTaskboardRoutes(ctx: Context, options: TaskboardRoutesOp
               }
               if (typeof body.blocked === 'boolean') next.blocked = body.blocked
               // The GUI (task owner surface) may edit model/execution; null clears the model.
-              if (body.execution !== undefined) next.execution = normalizeExecution(body.execution as { mode?: string; cron?: string }, options.now())
+              if (body.execution !== undefined) next.execution = normalizeExecution(body.execution as { mode?: string; cron?: string; runAt?: unknown }, options.now())
               if (body.model === null) next.model = undefined
               else if (body.model !== undefined) next.model = checkModel(body.model, options.modelProviders)
               // Isolation may change only before the first execution (分支与基线
@@ -821,6 +821,7 @@ export function registerTaskboardRoutes(ctx: Context, options: TaskboardRoutesOp
             await store.mutate('task-moved', ledger => {
               const { index, task } = liveTaskAt(ledger, id)
               if (ifVersion !== task.version) throw new Error(`Error: version_conflict: stale version ${ifVersion} (current ${task.version})`)
+              if (task.status !== 'in_review') throw new Error(`Error: invalid_transition: reject requires in_review (current ${task.status})`)
               if (!canTransition(task.status, 'todo')) throw new Error(`Error: invalid_transition: illegal transition ${task.status} → todo`)
               next = structuredClone(task)
               next.status = 'todo'

package/src/host/scheduled-session.ts

@@ -0,0 +1,68 @@
+/** Adapt DSH's live-agent and durable-session APIs for recurring executions. */
+import type { AgentsFace } from './execution.ts'
+
+type CreateOptions = Parameters<AgentsFace['create']>[0]
+type Handle = Awaited<ReturnType<AgentsFace['create']>>
+type Header = { cwd?: string; agentPreset?: string }
+
+export interface ScheduledSessionDeps {
+  agents: {
+    get(id: string): (Handle['agent'] & {
+      session: { header: Header }
+      options: CreateOptions['agentOptions']
+      cancel(cause: { kind: 'user' }): void
+    }) | undefined
+    resume(options: { resumeSessionId: string; agentOptions?: CreateOptions['agentOptions']; setup?: CreateOptions['setup'] }): Promise<Handle>
+  }
+  persistence(): { stat(id: string): Promise<{ header: Header } | undefined> } | undefined
+  isArchived(id: string): boolean
+}
+
+/**
+ * Only confirmed absence, archival or incompatible configuration permits a
+ * replacement session... and so does any resume obstacle: busy, locked or
+ * corrupt sessions degrade to a brand-new conversation (issue #26 policy),
+ * trading history continuity for guaranteed execution progress.
+ */
+export function scheduledSessionResumer(deps: ScheduledSessionDeps): NonNullable<AgentsFace['resumeScheduled']> {
+  return async (sessionId, options) => {
+    if (deps.isArchived(sessionId)) return undefined
+    const compatible = (header: Header): boolean => header.cwd === options.meta?.cwd
+      && header.agentPreset === options.meta?.agentPreset
+    const live = deps.agents.get(sessionId)
+    if (live !== undefined) {
+      // Busy: never queue behind the running conversation — fall back to a
+      // fresh session so the scheduled trigger still makes progress.
+      if (live.status !== 'idle') return undefined
+      if (!compatible(live.session.header)) return undefined
+      const model = options.agentOptions
+      if (live.options?.provider !== model?.provider || live.options?.model !== model?.model
+        || live.options?.reasoningEffort !== model?.reasoningEffort) return undefined
+      return {
+        agent: live,
+        borrowed: true,
+        // A registry lookup grants no ownership. Cancel this activity without
+        // disposing the agent owned by another service (for example the UI).
+        dispose: async () => { live.cancel({ kind: 'user' }); await live.whenIdle() },
+      }
+    }
+    // Unreadable metadata (locked/corrupt/disk trouble) degrades to a fresh
+    // session rather than failing the whole scheduled run.
+    let stored: { header: Header } | undefined
+    try {
+      const persistence = deps.persistence()
+      stored = await persistence?.stat(sessionId)
+    } catch { return undefined }
+    if (stored === undefined || !compatible(stored.header)) return undefined
+    // Recheck after the asynchronous metadata read, including a GUI resume.
+    if (deps.isArchived(sessionId)) return undefined
+    if (deps.agents.get(sessionId) !== undefined) return undefined
+    try {
+      return await deps.agents.resume({
+        resumeSessionId: sessionId,
+        ...(options.agentOptions !== undefined ? { agentOptions: options.agentOptions } : {}),
+        ...(options.setup !== undefined ? { setup: options.setup } : {}),
+      })
+    } catch { return undefined }
+  }
+}

