diff --git a/api/openapi.json b/api/openapi.json
index 8f7fac00..5c5ae5cb 100644
--- a/api/openapi.json
+++ b/api/openapi.json
@@ -4367,6 +4367,10 @@
             "format": "date-time",
             "type": "string"
           },
+          "creatorUserId": {
+            "format": "uuid",
+            "type": "string"
+          },
           "disabledReason": {
             "nullable": true,
             "type": "string"
@@ -4382,6 +4386,10 @@
             "format": "uuid",
             "type": "string"
           },
+          "model": {
+            "nullable": true,
+            "type": "string"
+          },
           "name": {
             "type": "string"
           },
@@ -4419,6 +4427,7 @@
         "required": [
           "id",
           "issueId",
+          "creatorUserId",
           "name",
           "prompt",
           "agentId",
@@ -5056,6 +5065,11 @@
             "format": "uuid",
             "type": "string"
           },
+          "scheduledTaskId": {
+            "format": "uuid",
+            "nullable": true,
+            "type": "string"
+          },
           "spaceId": {
             "format": "uuid",
             "type": "string"
@@ -5073,7 +5087,8 @@
               "issue_run.thread_changed",
               "project.repository_updated",
               "issue.conversation_changed",
-              "scheduled_task.artifacts_updated"
+              "scheduled_task.artifacts_updated",
+              "space.scheduled_tasks_updated"
             ],
             "type": "string"
           },
@@ -27024,6 +27039,9 @@
                     "format": "uuid",
                     "type": "string"
                   },
+                  "model": {
+                    "type": "string"
+                  },
                   "name": {
                     "type": "string"
                   },
@@ -27046,8 +27064,7 @@
                   "prompt",
                   "agentId",
                   "schedule",
-                  "timezone",
-                  "approval"
+                  "timezone"
                 ],
                 "type": "object"
               }
@@ -27487,6 +27504,9 @@
                     "format": "uuid",
                     "type": "string"
                   },
+                  "model": {
+                    "type": "string"
+                  },
                   "name": {
                     "type": "string"
                   },
@@ -27830,7 +27850,11 @@
             "application/json": {
               "schema": {
                 "additionalProperties": false,
-                "properties": {},
+                "properties": {
+                  "approval": {
+                    "$ref": "#/components/schemas/ScheduledTaskApproval"
+                  }
+                },
                 "type": "object"
               }
             }
diff --git a/frontend/src/api/generated.schemas.ts b/frontend/src/api/generated.schemas.ts
index f5259515..cf96e5ea 100644
--- a/frontend/src/api/generated.schemas.ts
+++ b/frontend/src/api/generated.schemas.ts
@@ -2007,11 +2007,14 @@ export interface ScheduledTaskSchedule {
 export interface ScheduledTask {
   agentId: string;
   createdAt: string;
+  creatorUserId: string;
   /** @nullable */
   disabledReason?: string | null;
   enabled: boolean;
   id: string;
   issueId: string;
+  /** @nullable */
+  model?: string | null;
   name: string;
   prompt: string;
   revision: number;
@@ -2254,6 +2257,7 @@ export const SpaceEventType = {
   projectrepository_updated: 'project.repository_updated',
   issueconversation_changed: 'issue.conversation_changed',
   scheduled_taskartifacts_updated: 'scheduled_task.artifacts_updated',
+  spacescheduled_tasks_updated: 'space.scheduled_tasks_updated',
 } as const;
 
 export interface SpaceEvent {
@@ -2262,6 +2266,8 @@ export interface SpaceEvent {
   /** @nullable */
   projectId?: string | null;
   runId?: string;
+  /** @nullable */
+  scheduledTaskId?: string | null;
   spaceId: string;
   type: SpaceEventType;
   version?: number;
@@ -4250,9 +4256,10 @@ export type GetApiV1TenantsTidResourceStatus200 = {
 
 export type PostApiV1TenantsTidScheduledTasksBody = {
   agentId: string;
-  approval: ScheduledTaskApproval;
+  approval?: ScheduledTaskApproval;
   enabled?: boolean;
   issueId: string;
+  model?: string;
   name: string;
   prompt: string;
   schedule: ScheduledTaskSchedule;
@@ -4276,6 +4283,7 @@ export type DeleteApiV1TenantsTidScheduledTasksStid200 = {
 
 export type PatchApiV1TenantsTidScheduledTasksStidBody = {
   agentId?: string;
+  model?: string;
   name?: string;
   prompt?: string;
   schedule?: ScheduledTaskSchedule;
@@ -4299,7 +4307,9 @@ export type PostApiV1TenantsTidScheduledTasksStidDisable200 = {
   resource: ScheduledTask;
 };
 
-export type PostApiV1TenantsTidScheduledTasksStidEnableBody = { [key: string]: unknown };
+export type PostApiV1TenantsTidScheduledTasksStidEnableBody = {
+  approval?: ScheduledTaskApproval;
+};
 
 export type PostApiV1TenantsTidScheduledTasksStidEnable200 = {
   resource: ScheduledTask;
diff --git a/frontend/src/features/scheduled-tasks/README.en.md b/frontend/src/features/scheduled-tasks/README.en.md
index a5fadcaf..f008c868 100644
--- a/frontend/src/features/scheduled-tasks/README.en.md
+++ b/frontend/src/features/scheduled-tasks/README.en.md
@@ -38,7 +38,7 @@ resources; the module requests, renders and turns user actions into mutations.
 The history tests serve fixed responses through MSW and assert what renders (the verdict text and the
 rejection count). Do not mock internal modules.
 
-The creation entry trusts the Cloud list response’s `acceptanceEnabled`; this module does not choose the gate, and the server independently validates writes.
+The creation entry trusts the Cloud list response’s `acceptanceEnabled`; this module does not choose the gate, and the server independently validates writes. The form may select a model from the creator's default connection; its connection and credential are frozen at admission, while no selection uses the then-current default model. A disabled create is an unauthorised draft and sends no approval; a stopped task must re-check the risk disclosure before it can be enabled.
 
 Artifact lists contain metadata only. Download links target same-origin Cloud routes; each click rechecks authorization and verifies the file before serving a safe attachment. Browsers receive no storage URL, credentials or expiry; artifact content is never rendered inside the app.
 
diff --git a/frontend/src/features/scheduled-tasks/README.md b/frontend/src/features/scheduled-tasks/README.md
index c507e3a1..36ed6b95 100644
--- a/frontend/src/features/scheduled-tasks/README.md
+++ b/frontend/src/features/scheduled-tasks/README.md
@@ -34,7 +34,7 @@
 
 历史测试通过 MSW 提供固定响应，断言渲染结果（结论文案、被拒数量）；不要 mock 内部模块。
 
-创建入口只依据 Cloud 列表响应的 `acceptanceEnabled`；本模块不决定开关，服务端仍独立验证写入。
+创建入口只依据 Cloud 列表响应的 `acceptanceEnabled`；本模块不决定开关，服务端仍独立验证写入。表单可选择创建者默认连接中的模型，实际连接/凭据会在接纳时冻结到运行；不选择时使用当时默认模型。禁用创建是无授权草稿，不发送授权；已停用任务在页面上必须重新勾选风险说明后才能启用。
 
 产物列表只含元数据；下载链接指向 Cloud 同源路径，每次点击由服务端重新鉴权并校验文件，以安全附件返回。浏览器不取得对象存储地址、凭据或有效期，不在应用内渲染产物正文。
 
diff --git a/frontend/src/features/scheduled-tasks/api.ts b/frontend/src/features/scheduled-tasks/api.ts
index 64a0e106..0f045b1d 100644
--- a/frontend/src/features/scheduled-tasks/api.ts
+++ b/frontend/src/features/scheduled-tasks/api.ts
@@ -29,6 +29,7 @@ export type ScheduledTaskDraft = {
   agentId: string
   name: string
   prompt: string
+  model: string
   schedule: ScheduledTaskSchedule
   timezone: string
   enabled: boolean
@@ -52,6 +53,7 @@ export function useSaveScheduledTask(tid: string, existing: ScheduledTask | unde
         name: draft.name,
         prompt: draft.prompt,
         agentId: draft.agentId,
+        model: draft.model,
         schedule: draft.schedule,
         timezone: draft.timezone,
       }
@@ -63,8 +65,8 @@ export function useSaveScheduledTask(tid: string, existing: ScheduledTask | unde
         : await postApiV1TenantsTidScheduledTasks(tid, {
             ...base,
             issueId: draft.issueId,
-            approval: { policy: 'full_auto_in_cloud_workspace' },
             enabled: draft.enabled,
+            ...(draft.enabled ? { approval: { policy: 'full_auto_in_cloud_workspace' } } : {}),
           })
       return result.resource
     },
@@ -87,9 +89,13 @@ export function useDeleteScheduledTask(tid: string) {
 export function useSetScheduledTaskEnabled(tid: string, task: ScheduledTask) {
   const queryClient = useQueryClient()
   return useMutation({
-    mutationFn: (enabled: boolean) =>
+    mutationFn: ({ enabled, consented }: { enabled: boolean; consented?: boolean }) =>
       enabled
-        ? postApiV1TenantsTidScheduledTasksStidEnable(tid, task.id, {})
+        ? postApiV1TenantsTidScheduledTasksStidEnable(
+            tid,
+            task.id,
+            consented ? { approval: { policy: 'full_auto_in_cloud_workspace' } } : {},
+          )
         : postApiV1TenantsTidScheduledTasksStidDisable(tid, task.id, {}),
     onSuccess: () =>
       queryClient.invalidateQueries({ queryKey: getGetApiV1TenantsTidScheduledTasksQueryKey(tid) }),
diff --git a/frontend/src/features/scheduled-tasks/scheduled-task-form.tsx b/frontend/src/features/scheduled-tasks/scheduled-task-form.tsx
index 61bb57ed..797f8015 100644
--- a/frontend/src/features/scheduled-tasks/scheduled-task-form.tsx
+++ b/frontend/src/features/scheduled-tasks/scheduled-task-form.tsx
@@ -1,5 +1,6 @@
 import { useState } from 'react'
 import { Button } from '@/components/ui/button'
+import { Checkbox } from '@/components/ui/checkbox'
 import {
   Dialog,
   DialogContent,
@@ -26,10 +27,17 @@ import {
   useScheduledTaskIssues,
   type ScheduledTask,
 } from './api'
+import { useModelConnections, useModelDefault } from '@/features/model-connections/api'
 
 const selectClass =
   'flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-sm shadow-xs'
 