package/src/host/scheduler.ts

@@ -92,28 +92,77 @@ export class SchedulerService {
     const now = this.deps.now()
     const ledger: TaskLedger = this.deps.store.snapshot()
     for (const task of ledger.tasks) {
-      if (task.execution.mode !== 'scheduled' || task.execution.cron === undefined) continue
-      if (task.execution.nextRunAt === undefined) continue
-      if (task.status === 'in_progress' || task.trashedAt !== undefined) continue
-      if (task.execution.nextRunAt > now) continue
+      if (task.execution.mode !== 'scheduled' || task.trashedAt !== undefined) continue
+      // Only todo fires. A finished periodic run settles in review (its cron
+      // moves to a freshly minted successor todo card), and terminal/parked
+      // states retain their config so an explicit reopen can resume — none
+      // of these ever refire from here.
+      if (task.status !== 'todo') continue
       // At the concurrency cap (S4: checked FRESH per task — runs register
       // only after agent creation, so a once-per-tick snapshot under-counted
-      // the startup window): leave nextRunAt in the past and retry next tick
-      // — advancing here would silently burn this window.
+      // the startup window): leave the due time in place and retry next tick
+      // — advancing/consuming here would silently burn this window.
       if (this.deps.execution.inFlight() >= (this.deps.maxConcurrent ?? DEFAULT_MAX_CONCURRENT)) continue
-      const missed = now - task.execution.nextRunAt > SKIP_AFTER_MS
 
-      // Advance the schedule AND record the trigger in ONE mutation (S13:
-      // one revision bump, one broadcast, and the two writes can no longer
-      // straddle a status change), then run unless the window was missed.
-      await this.advanceAndMark(task.id, now, missed ? undefined : task.execution.nextRunAt)
-      if (missed) continue
-      await this.deps.execution.run(task.id, 'scheduled').catch(error => {
-        console.error('[dsh-taskboard] scheduled run failed:', error)
-      })
+      if (task.execution.cron !== undefined) {
+        // Periodic (定期执行): refire at every cron match.
+        if (task.execution.nextRunAt === undefined) continue
+        if (task.execution.nextRunAt > now) continue
+        const missed = now - task.execution.nextRunAt > SKIP_AFTER_MS
+
+        // Advance the schedule AND record the trigger in ONE mutation (S13:
+        // one revision bump, one broadcast, and the two writes can no longer
+        // straddle a status change), then run unless the window was missed.
+        await this.advanceAndMark(task.id, now, missed ? undefined : task.execution.nextRunAt)
+        if (missed) continue
+        await this.deps.execution.run(task.id, 'scheduled').catch(error => {
+          console.error('[dsh-taskboard] scheduled run failed:', error)
+        })
+      } else if (task.execution.runAt !== undefined) {
+        // One-shot (定时执行): fire once at the instant, then consume it.
+        const due = task.execution.runAt
+        if (due > now) continue
+        const missed = now - due > SKIP_AFTER_MS
+
+        // Consume the one-shot AND record the trigger in ONE mutation, so a
+        // failure can never re-fire it (the settle path returns the card to
+        // todo with a comment, and the gone runAt keeps it there).
+        await this.consumeRunAt(task.id, now, missed ? due : undefined)
+        if (missed) continue
+        await this.deps.execution.run(task.id, 'scheduled').catch(error => {
+          console.error('[dsh-taskboard] scheduled run failed:', error)
+        })
+      }
     }
   }
 