+type ModelOption = { id: string; name: string }
+
+/** D5 无人值守授权的风险说明：必须显式同意后才能启用。 */
+export const CONSENT_RISK_STATEMENT =
+  '我已知悉并同意：定时运行在一次性隔离 Workspace 中全自动执行（非用户可见的数据边界承诺），Agent 可执行任意工具调用，消耗创建者个人模型额度，并以创建者 Git 身份提交。'
+
 const KIND_OPTIONS: readonly { value: ScheduledTaskScheduleKind; label: string }[] = [
   { value: 'daily', label: '每天' },
   { value: 'weekly', label: '每周' },
@@ -179,12 +187,17 @@ function Fields({
   setAgentId,
   prompt,
   setPrompt,
+  model,
+  setModel,
+  models,
   timezone,
   setTimezone,
   schedule,
   setSchedule,
   enabled,
   setEnabled,
+  consented,
+  setConsented,
 }: {
   isEdit: boolean
   issues: Issue[]
@@ -197,12 +210,17 @@ function Fields({
   setAgentId: (value: string) => void
   prompt: string
   setPrompt: (value: string) => void
+  model: string
+  setModel: (value: string) => void
+  models: ModelOption[]
   timezone: string
   setTimezone: (value: string) => void
   schedule: ScheduledTaskSchedule
   setSchedule: (value: ScheduledTaskSchedule) => void
   enabled: boolean
   setEnabled: (value: boolean) => void
+  consented: boolean
+  setConsented: (value: boolean) => void
 }) {
   return (
     <div className="space-y-4">
@@ -210,6 +228,98 @@ function Fields({
         <Input id="st-name" value={name} onChange={(e) => setName(e.target.value)} />
       </Field>
 
+      <TargetSelectors
+        isEdit={isEdit}
+        issues={issues}
+        agents={agents}
+        issueId={issueId}
+        setIssueId={setIssueId}
+        agentId={agentId}
+        setAgentId={setAgentId}
+      />
+
+      <Field label="提示词" htmlFor="st-prompt">
+        <Textarea
+          id="st-prompt"
+          rows={4}
+          value={prompt}
+          onChange={(e) => setPrompt(e.target.value)}
+        />
+      </Field>
+
+      <ModelSelector model={model} setModel={setModel} models={models} />
+
+      <Field label="时区（IANA）" htmlFor="st-timezone">
+        <Input
+          id="st-timezone"
+          value={timezone}
+          onChange={(e) => setTimezone(e.target.value)}
+          placeholder="Asia/Shanghai"
+        />
+      </Field>
+
+      <ScheduleEditor schedule={schedule} onChange={setSchedule} />
+
+      {!isEdit && (
+        <label className="flex items-center gap-2 text-sm">
+          <Switch checked={enabled} onCheckedChange={setEnabled} />
+          创建后立即启用
+        </label>
+      )}
+
+      {enabled && <ConsentAgreement consented={consented} setConsented={setConsented} />}
+    </div>
+  )
+}
+
+function ModelSelector({
+  model,
+  setModel,
+  models,
+}: {
+  model: string
+  setModel: (value: string) => void
+  models: ModelOption[]
+}) {
+  return (
+    <Field label="运行模型" htmlFor="st-model">
+      <select
+        id="st-model"
+        className={selectClass}
+        value={model}
+        onChange={(e) => setModel(e.target.value)}
+      >
+        <option value="">使用当前默认模型</option>
+        {models.map((option) => (
+          <option key={option.id} value={option.id}>
+            {option.name} ({option.id})
+          </option>
+        ))}
+      </select>
+    </Field>
+  )
+}
+
+/** The issue and agent target selectors; the issue selector is only shown on creation. */
+function TargetSelectors({
+  isEdit,
+  issues,
+  agents,
+  issueId,
+  setIssueId,
+  agentId,
+  setAgentId,
+}: {
+  isEdit: boolean
+  issues: Issue[]
+  agents: CollaborationTarget[]
+  issueId: string
+  setIssueId: (value: string) => void
+  agentId: string
+  setAgentId: (value: string) => void
+}) {
+  return (
+    <>
       {!isEdit && (
         <Field label="绑定 issue" htmlFor="st-issue">
           <select
@@ -227,7 +337,6 @@ function Fields({
           </select>
         </Field>
       )}
-
       <Field label="执行智能体" htmlFor="st-agent">
         <select
           id="st-agent"
@@ -243,34 +352,27 @@ function Fields({
           ))}
         </select>
       </Field>
+    </>
+  )
+}
 
-      <Field label="提示词" htmlFor="st-prompt">
-        <Textarea
-          id="st-prompt"
-          rows={4}
-          value={prompt}
-          onChange={(e) => setPrompt(e.target.value)}
-        />
-      </Field>
-
-      <Field label="时区（IANA）" htmlFor="st-timezone">
-        <Input
-          id="st-timezone"
-          value={timezone}
-          onChange={(e) => setTimezone(e.target.value)}
-          placeholder="Asia/Shanghai"
-        />
-      </Field>
-
-      <ScheduleEditor schedule={schedule} onChange={setSchedule} />
-
-      {!isEdit && (
-        <label className="flex items-center gap-2 text-sm">
-          <Switch checked={enabled} onCheckedChange={setEnabled} />
-          创建后立即启用
-        </label>
-      )}
-    </div>
+/** The D5 unattended-consent risk statement and its required agreement checkbox. */
+export function ConsentAgreement({
+  consented,
+  setConsented,
+}: {
+  consented: boolean
+  setConsented: (value: boolean) => void
+}) {
+  return (
+    <label className="flex items-start gap-2 rounded-md border border-muted p-3 text-xs text-muted-foreground">
+      <Checkbox
+        checked={consented}
+        onCheckedChange={(checked) => setConsented(checked)}
+        aria-label="同意无人值守授权"
+      />
+      <span>{CONSENT_RISK_STATEMENT}</span>
+    </label>
   )
 }
 
@@ -280,6 +382,7 @@ function toDraft(task: ScheduledTask | undefined) {
     issueId: task ? task.issueId : '',
     agentId: task ? task.agentId : '',
     prompt: task ? task.prompt : '',
+    model: task?.model ?? '',
     timezone: task ? task.timezone : 'Asia/Shanghai',
     schedule: task
       ? task.schedule
@@ -312,6 +415,8 @@ export function ScheduledTaskForm({
   const isEdit = task != null
   const issues = useScheduledTaskIssues(tid)
   const agents = useScheduledTaskAgents(tid)
+  const connections = useModelConnections()
+  const defaultModel = useModelDefault()
   const save = useSaveScheduledTask(tid, task)
 
   const draft = toDraft(task)
@@ -319,20 +424,28 @@ export function ScheduledTaskForm({
   const [issueId, setIssueId] = useState(draft.issueId)
   const [agentId, setAgentId] = useState(draft.agentId)
   const [prompt, setPrompt] = useState(draft.prompt)
+  const [model, setModel] = useState(draft.model)
   const [timezone, setTimezone] = useState(draft.timezone)
   const [schedule, setSchedule] = useState<ScheduledTaskSchedule>(draft.schedule)
   const [enabled, setEnabled] = useState(false)
+  const [consented, setConsented] = useState(false)
 
   const submit = () =>
     save.mutate(
-      { issueId, agentId, name, prompt, schedule, timezone, enabled },
+      { issueId, agentId, name, prompt, model, schedule, timezone, enabled },
       { onSuccess: onClose },
     )
-  const invalid = isDraftInvalid(isEdit, { name, prompt, agentId, issueId })
+  const invalid =
+    isDraftInvalid(isEdit, { name, prompt, agentId, issueId }) || (enabled && !consented)
   let submitLabel = '创建'
   if (save.isPending) submitLabel = '保存中…'
   else if (isEdit) submitLabel = '保存'
 
+  const defaultConnection = connections.data?.find(
+    (connection) => connection.id === defaultModel.data?.connectionId,
+  )
+  const models = defaultConnection?.models ?? []
+
   return (
     <Dialog open onOpenChange={(next) => !next && onClose()}>
       <DialogContent className="max-h-[85vh] overflow-y-auto sm:max-w-lg">
@@ -355,12 +468,17 @@ export function ScheduledTaskForm({
           setAgentId={setAgentId}
           prompt={prompt}
           setPrompt={setPrompt}
+          model={model}
+          setModel={setModel}
+          models={models}
           timezone={timezone}
           setTimezone={setTimezone}
           schedule={schedule}
           setSchedule={setSchedule}
           enabled={enabled}
           setEnabled={setEnabled}
+          consented={consented}
+          setConsented={setConsented}
         />
 
         {save.isError && (
diff --git a/frontend/src/features/scheduled-tasks/scheduled-tasks-page.test.tsx b/frontend/src/features/scheduled-tasks/scheduled-tasks-page.test.tsx
index 0239d1ad..24da1681 100644
--- a/frontend/src/features/scheduled-tasks/scheduled-tasks-page.test.tsx
+++ b/frontend/src/features/scheduled-tasks/scheduled-tasks-page.test.tsx
@@ -1,5 +1,5 @@
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
-import { render, screen } from '@testing-library/react'
+import { render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { http, HttpResponse } from 'msw'
 import { describe, expect, it } from 'vitest'
@@ -11,11 +11,18 @@ const TID = 'tid1'
 const LIST = '/api/v1/tenants/tid1/scheduled-tasks'
 const ISSUES = '/api/v1/tenants/tid1/issues'
 const TARGETS = '/api/v1/tenants/tid1/collaboration/targets'
+const MODEL_CONNECTIONS = '/api/v1/me/model-connections'
+const MODEL_DEFAULT = '/api/v1/me/model-default'
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
 
 function task(overrides: Partial<ScheduledTask> = {}): ScheduledTask {
   return {
     id: 'st1',
     issueId: 'i1',
+    creatorUserId: 'u1',
     name: '每日同步',
     prompt: '同步仓库',
     agentId: 'a1',
@@ -26,6 +33,7 @@ function task(overrides: Partial<ScheduledTask> = {}): ScheduledTask {
     enabled: false,
     createdAt: '2026-10-01T00:00:00Z',
     updatedAt: '2026-10-01T00:00:00Z',
+    model: null,
     ...overrides,
   }
 }
@@ -42,6 +50,31 @@ function serve(tasks: ScheduledTask[] = [], acceptanceEnabled = false) {
         nextCursor: '',
       }),
     ),
+    http.get(MODEL_CONNECTIONS, () =>
+      HttpResponse.json({
+        items: [
+          {
+            id: 'mc1',
+            name: '个人模型',
+            protocol: 'openai-completions',
+            baseUrl: 'https://models.example.test/v1',
+            authMode: 'bearer',
+            models: [
+              { id: 'vendor/model-v1', name: 'Model V1', contextWindow: 128000, maxTokens: 8192 },
+            ],
+            enabled: true,
+            credentialConfigured: true,
+            version: 1,
+            createdAt: '2026-10-01T00:00:00Z',
+            updatedAt: '2026-10-01T00:00:00Z',
+          },
+        ],
+        nextCursor: '',
+      }),
+    ),
+    http.get(MODEL_DEFAULT, () =>
+      HttpResponse.json({ connectionId: 'mc1', modelId: 'vendor/model-v1', version: 1 }),
+    ),
   )
 }
 
@@ -89,6 +122,43 @@ describe('ScheduledTasksPage', () => {
     expect(screen.getByRole('dialog', { name: '新建定时任务' })).toBeInTheDocument()
   })
 
+  it('shows the risk disclosure and requires consent once the task is enabled', async () => {
+    serve([], true)
+    const user = userEvent.setup()
+    renderPage()
+    await user.click(await screen.findByRole('button', { name: '新建定时任务' }))
+    await user.click(screen.getByRole('switch'))
+    expect(screen.getByLabelText('同意无人值守授权')).toBeInTheDocument()
+    expect(screen.getByText(/我已知悉并同意/)).toBeInTheDocument()
+  })
+
+  it('creates a disabled task as an unauthorised draft while offering the default-connection models', async () => {
+    serve([], true)
+    let created: Record<string, unknown> | undefined
+    server.use(
+      http.post(LIST, async ({ request }) => {
+        const payload = await request.json()
+        if (!isRecord(payload)) {
+          return HttpResponse.json({ error: 'expected object' }, { status: 400 })
+        }
+        created = payload
+        return HttpResponse.json({ resource: task() })
+      }),
+    )
+    const user = userEvent.setup()
+    renderPage()
+    await user.click(await screen.findByRole('button', { name: '新建定时任务' }))
+    await user.selectOptions(screen.getByLabelText('绑定 issue'), 'i1')
+    await user.selectOptions(screen.getByLabelText('执行智能体'), 'a1')
+    await user.type(screen.getByLabelText('名称'), '无授权草稿')
+    await user.type(screen.getByLabelText('提示词'), '稍后再启用')
+    expect(await screen.findByRole('option', { name: /Model V1/ })).toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: '创建' }))
+    await waitFor(() => expect(created).toBeDefined())
+    expect(created).toMatchObject({ enabled: false, model: '' })
+    expect(created).not.toHaveProperty('approval')
+  })
+
   it('deletes a task only after confirmation', async () => {
     serve([task()])
     let deleted = null
@@ -121,4 +191,63 @@ describe('ScheduledTasksPage', () => {
     await user.click(screen.getByRole('switch'))
     expect(disabled).toBe(true)
   })
+
+  it('requires an explicit re-consent before enabling a stopped task', async () => {
+    serve([task()])
+    let approval: Record<string, unknown> | undefined
+    server.use(
+      http.post(`${LIST}/st1/enable`, async ({ request }) => {
+        const payload = await request.json()
+        if (!isRecord(payload)) {
+          return HttpResponse.json({ error: 'expected object' }, { status: 400 })
+        }
+        approval = payload
+        return HttpResponse.json({ resource: task({ enabled: true }) })
+      }),
+    )
+    const user = userEvent.setup()
+    renderPage()
+    await screen.findByRole('article', { name: '每日同步' })
+    const enable = screen.getByRole('button', { name: '重新同意并启用' })
+    expect(enable).toBeDisabled()
+    await user.click(screen.getByLabelText('同意无人值守授权'))
+    await user.click(enable)
+    await waitFor(() =>
+      expect(approval).toEqual({ approval: { policy: 'full_auto_in_cloud_workspace' } }),
+    )
+  })
+
+  it('clears a stale consent box after enable and revoke so re-consent is explicit', async () => {
+    let current: ScheduledTask = task({
+      enabled: false,
+      unattendedPolicy: 'full_auto_in_cloud_workspace',
+    })
+    server.use(
+      http.get(LIST, () => HttpResponse.json({ tasks: [current], acceptanceEnabled: false })),
+      http.post(`${LIST}/st1/enable`, () => {
+        current = task({ enabled: true, unattendedPolicy: 'full_auto_in_cloud_workspace' })
+        return HttpResponse.json({ resource: current })
+      }),
+      http.post(`${LIST}/st1/revoke-consent`, () => {
+        current = task({ enabled: false })
+        return HttpResponse.json({ resource: current })
+      }),
+    )
+    const userEventSetup = userEvent.setup()
+    renderPage()
+
+    await screen.findByRole('article', { name: '每日同步' })
+    await userEventSetup.click(screen.getByLabelText('同意无人值守授权'))
+    await userEventSetup.click(screen.getByRole('button', { name: '重新同意并启用' }))
+    await waitFor(() => expect(screen.getByRole('switch')).toBeChecked())
+
+    await userEventSetup.click(screen.getByRole('button', { name: '撤销授权' }))
+    await userEventSetup.click(screen.getByRole('button', { name: '确认撤销授权' }))
+    const fresh = await screen.findByLabelText('同意无人值守授权')
+    expect(fresh).not.toBeChecked()
+    expect(screen.getByRole('button', { name: '重新同意并启用' })).toBeDisabled()
+
+    await userEventSetup.click(fresh)
+    expect(screen.getByRole('button', { name: '重新同意并启用' })).toBeEnabled()
+  })
 })
diff --git a/frontend/src/features/scheduled-tasks/scheduled-tasks-page.tsx b/frontend/src/features/scheduled-tasks/scheduled-tasks-page.tsx
index 1e844093..0b08e14f 100644
--- a/frontend/src/features/scheduled-tasks/scheduled-tasks-page.tsx
+++ b/frontend/src/features/scheduled-tasks/scheduled-tasks-page.tsx
@@ -12,7 +12,7 @@ import {
   useSetScheduledTaskEnabled,
   type ScheduledTask,
 } from './api'
-import { ScheduledTaskForm } from './scheduled-task-form'
+import { ConsentAgreement, ScheduledTaskForm } from './scheduled-task-form'
 import { ScheduledTaskHistory } from './scheduled-task-history'
 
 function ConfirmButton({
@@ -54,6 +54,7 @@ function ScheduledTaskCard({
   const remove = useDeleteScheduledTask(tid)
   const revoke = useRevokeScheduledTaskConsent(tid)
   const toggle = useSetScheduledTaskEnabled(tid, task)
+  const [consented, setConsented] = useState(false)
   const failure = toggle.error ?? remove.error ?? revoke.error
 
   return (
@@ -70,16 +71,35 @@ function ScheduledTaskCard({
       {task.disabledReason && (
         <p className="text-xs text-muted-foreground">停用原因：{task.disabledReason}</p>
       )}
-      <div className="flex items-center gap-2 text-sm">
-        <span className="text-muted-foreground">启用</span>
-        <Switch
-          checked={task.enabled}
-          disabled={toggle.isPending || !task.enabled}
-          onCheckedChange={(next) => {
-            if (!next) toggle.mutate(false)
-          }}
-        />
-      </div>
+      {task.enabled ? (
+        <div className="flex items-center gap-2 text-sm">
+          <span className="text-muted-foreground">启用</span>
+          <Switch
+            checked
+            disabled={toggle.isPending}
+            onCheckedChange={(next) => {
+              if (!next) toggle.mutate({ enabled: false }, { onSuccess: () => setConsented(false) })
+            }}
+          />
+        </div>
+      ) : (
+        <div className="space-y-2">
+          <ConsentAgreement consented={consented} setConsented={setConsented} />
+          <Button
+            type="button"
+            size="sm"
+            disabled={toggle.isPending || !consented}
+            onClick={() =>
+              toggle.mutate(
+                { enabled: true, consented: true },
+                { onSuccess: () => setConsented(false) },
+              )
+            }
+          >
+            重新同意并启用
+          </Button>
+        </div>
+      )}
       <div className="flex flex-wrap gap-2">
         <Button type="button" size="sm" variant="outline" onClick={onHistory}>
           历史
@@ -89,7 +109,7 @@ function ScheduledTaskCard({
             label="撤销授权"
             confirmLabel="确认撤销授权"
             pending={revoke.isPending}
-            onConfirm={() => revoke.mutate(task.id)}
+            onConfirm={() => revoke.mutate(task.id, { onSuccess: () => setConsented(false) })}
           />
         )}
         <ConfirmButton
diff --git a/frontend/src/features/spaces/README.en.md b/frontend/src/features/spaces/README.en.md
index a3a2d98e..203f9039 100644
--- a/frontend/src/features/spaces/README.en.md
+++ b/frontend/src/features/spaces/README.en.md
@@ -32,4 +32,4 @@ MSW replaces the generated client's network boundary; pure tests cover slugs, SS
 
 Creation uses shared `CreateFormSubmit` error and pending feedback. SSE handles member revocation, plugin selection and catalog updates. `issue_run.thread_appended` / `issue_run.thread_changed` invalidate the addressed Thread, task conversation and run list. `issue.conversation_changed` invalidates task messages and runs. Both are lossy hints; only REST moves a cursor. Missing or malformed issue/run identities are rejected at the boundary.
 