+  /**
+   * Consume a one-shot task's runAt in one serial-queue mutation: the field
+   * and nextRunAt are cleared the moment the trigger fires, so the task can
+   * never fire twice. A window missed while the host was down is consumed
+   * too, with a system comment instead of a silent drop.
+   */
+  private async consumeRunAt(taskId: string, now: number, missedDue: number | undefined): Promise<void> {
+    await this.deps.store.mutate('task-updated', (ledger) => {
+      const task = ledger.tasks.find(t => t.id === taskId)
+      if (task === undefined || task.execution.runAt === undefined) return undefined
+      if (task.status !== 'todo' || task.trashedAt !== undefined) return undefined
+      delete task.execution.runAt
+      task.execution.nextRunAt = undefined
+      task.execution.lastTriggeredAt = now
+      if (missedDue !== undefined) {
+        task.comments.push({
+          id: newCommentId(),
+          body: normalizeBody('[系统] 定时执行错过触发时间（主机当时未运行），本次不再补跑；可手动执行或修改定时。'),
+          systemKey: 'sys.runAtMissed',
+          version: 1,
+          createdAt: now,
+        })
+      }
+      return [task]
+    })
+  }
+
   /**
    * Recompute the next run and record the trigger instant for one scheduled
    * task, in one serial-queue mutation. S12: a cron that can no longer match
@@ -126,7 +175,7 @@ export class SchedulerService {
     await this.deps.store.mutate('task-updated', (ledger) => {
       const task = ledger.tasks.find(t => t.id === taskId)
       if (task === undefined || task.execution.cron === undefined) return undefined
-      if (task.status === 'in_progress' || task.trashedAt !== undefined) return undefined
+      if (task.status !== 'todo' || task.trashedAt !== undefined) return undefined
       const match = parseCron(task.execution.cron)
       const next = match === null ? undefined : nextCronTime(match, now) ?? undefined
       if (next === undefined) {

package/src/host/session-sync.ts

@@ -15,8 +15,11 @@ import {
   newCommentId,
   newExecutionId,
   newTaskId,
+  nextCronTime,
   normalizeBody,
   normalizeTitle,
+  parseCron,
+  spawnNextCycle,
   type TaskRecord,
 } from '../shared/protocol.ts'
 import type { EventsFace } from './execution.ts'
@@ -604,8 +607,10 @@ export class ExternalSessionSyncService {
       if (task === undefined || task.trashedAt !== undefined) return undefined
 
       // Settle running execution
+      let scheduledTrigger = false
       for (const exec of task.executions) {
         if (exec.sessionId === sessionId && exec.outcome === 'running') {
+          scheduledTrigger = exec.trigger === 'scheduled'
           exec.endedAt = now
           if (isFailure) {
             exec.outcome = 'failed'
@@ -645,6 +650,35 @@ export class ExternalSessionSyncService {
             version: 1,
             createdAt: now,
           })
+          // Periodic scheduled success (定期执行): same handoff as the
+          // execution service — the finished card stays in review while a
+          // fresh todo card carries the cron onward.
+          if (scheduledTrigger && task.execution.cron !== undefined) {
+            const match = parseCron(task.execution.cron)
+            const next = match === null ? undefined : nextCronTime(match, now) ?? undefined
+            if (next !== undefined) {
+              const successor = spawnNextCycle(task, undefined, now)
+              task.execution = { mode: 'claim' }
+              task.comments.push({
+                id: newCommentId(),
+                body: normalizeBody(`[系统] 定期任务本轮执行完毕，定时已由新待办卡 ${successor.id} 承接，请审查本卡后验收。`),
+                systemKey: 'sys.periodicHandoff',
+                systemParams: { nextTaskId: successor.id },
+                version: 1,
+                createdAt: now,
+              })
+              ledger.tasks.push(successor)
+              return [task, successor]
+            }
+            task.execution = { mode: 'claim' }
+            task.comments.push({
+              id: newCommentId(),
+              body: normalizeBody('[系统] 定期表达式已无未来触发时间，本轮结束后定时停用；如需继续请重新设置。'),
+              systemKey: 'sys.cronDead',
+              version: 1,
+              createdAt: now,
+            })
+          }
         }
       }
       return [task]