-`scheduled_task.artifacts_updated` invalidates only this tenant’s scheduled histories and the addressed run’s artifact index. It never mints downloads or refreshes other tenants or runs.
+`scheduled_task.artifacts_updated` invalidates only this tenant’s scheduled histories and the addressed run’s artifact index. It never mints downloads or refreshes other tenants or runs. `space.scheduled_tasks_updated` invalidates the tenant task list and, when it carries `scheduledTaskId`, only that task's history.
diff --git a/frontend/src/features/spaces/README.md b/frontend/src/features/spaces/README.md
index 29424303..2ad0126a 100644
--- a/frontend/src/features/spaces/README.md
+++ b/frontend/src/features/spaces/README.md
@@ -32,4 +32,4 @@ MSW 模拟生成客户端的网络边界；纯函数单测覆盖 slug、SSE 帧
 
 创建表单复用 `CreateFormSubmit` 统一错误与等待反馈；SSE 同时支持租户成员撤权、插件选择和目录更新，刷新相应查询。`issue_run.thread_appended` / `issue_run.thread_changed` 失效该 run 的 Thread、任务对话和运行列表；`issue.conversation_changed` 失效任务消息与运行列表。两类事件都是失效提示，游标只由 REST 读取推进。缺少 `issueId` 的事件被忽略，身份不是字符串的事件在边界处丢弃。
 
-`scheduled_task.artifacts_updated` 只失效本租户的定时任务历史和指定运行的产物索引，不签发下载能力，不刷新其他租户或运行。
+`scheduled_task.artifacts_updated` 只失效本租户的定时任务历史和指定运行的产物索引，不签发下载能力，不刷新其他租户或运行。`space.scheduled_tasks_updated` 失效本租户任务列表；事件带 `scheduledTaskId` 时还只失效该任务的历史。
diff --git a/frontend/src/features/spaces/spaces.test.tsx b/frontend/src/features/spaces/spaces.test.tsx
index b7b4c451..095fb1fa 100644
--- a/frontend/src/features/spaces/spaces.test.tsx
+++ b/frontend/src/features/spaces/spaces.test.tsx
@@ -364,6 +364,25 @@ describe('useSpaceEvents', () => {
     unmount()
   })
 
+  it('refetches the scheduled-task list and only the history addressed by a task update event', async () => {
+    server.use(
+      http.get(eventsUrl, () =>
+        eventStream([
+          'data: {"type":"space.scheduled_tasks_updated","spaceId":"S","scheduledTaskId":"T"}\n\n',
+        ]),
+      ),
+    )
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+    const list = [`/api/v1/tenants/${tenantId}/scheduled-tasks`]
+    const history = [`/api/v1/tenants/${tenantId}/scheduled-tasks/T/history`]
+    const otherHistory = [`/api/v1/tenants/${tenantId}/scheduled-tasks/OTHER/history`]
+    const { unmount, invalidated } = renderEvents(client, [list, history, otherHistory])
+    await waitFor(() => expect(invalidated(list)).toBe(true))
+    expect(invalidated(history)).toBe(true)
+    expect(invalidated(otherHistory)).toBe(false)
+    unmount()
+  })
+
   it('does nothing without a tenant or space', async () => {
     let connections = 0
     server.use(
diff --git a/frontend/src/features/spaces/use-space-events.ts b/frontend/src/features/spaces/use-space-events.ts
index 392fa482..199ca378 100644
--- a/frontend/src/features/spaces/use-space-events.ts
+++ b/frontend/src/features/spaces/use-space-events.ts
@@ -6,6 +6,10 @@ import {
   getGetApiV1TenantsTidIssuesIidRunsRidThreadQueryKey,
   getGetApiV1TenantsTidIssuesIidRunsRidArtifactsQueryKey,
 } from '@/api/tenants/tenants'
+import {
+  getGetApiV1TenantsTidScheduledTasksQueryKey,
+  getGetApiV1TenantsTidScheduledTasksStidHistoryQueryKey,
+} from '@/api/scheduled-tasks/scheduled-tasks'
 
 /**
  * Narrows an unknown value to a property bag; JSON.parse and network payloads
@@ -23,7 +27,7 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 function isSpaceEvent(value: unknown): value is SpaceEvent {
   if (!isRecord(value)) return false
   if (typeof value['type'] !== 'string' || typeof value['spaceId'] !== 'string') return false
-  return ['issueId', 'runId'].every((field) => optionalString(value[field]))
+  return ['issueId', 'runId', 'scheduledTaskId'].every((field) => optionalString(value[field]))
 }
 
 function optionalString(value: unknown): boolean {
@@ -100,6 +104,25 @@ function invalidateForScheduledArtifactEvent(
   })
 }
 
+// Definition changes update the tenant list; the event's task identity lets an already-open
+// history dialog refresh without invalidating unrelated task histories.
+function invalidateForScheduledTaskEvent(
+  event: SpaceEvent,
+  tenantId: string,
+  queryClient: QueryClient,
+) {
+  void queryClient.invalidateQueries({
+    queryKey: getGetApiV1TenantsTidScheduledTasksQueryKey(tenantId),
+  })
+  if (!event.scheduledTaskId) return
+  void queryClient.invalidateQueries({
+    queryKey: getGetApiV1TenantsTidScheduledTasksStidHistoryQueryKey(
+      tenantId,
+      event.scheduledTaskId,
+    ),
+  })
+}
+
 /** Invalidates exactly the queries an event type affects; never carries state. */
 function invalidateForEvent(
   event: SpaceEvent,
@@ -114,6 +137,8 @@ function invalidateForEvent(
     void queryClient.invalidateQueries({ queryKey: ['issue-runs', tenantId, event.issueId] })
   } else if (event.type === 'scheduled_task.artifacts_updated') {
     invalidateForScheduledArtifactEvent(event, tenantId, queryClient)
+  } else if (event.type === 'space.scheduled_tasks_updated') {
+    invalidateForScheduledTaskEvent(event, tenantId, queryClient)
   } else if (event.type.startsWith('project.')) {
     void queryClient.invalidateQueries({
       queryKey: [`/api/v1/tenants/${tenantId}/spaces/${spaceId}/projects`],
diff --git a/integration/scheduled_task_admission_db_test.go b/integration/scheduled_task_admission_db_test.go
index 40eca659..653d416b 100644
--- a/integration/scheduled_task_admission_db_test.go
+++ b/integration/scheduled_task_admission_db_test.go
@@ -15,7 +15,10 @@ import (
 // and Store.Public, against a real PostgreSQL schema. NOT_VERIFIED locally: this environment has no
 // network to fetch the integration test dependencies (pgx), so the suite only runs in CI.
 
-const scheduledTaskModelID = "vendor/model-v1"
+const (
+	scheduledTaskModelID          = "vendor/model-v1"
+	scheduledTaskAlternateModelID = "vendor/model-v2"
+)
 
 // seedScheduledTaskModelChain gives the creator a usable personal default backed by an enabled,
 // credential-bound connection, so creatorModelReady and bindRunModel both resolve.
@@ -28,7 +31,7 @@ func seedScheduledTaskModelChain(t *testing.T, store *core.Store, userID string)
 	must(t, err)
 	_, err = store.Pool.Exec(`INSERT INTO personal_model_connections(id,user_id,credential_id,name,protocol,base_url,auth_mode,models,enabled)
 		VALUES($1,$2,$3,'Personal Provider','openai-completions','https://models.example.invalid/v1','bearer',$4::jsonb,true)`,
-		conn, userID, cred, `[{"id":"`+scheduledTaskModelID+`","name":"Model V1","contextWindow":128000,"maxTokens":8192}]`)
+		conn, userID, cred, `[{"id":"`+scheduledTaskModelID+`","name":"Model V1","contextWindow":128000,"maxTokens":8192},{"id":"`+scheduledTaskAlternateModelID+`","name":"Model V2","contextWindow":128000,"maxTokens":8192}]`)
 	must(t, err)
 	_, err = store.Pool.Exec(`INSERT INTO personal_model_defaults(user_id,connection_id,model_id,version) VALUES($1,$2,$3,1)`, userID, conn, scheduledTaskModelID)
 	must(t, err)
@@ -92,6 +95,35 @@ func TestScheduledTaskAdmissionCreatesARun(t *testing.T) {
 	}
 }
 
+// TestScheduledTaskModelBindingFreezesDefinitionSelection ensures a definition-selected model is
+// resolved at admission and copied into the run binding. Later edits to either the definition or
+// the personal default cannot rewrite the already admitted occurrence.
+func TestScheduledTaskModelBindingFreezesDefinitionSelection(t *testing.T) {
+	store, s, agentID := scheduledTaskStore(t)
+	taskID := seedEnabledScheduledTask(t, store, s, agentID, "Frozen selected model", 65)
+	_, err := store.Pool.Exec(`UPDATE scheduled_tasks SET model=$1 WHERE id=$2`, scheduledTaskAlternateModelID, taskID)
+	must(t, err)
+
+	must(t, store.EvaluateScheduledTasksOnce(context.Background()))
+	var runID, boundModel string
+	must(t, store.Pool.QueryRow(`SELECT o.run_id, b.model->>'id'
+		FROM scheduled_task_occurrences o
+		JOIN run_model_bindings b ON b.run_id=o.run_id AND b.slot_name='default'
+		WHERE o.task_id=$1`, taskID).Scan(&runID, &boundModel))
+	if runID == "" || boundModel != scheduledTaskAlternateModelID {
+		t.Fatalf("admitted task must freeze selected model %q, got run=%q model=%q", scheduledTaskAlternateModelID, runID, boundModel)
+	}
+
+	_, err = store.Pool.Exec(`UPDATE scheduled_tasks SET model=$1 WHERE id=$2`, scheduledTaskModelID, taskID)
+	must(t, err)
+	_, err = store.Pool.Exec(`UPDATE personal_model_defaults SET model_id=$1 WHERE user_id=$2`, scheduledTaskAlternateModelID, s.userID)
+	must(t, err)
+	must(t, store.Pool.QueryRow(`SELECT model->>'id' FROM run_model_bindings WHERE run_id=$1 AND slot_name='default'`, runID).Scan(&boundModel))
+	if boundModel != scheduledTaskAlternateModelID {
+		t.Fatalf("later definition/default changes must not rewrite run binding, got %q", boundModel)
+	}
+}
+
 // TestScheduledTaskHistoryReadsEmptyAndAdmitted verifies the public history path against PostgreSQL
 // before and after admission. IssueRun has no session_id fact, so history must not manufacture one.
 func TestScheduledTaskHistoryReadsEmptyAndAdmitted(t *testing.T) {
diff --git a/integration/scheduled_task_contract_obligations_test.go b/integration/scheduled_task_contract_obligations_test.go
new file mode 100644
index 00000000..b7c93e31
--- /dev/null
+++ b/integration/scheduled_task_contract_obligations_test.go
@@ -0,0 +1,150 @@
+package integration
+
+import (
+	"context"
+	"testing"
+
+	"github.com/wanglongan587/cloud/internal/core"
+)
+
+// TestScheduledTaskModelSelectionPersistsAndBumpsRevision pins D1 模型选择持久化：创建时携带的 model
+// 原样落库并在读取时返回；修改 model 与修改 prompt/agent/schedule 一样递增 revision。
+func TestScheduledTaskModelSelectionPersistsAndBumpsRevision(t *testing.T) {
+	store, s, agentID := scheduledTaskStore(t)
+	caller := scheduledTaskCaller(t, store, s.tenantID)
+	path := "/api/v1/tenants/" + s.tenantID + "/scheduled-tasks"
+
+	out, status, err := store.Public(context.Background(), &core.PublicRequest{
+		Method: "POST", Key: "create-with-model", Path: path,
+		TenantID: s.tenantID, Identity: caller,
+		Body: core.Object{
+			"issueId": s.issueID, "agentId": agentID, "name": "Model task", "prompt": "Sync",
+			"model":    "vendor/model-v1",
+			"schedule": core.Object{"kind": "every_hours", "intervalHours": 1},
+			"timezone": "Asia/Shanghai",
+			"approval": core.Object{"policy": "full_auto_in_cloud_workspace"},
+			"enabled":  false,
+		},
+	})
+	must(t, err)
+	if status != 200 {
+		t.Fatalf("create with model must succeed, got %d", status)
+	}
+	task := out.O("resource")
+	if task.S("model") != "vendor/model-v1" {
+		t.Fatalf("model must round-trip through create, got %q", task.S("model"))
+	}
+
+	_, status, err = store.Public(context.Background(), &core.PublicRequest{
+		Method: "PATCH", Key: "patch-model", Path: path + "/" + task.S("id"),
+		TenantID: s.tenantID, ScheduledTaskID: task.S("id"), Identity: caller,
+		Body: core.Object{"model": "vendor/model-v2", "version": task.N("version")},
+	})
+	must(t, err)
+	if status != 200 {
+		t.Fatalf("model update must succeed, got %d", status)
+	}
+	var model string
+	var revision int64
+	must(t, store.Pool.QueryRow(`SELECT COALESCE(model,''), revision FROM scheduled_tasks WHERE id=$1`, task.S("id")).Scan(&model, &revision))
+	if model != "vendor/model-v2" {
+		t.Fatalf("model update must persist, got %q", model)
+	}
+	if revision != 2 {
+		t.Fatalf("model change must bump revision, got %d", revision)
+	}
+}
+
+// TestScheduledTaskDisabledCreateDoesNotPersistConsent keeps an unstarted definition a draft:
+// supplying a stale approval field cannot create a future unattended grant. Enabling must receive
+// a fresh explicit approval, which lets the UI present re-consent at the action boundary.
+func TestScheduledTaskDisabledCreateDoesNotPersistConsent(t *testing.T) {
+	store, s, agentID := scheduledTaskStore(t)
+	caller := scheduledTaskCaller(t, store, s.tenantID)
+	path := "/api/v1/tenants/" + s.tenantID + "/scheduled-tasks"
+
+	out, status, err := store.Public(context.Background(), &core.PublicRequest{
+		Method: "POST", Key: "create-disabled-draft", Path: path,
+		TenantID: s.tenantID, Identity: caller,
+		Body: core.Object{
+			"issueId": s.issueID, "agentId": agentID, "name": "Disabled draft", "prompt": "Sync",
+			"schedule": core.Object{"kind": "every_hours", "intervalHours": 1},
+			"timezone": "Asia/Shanghai", "enabled": false,
+			// A stale client may still include it; disabled creation must discard rather than persist it.
+			"approval": core.Object{"policy": "full_auto_in_cloud_workspace"},
+		},
+	})
+	must(t, err)
+	if status != 200 {
+		t.Fatalf("disabled draft create status = %d, want 200", status)
+	}
+	taskID := out.O("resource").S("id")
+	var policy string
+	var consentedAt any
+	must(t, store.Pool.QueryRow(`SELECT COALESCE(unattended_policy,''), unattended_consented_at FROM scheduled_tasks WHERE id=$1`, taskID).Scan(&policy, &consentedAt))
+	if policy != "" || consentedAt != nil {
+		t.Fatalf("disabled draft must not retain consent, got policy=%q consentedAt=%v", policy, consentedAt)
+	}
+
+	_, _, err = store.Public(context.Background(), &core.PublicRequest{
+		Method: "POST", Key: "enable-disabled-draft-without-consent", Path: path + "/" + taskID + "/enable",
+		TenantID: s.tenantID, ScheduledTaskID: taskID, Identity: caller, Body: core.Object{},
+	})
+	if fault := core.ErrorCode(err); fault.Code != "approval_policy_invalid" {
+		t.Fatalf("draft enable without fresh consent must be approval_policy_invalid, got %v", err)
+	}
+}
+
+// TestScheduledTaskReconsentAfterRevoke pins D5 撤销同意后重新同意：撤销清空 consent 并停用；不带新
+// 同意的启用被拒，携带新同意的启用恢复 consent 与启用状态。
+func TestScheduledTaskReconsentAfterRevoke(t *testing.T) {
+	store, s, agentID := scheduledTaskStore(t)
+	caller := scheduledTaskCaller(t, store, s.tenantID)
+	taskID := seedEnabledScheduledTask(t, store, s, agentID, "Reconsent", 65)
+	path := "/api/v1/tenants/" + s.tenantID + "/scheduled-tasks/" + taskID
+
+	_, _, err := store.Public(context.Background(), &core.PublicRequest{
+		Method: "POST", Key: "revoke", Path: path + "/revoke-consent",
+		TenantID: s.tenantID, ScheduledTaskID: taskID, Identity: caller, Body: core.Object{},
+	})
+	must(t, err)
+
+	_, _, err = store.Public(context.Background(), &core.PublicRequest{
+		Method: "POST", Key: "enable-no-consent", Path: path + "/enable",
+		TenantID: s.tenantID, ScheduledTaskID: taskID, Identity: caller, Body: core.Object{},
+	})
+	if fault := core.ErrorCode(err); fault.Code != "approval_policy_invalid" {
+		t.Fatalf("enable without fresh consent must be approval_policy_invalid, got %v", err)
+	}
+
+	_, _, err = store.Public(context.Background(), &core.PublicRequest{
+		Method: "POST", Key: "enable-reconsent", Path: path + "/enable",
+		TenantID: s.tenantID, ScheduledTaskID: taskID, Identity: caller,
+		Body: core.Object{"approval": core.Object{"policy": "full_auto_in_cloud_workspace"}},
+	})
+	must(t, err)
+	var enabled bool
+	var policy string
+	must(t, store.Pool.QueryRow(`SELECT enabled, COALESCE(unattended_policy,'') FROM scheduled_tasks WHERE id=$1`, taskID).Scan(&enabled, &policy))
+	if !enabled || policy != "full_auto_in_cloud_workspace" {
+		t.Fatalf("re-consent enable must restore consent, got enabled=%v policy=%q", enabled, policy)
+	}
+}
+
+// TestScheduledTaskReadRequiresBoundIssue pins D1 读取跟随绑定 issue 可见性：绑定 issue 已删除后，
+// 任务的读取与历史读取都回答 404 not_found。
+func TestScheduledTaskReadRequiresBoundIssue(t *testing.T) {
+	store, s, agentID := scheduledTaskStore(t)
+	caller := scheduledTaskCaller(t, store, s.tenantID)
+	taskID := seedEnabledScheduledTask(t, store, s, agentID, "Orphan read", 65)
+	_, err := store.Pool.Exec(`UPDATE issues SET deleted_at=now() WHERE id=$1`, s.issueID)
+	must(t, err)
+
+	_, _, err = store.Public(context.Background(), &core.PublicRequest{
+		Method: "GET", Key: "orphan-get", Path: "/api/v1/tenants/" + s.tenantID + "/scheduled-tasks/" + taskID,
+		TenantID: s.tenantID, ScheduledTaskID: taskID, Identity: caller,
+	})
+	if fault := core.ErrorCode(err); fault.Status != 404 || fault.Code != "not_found" {
+		t.Fatalf("read of a task whose issue is deleted must be 404 not_found, got %v", err)
+	}
+}
diff --git a/integration/scheduled_task_http_test.go b/integration/scheduled_task_http_test.go
new file mode 100644
index 00000000..226fcb45
--- /dev/null
+++ b/integration/scheduled_task_http_test.go
@@ -0,0 +1,108 @@
+package integration
+
+import (
+	"testing"
+
+	"github.com/google/uuid"
+)
+
+// These HTTP tests pin the scheduled-task model and re-consent boundaries through the real Gin
+// router and the Store.Public dispatch, not Store.Public directly: the transport's field whitelist
+// (unknown_field) and the 409 fault shapes are exactly what a Store.Public-only test cannot hold.
+
+// seedScheduledTaskHTTPScene seeds a skeleton in its own tenant, joins the fixture's verified user as
+// an admin, and lays down the agent and the creator's model chain, so the create/enable path runs the
+// real eligibility table against the caller's membership and model configuration.
+func seedScheduledTaskHTTPScene(t *testing.T, f *fixture) (skeletonSeed, string) {
+	t.Helper()
+	f.store.ScheduledTaskAcceptanceEnabled = true
+	s := seedAgentIssueRunSkeleton(t, f.store.Pool)
+	_, err := f.store.Pool.Exec(`INSERT INTO tenant_memberships(tenant_id,user_id,role,status) VALUES($1,$2,'admin','active')`, s.tenantID, f.uid)
+	must(t, err)
+	_, err = f.store.Pool.Exec(`UPDATE issues SET project_ref=$1 WHERE id=$2`, s.projectID, s.issueID)
+	must(t, err)
+	agentID := seedScheduledTaskAgent(t, f.store.Pool, s)
+	seedScheduledTaskModelChain(t, f.store, f.uid)
+	return s, agentID
+}
+
+// TestScheduledTaskModelOverHTTP pins D1 model selection through the transport: the create body
+// carries model and it round-trips, and a PATCH model change persists with the revision bump.
+func TestScheduledTaskModelOverHTTP(t *testing.T) {
+	f := setup(t)
+	s, agentID := seedScheduledTaskHTTPScene(t, f)
+	path := "/api/v1/tenants/" + s.tenantID + "/scheduled-tasks"
+
+	create := mustJSONRaw(map[string]any{
+		"issueId": s.issueID, "agentId": agentID, "name": "Model task", "prompt": "Sync",
+		"model":    scheduledTaskModelID,
+		"schedule": map[string]any{"kind": "every_hours", "intervalHours": 1},
+		"timezone": "Asia/Shanghai",
+		"enabled":  false,
+	})
+	status, out, err := f.threadRequest("POST", path, create, uuid.NewString())
+	must(t, err)
+	if status != 200 || out.O("resource").S("model") != scheduledTaskModelID {
+		t.Fatalf("HTTP create with model: want 200 + model %q, got %d %v", scheduledTaskModelID, status, out)
+	}
+	taskID := out.O("resource").S("id")
+
+	patch := mustJSONRaw(map[string]any{"model": scheduledTaskAlternateModelID, "version": out.O("resource").N("version")})
+	status, out, err = f.threadRequest("PATCH", path+"/"+taskID, patch, uuid.NewString())
+	must(t, err)
+	if status != 200 || out.O("resource").S("model") != scheduledTaskAlternateModelID {
+		t.Fatalf("HTTP PATCH model: want 200 + model %q, got %d %v", scheduledTaskAlternateModelID, status, out)
+	}
+	var model string
+	var revision int64
+	must(t, f.store.Pool.QueryRow(`SELECT COALESCE(model,''), revision FROM scheduled_tasks WHERE id=$1`, taskID).Scan(&model, &revision))
+	if model != scheduledTaskAlternateModelID || revision != 2 {
+		t.Fatalf("model update must persist with revision bump, got model=%q revision=%d", model, revision)
+	}
+}
+
+// TestScheduledTaskReconsentOverHTTP pins D5 re-consent through the transport: after revoke clears the
+// consent, enable without approval is refused and enable with a fresh approval restores the consent.
+func TestScheduledTaskReconsentOverHTTP(t *testing.T) {
+	f := setup(t)
+	s, agentID := seedScheduledTaskHTTPScene(t, f)
+	path := "/api/v1/tenants/" + s.tenantID + "/scheduled-tasks"
+
+	create := mustJSONRaw(map[string]any{
+		"issueId": s.issueID, "agentId": agentID, "name": "Consent task", "prompt": "Sync",
+		"schedule": map[string]any{"kind": "every_hours", "intervalHours": 1},
+		"timezone": "Asia/Shanghai",
+		"approval": map[string]any{"policy": "full_auto_in_cloud_workspace"},
+		"enabled":  true,
+	})
+	status, out, err := f.threadRequest("POST", path, create, uuid.NewString())
+	must(t, err)
+	if status != 200 {
+		t.Fatalf("HTTP create enabled: want 200, got %d %v", status, out)
+	}
+	taskID := out.O("resource").S("id")
+
+	status, _, err = f.threadRequest("POST", path+"/"+taskID+"/revoke-consent", `{}`, uuid.NewString())
+	must(t, err)
+	if status != 200 {
+		t.Fatalf("HTTP revoke-consent: want 200, got %d", status)
+	}
+
+	status, out, err = f.threadRequest("POST", path+"/"+taskID+"/enable", `{}`, uuid.NewString())
+	must(t, err)
+	if status != 409 || out.S("code") != "approval_policy_invalid" {
+		t.Fatalf("HTTP enable without fresh consent: want 409 approval_policy_invalid, got %d %v", status, out)
+	}
+
+	status, out, err = f.threadRequest("POST", path+"/"+taskID+"/enable", mustJSONRaw(map[string]any{"approval": map[string]any{"policy": "full_auto_in_cloud_workspace"}}), uuid.NewString())
+	must(t, err)
+	if status != 200 {
+		t.Fatalf("HTTP enable with fresh consent: want 200, got %d %v", status, out)
+	}
+	var enabled bool
+	var policy string
+	must(t, f.store.Pool.QueryRow(`SELECT enabled, COALESCE(unattended_policy,'') FROM scheduled_tasks WHERE id=$1`, taskID).Scan(&enabled, &policy))
+	if !enabled || policy != "full_auto_in_cloud_workspace" {
+		t.Fatalf("re-consent enable must restore consent, got enabled=%v policy=%q", enabled, policy)
+	}
+}
diff --git a/integration/scheduled_task_migration_test.go b/integration/scheduled_task_migration_test.go
index f1036b02..e89078f8 100644
--- a/integration/scheduled_task_migration_test.go
+++ b/integration/scheduled_task_migration_test.go
@@ -8,7 +8,10 @@ import (
 	"github.com/google/uuid"
 )
 
-const scheduledTaskMigration = "0061_scheduled_tasks.sql"
+const (
+	scheduledTaskMigration      = "0061_scheduled_tasks.sql"
+	scheduledTaskModelMigration = "0071_scheduled_task_model.sql"
+)
 
 // seedScheduledTaskAgent inserts the one space_agents row a definition binds, returning its id.
 func seedScheduledTaskAgent(t *testing.T, pool *sql.DB, s skeletonSeed) string {
@@ -152,6 +155,29 @@ func TestMigration0061ScheduledTasksUpgradeAndReplay(t *testing.T) {
 	}
 }
 
+func TestMigration0071ScheduledTaskModelUpgradeAndReplay(t *testing.T) {
+	pool, _ := testSchema(t, "test_scheduled71u_")
+	applyMigrationsUpTo(t, pool, migrationsBefore(t, scheduledTaskModelMigration))
+	s := seedAgentIssueRunSkeleton(t, pool)
+	agentID := seedScheduledTaskAgent(t, pool, s)
+	taskID := insertScheduledTask(t, pool, s, agentID, "")
+
+	store := newStoreOnSchema(t, pool)
+	must(t, store.Migrate(context.Background()))
+	var model sql.NullString
+	must(t, pool.QueryRow(`SELECT model FROM scheduled_tasks WHERE id=$1`, taskID).Scan(&model))
+	if model.Valid {
+		t.Fatalf("0071 must leave existing definitions without a selected model, got %q", model.String)
+	}
+	_, err := pool.Exec(`UPDATE scheduled_tasks SET model='vendor/model-v2' WHERE id=$1`, taskID)
+	must(t, err)
+	must(t, store.Migrate(context.Background()))
+	must(t, pool.QueryRow(`SELECT model FROM scheduled_tasks WHERE id=$1`, taskID).Scan(&model))
+	if !model.Valid || model.String != "vendor/model-v2" {
+		t.Fatalf("replaying 0071 must preserve selected model, got %#v", model)
+	}
+}
+
 // scheduledMigrationBusinessSnapshot captures the business tables a definition references so the
 // upgrade path can prove it rewrote none of them.
 func scheduledMigrationBusinessSnapshot(t *testing.T, pool *sql.DB) string {
diff --git a/integration/scheduled_task_model_protocol_test.go b/integration/scheduled_task_model_protocol_test.go
new file mode 100644
index 00000000..37718dc7
--- /dev/null
+++ b/integration/scheduled_task_model_protocol_test.go
@@ -0,0 +1,69 @@
+package integration
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"github.com/wanglongan587/cloud/internal/core"
+	"github.com/wanglongan587/cloud/internal/pluginmarket"
+)
+
+// seedScheduledTaskClaudeModelOverride prepares a declared Claude agent whose declaration and adapter
+// accept only anthropic-messages, a creator whose personal default connection is OpenAI, and a task
+// whose definition selects the OpenAI default model. It returns the task ID.
+func seedScheduledTaskClaudeModelOverride(t *testing.T, store *core.Store, s skeletonSeed) string {
+	t.Helper()
+	claudeAgentID := seedScheduledTaskAgentWithPlugin(t, store.Pool, s, "official/ora-space.claude")
+	declaration := `{"schemaVersion":2,"agent":{"modelAccess":{"contractVersion":1,"protocols":["anthropic-messages"],"modelCardinality":"single"}}}`
+	compiled, err := pluginmarket.CompileAgentConfiguration([]byte(declaration))
+	must(t, err)
+	release := core.Object{
+		"id": "official/ora-space.claude", "kind": "agent", "version": "1.0.0",
+		"url": "https://packages.example.invalid/claude.orax", "sha256": strings.Repeat("c", 64),
+		"agentConfiguration": core.Object{"schemaVersion": 2, "declarationSha256": compiled.Fingerprint, "declaration": declaration},
+	}
+	_, err = store.Pool.Exec(`INSERT INTO space_plugins(space_id,tenant_id,source_namespace,identifier,desired_state,desired_version,selected_release)
+		VALUES($1,$2,'official','ora-space.claude','installed','1.0.0',$3)`, s.spaceID, s.tenantID, mustJSON(t, release))
+	must(t, err)
+	store.PersonalAgentRuntime = &core.PersonalAgentRuntime{Target: "x86_64-unknown-linux-gnu", ContractVersion: 1, Protocols: []string{"anthropic-messages"}}
+
+	// A creator-owned anthropic connection plus the Claude configuration pointing at it, so the
+	// declared path resolves cleanly before the task override is applied.
+	anthropicConn := uuid.NewString()
+	cred := uuid.NewString()
+	_, err = store.Pool.Exec(`INSERT INTO personal_model_credentials(id,user_id,ciphertext,key_id) VALUES($1,$2,repeat('a',64),'claude-test')`, cred, s.userID)
+	must(t, err)
+	_, err = store.Pool.Exec(`INSERT INTO personal_model_connections(id,user_id,credential_id,name,protocol,base_url,auth_mode,models,enabled)
+		VALUES($1,$2,$3,'Claude Provider','anthropic-messages','https://models.example.invalid/anthropic','bearer',$4::jsonb,true)`,
+		anthropicConn, s.userID, cred, `[{"id":"claude-model","name":"Claude Model","contextWindow":200000,"maxTokens":8192}]`)
+	must(t, err)
+	_, err = store.Pool.Exec(`INSERT INTO personal_agent_configurations(user_id,plugin_id,declaration_fingerprint,settings,connection_id,model_id,revision,cleared)
+		VALUES($1,'official/ora-space.claude',$2,'{}'::jsonb,$3,'claude-model',1,false)`, s.userID, compiled.Fingerprint, anthropicConn)
+	must(t, err)
+
+	taskID := seedEnabledScheduledTask(t, store, s, claudeAgentID, "Protocol override", 65)
+	_, err = store.Pool.Exec(`UPDATE scheduled_tasks SET model=$1 WHERE id=$2`, scheduledTaskModelID, taskID)
+	must(t, err)
+	return taskID
+}
+
+// TestScheduledTaskIncompatibleModelOverrideFailsOccurrence pins the review's protocol gate: a Claude
+// declaration backed by Anthropic plus a task model selected on the creator's OpenAI default must be
+// refused at admission as a model_unavailable occurrence, not frozen into an OpenAI binding the Claude
+// runtime cannot execute.
+func TestScheduledTaskIncompatibleModelOverrideFailsOccurrence(t *testing.T) {
+	store, s, _ := scheduledTaskStore(t)
+	taskID := seedScheduledTaskClaudeModelOverride(t, store, s)
+
+	must(t, store.EvaluateScheduledTasksOnce(context.Background()))
+	must(t, store.EvaluateScheduledTasksOnce(context.Background()))
+	var count, runs int
+	var outcome, reason string
+	must(t, store.Pool.QueryRow(`SELECT count(*), COALESCE(min(outcome),''), COALESCE(min(failure_reason),''), count(run_id) FROM scheduled_task_occurrences WHERE task_id=$1`, taskID).Scan(&count, &outcome, &reason, &runs))
+	if count != 1 || outcome != "failed" || reason != "model_unavailable" || runs != 0 {
+		t.Fatalf("incompatible model override must leave one failed model_unavailable occurrence without a run, got count=%d outcome=%q reason=%q runs=%d", count, outcome, reason, runs)
+	}
+}
diff --git a/internal/api/router/router.go b/internal/api/router/router.go
index 624a2d43..0ac7904a 100644
--- a/internal/api/router/router.go
+++ b/internal/api/router/router.go
@@ -185,15 +185,15 @@ func Routes() []Route {
 		{"POST", "/api/v1/tenants/:tid/issues/:iid/runs/:rid/thread/messages", "", []string{"content"}},
 		{"POST", "/api/v1/tenants/:tid/issues/:iid/runs/:rid/thread/end", "", nil},
 		{"POST", "/api/v1/tenants/:tid/issues/:iid/runs/:rid/cancel", "", nil},
-		{"POST", "/api/v1/tenants/:tid/scheduled-tasks", "", []string{"issueId", "name", "prompt", "agentId", "schedule", "timezone", "approval", "enabled"}},
+		{"POST", "/api/v1/tenants/:tid/scheduled-tasks", "", []string{"issueId", "name", "prompt", "agentId", "model", "schedule", "timezone", "approval", "enabled"}},
 		{"GET", "/api/v1/tenants/:tid/scheduled-tasks", "", nil},
 		{"GET", "/api/v1/tenants/:tid/scheduled-tasks/:stid", "", nil},
-		{"PATCH", "/api/v1/tenants/:tid/scheduled-tasks/:stid", "", []string{"version", "name", "prompt", "agentId", "schedule", "timezone"}},
+		{"PATCH", "/api/v1/tenants/:tid/scheduled-tasks/:stid", "", []string{"version", "name", "prompt", "agentId", "model", "schedule", "timezone"}},
 		{"DELETE", "/api/v1/tenants/:tid/scheduled-tasks/:stid", "", nil},
 		{"GET", "/api/v1/tenants/:tid/scheduled-tasks/:stid/history", "", nil},
 		{"GET", scheduledArtifactsPath, "", nil},
 		{"GET", scheduledArtifactPath, "", nil},
-		{"POST", "/api/v1/tenants/:tid/scheduled-tasks/:stid/enable", "", nil},
+		{"POST", "/api/v1/tenants/:tid/scheduled-tasks/:stid/enable", "", []string{"approval"}},
 		{"POST", "/api/v1/tenants/:tid/scheduled-tasks/:stid/disable", "", nil},
 		{"POST", "/api/v1/tenants/:tid/scheduled-tasks/:stid/revoke-consent", "", nil},
 		{"GET", TaskConversationPath, "", nil},
diff --git a/internal/api/router/router_test.go b/internal/api/router/router_test.go
index edcb5b4c..189beb1a 100644
--- a/internal/api/router/router_test.go
+++ b/internal/api/router/router_test.go
@@ -127,7 +127,7 @@ func TestScheduledTaskFieldValidation(t *testing.T) {
 func TestScheduledTaskDocumentedBodyPassesFieldValidation(t *testing.T) {
 	const body = `{"issueId":"c0b8b8e4-6a2f-4f6f-9d6d-0d0b5f0c9a11",
 		"agentId":"3f0d0a6e-8f0e-4a53-9a4e-9f1b0d3f5c22","name":"Nightly acceptance",
-		"prompt":"write the acceptance report","timezone":"Asia/Shanghai",
+		"prompt":"write the acceptance report","model":"vendor/model-v1","timezone":"Asia/Shanghai",
 		"schedule":{"kind":"daily","hour":3,"minute":5},
 		"approval":{"policy":"full_auto_in_cloud_workspace"},"enabled":true}`
 	decoder := json.NewDecoder(strings.NewReader(body))
@@ -138,7 +138,7 @@ func TestScheduledTaskDocumentedBodyPassesFieldValidation(t *testing.T) {
 	}
 	fields := map[string]bool{
 		"issueId": true, "name": true, "prompt": true, "agentId": true,
-		"schedule": true, "timezone": true, "approval": true, "enabled": true,
+		"model": true, "schedule": true, "timezone": true, "approval": true, "enabled": true,
 	}
 	if len(decoded) != len(fields) {
 		t.Fatalf("documented body fields = %v", decoded)
@@ -152,7 +152,7 @@ func TestScheduledTaskDocumentedBodyPassesFieldValidation(t *testing.T) {
 		}
 	}
 	patch := `{"version":1,"name":"Renamed","prompt":"new prompt","agentId":"3f0d0a6e-8f0e-4a53-9a4e-9f1b0d3f5c22",
-		"schedule":{"kind":"every_hours","intervalHours":2},"timezone":"Asia/Shanghai"}`
+		"model":"vendor/model-v2","schedule":{"kind":"every_hours","intervalHours":2},"timezone":"Asia/Shanghai"}`
 	decoder = json.NewDecoder(strings.NewReader(patch))
 	decoder.UseNumber()
 	var decodedPatch map[string]any
diff --git a/internal/contract/openapi.go b/internal/contract/openapi.go
index 1fded54c..cdb9a852 100644
--- a/internal/contract/openapi.go
+++ b/internal/contract/openapi.go
@@ -93,7 +93,7 @@ func Document() map[string]any {
 	// issue_run.thread_appended / issue_run.thread_changed address one agent run's Thread (Thread
 	// D5): issueId and runId name it and lastSeq is only a hint — the Thread GET alone moves a
 	// client's cursor. Every other event omits the three fields.
-	s["SpaceEvent"] = object(obj{"type": enumeration("space.updated", "space.member_updated", "project.created", "project.updated", "project.archived", "space.plugins_updated", "plugins.catalog_updated", "issue_run.thread_appended", "issue_run.thread_changed", "project.repository_updated", "issue.conversation_changed", "scheduled_task.artifacts_updated"), "spaceId": uuid(), "projectId": optional(uuid()), "version": number(), "issueId": uuid(), "runId": uuid(), "lastSeq": number()}, "type", "spaceId")
+	s["SpaceEvent"] = object(obj{"type": enumeration("space.updated", "space.member_updated", "project.created", "project.updated", "project.archived", "space.plugins_updated", "plugins.catalog_updated", "issue_run.thread_appended", "issue_run.thread_changed", "project.repository_updated", "issue.conversation_changed", "scheduled_task.artifacts_updated", "space.scheduled_tasks_updated"), "spaceId": uuid(), "projectId": optional(uuid()), "version": number(), "issueId": uuid(), "runId": uuid(), "lastSeq": number(), "scheduledTaskId": optional(uuid())}, "type", "spaceId")
 	// GitIdentity is the identity the caller's Agent runs commit as (identity-access git identity
 	// D1). version is 0 while isDefault is true: no identity is stated and the default applies.
 	s["GitIdentity"] = object(obj{"name": str(), "email": str(), "isDefault": boolean(), "version": number()}, "name", "email", "isDefault", "version")
@@ -244,7 +244,8 @@ func Document() map[string]any {
 	}, "kind")
 	s["ScheduledTaskApproval"] = object(obj{"policy": enumeration("full_auto_in_cloud_workspace")}, "policy")
 	s["ScheduledTask"] = object(obj{
-		"id": uuid(), "issueId": uuid(), "name": str(), "prompt": str(), "agentId": uuid(),
+		"id": uuid(), "issueId": uuid(), "creatorUserId": uuid(), "name": str(), "prompt": str(), "agentId": uuid(),
+		"model":    optional(str()),
 		"schedule": ref("ScheduledTaskSchedule"), "timezone": str(),
 		"revision":              number(),
 		"version":               number(),
@@ -253,7 +254,7 @@ func Document() map[string]any {
 		"unattendedConsentedAt": optional(timestamp()),
 		"disabledReason":        optional(str()),
 		"createdAt":             timestamp(), "updatedAt": timestamp(),
-	}, "id", "issueId", "name", "prompt", "agentId", "schedule", "timezone", "revision", "version", "enabled", "createdAt", "updatedAt")
+	}, "id", "issueId", "creatorUserId", "name", "prompt", "agentId", "schedule", "timezone", "revision", "version", "enabled", "createdAt", "updatedAt")
 	s["ScheduledTaskList"] = object(obj{"tasks": array(ref("ScheduledTask")), "acceptanceEnabled": boolean()}, "tasks", "acceptanceEnabled")
 	s["ScheduledArtifactList"] = object(obj{"artifacts": array(ref("ScheduledArtifact"))}, "artifacts")
 	s["ScheduledArtifact"] = object(obj{
@@ -1060,7 +1061,11 @@ func optionalField(name string, r router.Route) bool {
 		return repositoryOptional(name, r)
 	}
 	if strings.Contains(r.Path, "/scheduled-tasks") {
-		return name == "enabled" || (r.Method == "PATCH" && name != "version")
+		// A disabled create is a draft and therefore carries no unattended consent. Enable accepts
+		// approval only when a prior revoke cleared it, while an already-consented task can be
+		// enabled without re-sending the historical grant. Model selection is optional and falls
+		// back to the creator's current default when omitted.
+		return name == "enabled" || name == "approval" || name == "model" || (r.Method == "PATCH" && name != "version")
 	}
 	if strings.HasPrefix(r.Path, "/api/v1/me/model-") {
 		return name == "enabled"
diff --git a/internal/contract/scheduled_artifact_test.go b/internal/contract/scheduled_artifact_test.go
index 6e864a51..e8360cd0 100644
--- a/internal/contract/scheduled_artifact_test.go
+++ b/internal/contract/scheduled_artifact_test.go
@@ -48,3 +48,30 @@ func TestSpaceEventIncludesScheduledArtifactInvalidation(t *testing.T) {
 		t.Fatal("artifact invalidation missing from the published SSE contract")
 	}
 }
+
+// Pin the D7 invalidation surface: the SpaceEvent carries the scheduled-task notice type and its task
+// identity, so a regenerated client can refetch a tenant's task list and one open history.
+func TestSpaceEventIncludesScheduledTaskInvalidation(t *testing.T) {
+	schemas := Document()["components"].(map[string]any)["schemas"].(map[string]any)
+	event := schemas["SpaceEvent"].(map[string]any)["properties"].(map[string]any)
+	types := event["type"].(map[string]any)["enum"].([]string)
+	if !slices.Contains(types, "space.scheduled_tasks_updated") {
+		t.Fatal("scheduled-task invalidation missing from the published SSE contract")
+	}
+	if event["scheduledTaskId"] == nil {
+		t.Fatal("scheduledTaskId missing from the published SpaceEvent contract")
+	}
+}
+
+// Pin the D1 resource surface: the task resource exposes the creator and the frozen model selection
+// so a regenerated client can read both.
+func TestScheduledTaskResourceCarriesModelAndCreator(t *testing.T) {
+	schemas := Document()["components"].(map[string]any)["schemas"].(map[string]any)
+	props := schemas["ScheduledTask"].(map[string]any)["properties"].(map[string]any)
+	if props["creatorUserId"] == nil {
+		t.Fatal("creatorUserId missing from the ScheduledTask contract")
+	}
+	if props["model"] == nil {
+		t.Fatal("model missing from the ScheduledTask contract")
+	}
+}
diff --git a/internal/core/declared_agent_startup_db_test.go b/internal/core/declared_agent_startup_db_test.go
index 5e303d91..3d130f01 100644
--- a/internal/core/declared_agent_startup_db_test.go
+++ b/internal/core/declared_agent_startup_db_test.go
@@ -16,7 +16,7 @@ func declaredStartupScene(t *testing.T) (personalAgentScene, string) {
 	scene.store.PersonalAgentRuntime = &PersonalAgentRuntime{Target: "x86_64-unknown-linux-gnu", ContractVersion: 1, Protocols: []string{"anthropic-messages"}}
 	result, err := scene.store.transact(context.Background(), func(tx *transaction) Object {
 		input := Object{"agentPluginId": claudeAgentCLI, "agentPluginVersion": "1.0.0"}
-		bindRunModel(tx, scene.seed.run, scene.uid, input)
+		bindRunModel(tx, scene.seed.run, scene.uid, input, "")
 		created := createRunWorkspace(tx, scene.seed.run)
 		workspace, operation := created.O("workspace").S("id"), created.O("operation").S("id")
 		tx.exec("UPDATE operations SET state='succeeded',step='done',version=version+1 WHERE id=$1", operation)
diff --git a/internal/core/hub.go b/internal/core/hub.go
index e3474c0b..cb1c51d6 100644
--- a/internal/core/hub.go
+++ b/internal/core/hub.go
@@ -12,13 +12,14 @@ import "sync"
 // LastSeq says only "there is data at or below this seq", never which entries exist, and it never
 // advances a client's cursor — only the Thread GET does that.
 type SpaceEvent struct {
-	Type      string `json:"type"`
-	SpaceID   string `json:"spaceId"`
-	ProjectID string `json:"projectId,omitempty"`
-	Version   int64  `json:"version,omitempty"`
-	IssueID   string `json:"issueId,omitempty"`
-	RunID     string `json:"runId,omitempty"`
-	LastSeq   int64  `json:"lastSeq,omitempty"`
+	Type            string `json:"type"`
+	SpaceID         string `json:"spaceId"`
+	ProjectID       string `json:"projectId,omitempty"`
+	Version         int64  `json:"version,omitempty"`
+	IssueID         string `json:"issueId,omitempty"`
+	RunID           string `json:"runId,omitempty"`
+	LastSeq         int64  `json:"lastSeq,omitempty"`
+	ScheduledTaskID string `json:"scheduledTaskId,omitempty"`
 }
 
 // SpaceHub fans committed workspace events out to live subscribers.
diff --git a/internal/core/issue_run_lifecycle.go b/internal/core/issue_run_lifecycle.go
index 911e28fe..3bb478a7 100644
--- a/internal/core/issue_run_lifecycle.go
+++ b/internal/core/issue_run_lifecycle.go
@@ -104,6 +104,13 @@ func enqueueRunWithInvocation(t *transaction, tid, iid, executorType, executorID
 	if input == nil {
 		input = Object{}
 	}
+	// A scheduled task may supply an already-authorized model id from its definition. It is never
+	// persisted as execution input; only the binding written below becomes runtime authority.
+	scheduledModel := ""
+	if triggerKind == "scheduled_task" {
+		scheduledModel = input.S("scheduledTaskModel")
+	}
+	delete(input, "scheduledTaskModel")
 	// This opaque reference is server-owned even for agents that do not use personal models.
 	delete(input, "modelBindingId")
 	delete(input, "agentConfiguration")
@@ -118,7 +125,7 @@ func enqueueRunWithInvocation(t *transaction, tid, iid, executorType, executorID
 	if executorType == "agent" {
 		// Caller-supplied private bindings cannot authorize a model connection. The production
 		// OpenCode path always creates its own owner-scoped binding in this transaction.
-		bindRunModel(t, id, actorID, input)
+		bindRunModel(t, id, actorID, input, scheduledModel)
 	}
 	appendActivity(t, tid, iid, actorType, actorID, "run.enqueued", runActivityDetails(id, executorType, executorID, nil))
 	return run(t, tid, iid, id)
diff --git a/internal/core/migrations/0071_scheduled_task_model.sql b/internal/core/migrations/0071_scheduled_task_model.sql
new file mode 100644
index 00000000..66d0e869
--- /dev/null
+++ b/internal/core/migrations/0071_scheduled_task_model.sql
@@ -0,0 +1,3 @@
+-- D1: 创建者的模型选择随任务定义持久化（可空——缺省走创建者个人默认/agent 默认）。修改模型选择
+-- 增加 revision（见 scheduled_task_api.go）。Additive；不改写已应用的迁移。
+ALTER TABLE scheduled_tasks ADD COLUMN model text;
diff --git a/internal/core/migrations/README.en.md b/internal/core/migrations/README.en.md
index 64242afd..f24deac3 100644
--- a/internal/core/migrations/README.en.md
+++ b/internal/core/migrations/README.en.md
@@ -82,6 +82,7 @@ There are currently 72 SQL files.
 | [0068_scheduled_manifest_completeness.sql](0068_scheduled_manifest_completeness.sql) | Persist omitted rejection counts and walk truncation facts |
 | [0069_workflow_node_attempt.sql](0069_workflow_node_attempt.sql) | Per-attempt identity for workflow node work items, executions and end requests |
 | [0070_d8_missing_delete_operation.sql](0070_d8_missing_delete_operation.sql) | Explicit D8 missing-delete provenance and mutually exclusive identity constraints |
+| [0071_scheduled_task_model.sql](0071_scheduled_task_model.sql) | Optional selected model on scheduled tasks |
 
 0050 copies no personal connection or key and backfills no historical run. Clearing configuration retains its revision; run options are stored separately from shared run input.
 
@@ -89,6 +90,8 @@ There are currently 72 SQL files.
 
 0070 adds the default-off `legacy_delete_operation_missing` marker to controlled reclamation intents. Existing D8 intents with original deletion identities and residual-ledger intents retain their values. Only an explicitly selected missing-delete variant records the absence; no Run history is backfilled or changed. Fresh schemas, preceding-schema upgrades, repeated migration, and rejection of contradictory provenance are covered by `TestControlledD8MissingDeleteMigrationUpgradesAndRepeats`.
 
+0071 adds a nullable `model` to `scheduled_tasks`. The upgrade never guesses a model for existing definitions; each admission resolves the selected value through the creator's then-usable connection and freezes that resolution into the new IssueRun. A null value continues to mean the creator's default model at admission. Upgrade and replay coverage is `TestMigration0071ScheduledTaskModelUpgradeAndReplay`.
+
 - Never edit or rename applied SQL; corrections use new forward migrations. Repeated application skips applied files with matching checksums.
 - `CheckSchema` only reads and rejects missing migrations, checksum mismatches and unknown database versions. Production services do not run DDL; operators migrate through [cloudctl](../../../cmd/cloudctl/README.en.md).
 - Files describe their application-time changes, not the final schema alone. For example, 0017 supersedes 0013's nullable space scope; 0016 retains old storage/worktree records while retiring their steps.
diff --git a/internal/core/migrations/README.md b/internal/core/migrations/README.md
index dd93c066..9b8a59db 100644
--- a/internal/core/migrations/README.md
+++ b/internal/core/migrations/README.md
@@ -82,6 +82,7 @@ SQL 通过 `core/store.go` 的 `embed.FS` 编入二进制。`Store.Migrate` 在
 | [0068_scheduled_manifest_completeness.sql](0068_scheduled_manifest_completeness.sql) | 保存未列明的拒绝数和遍历截断事实 |
 | [0069_workflow_node_attempt.sql](0069_workflow_node_attempt.sql) | 工作流节点工作项、执行与结束请求的尝试序号 |
 | [0070_d8_missing_delete_operation.sql](0070_d8_missing_delete_operation.sql) | D8 无原删除操作的显式来源标记与互斥约束 |
+| [0071_scheduled_task_model.sql](0071_scheduled_task_model.sql) | 定时任务可选模型选择 |
 
 0050 不复制个人连接或 Key，不回填历史运行；清除配置保留 revision，运行选项独立于共享运行输入保存。
 
@@ -89,6 +90,8 @@ SQL 通过 `core/store.go` 的 `embed.FS` 编入二进制。`Store.Migrate` 在
 
 0070 给受控回收意图增加默认关闭的 `legacy_delete_operation_missing`。有原删除操作的 D8 和残留账本意图保持原值；仅明确选择无删除操作变体时才可记录缺失，不回填或修改 Run 历史。空库、前一版升级、重复迁移和矛盾来源拒绝由 `TestControlledD8MissingDeleteMigrationUpgradesAndRepeats` 覆盖。
 
+0071 为 `scheduled_tasks` 添加可空的 `model`。升级不为既有定义猜测模型；每次接纳才按创建者当前可用连接解析该选择，并将解析结果冻结到新 IssueRun。空值仍表示该次接纳使用创建者默认模型。升级与重放由 `TestMigration0071ScheduledTaskModelUpgradeAndReplay` 覆盖。
+
 - 已应用 SQL 不改内容、不改文件名；更正用新的前向迁移。重复应用跳过 checksum 相同的已应用文件。
 - `CheckSchema` 只读检查缺失迁移、checksum 不符和未知数据库版本，发现不一致拒绝启动。生产服务不执行 DDL，运维用 [cloudctl](../../../cmd/cloudctl/README.md) 应用迁移。
 - 文件描述各自应用时的变化，不能单独当成最终 schema。例如 0013 的可空空间归属被 0017 取代；0016 保留旧存储/工作树记录但停用旧步骤。
diff --git a/internal/core/model_attempts_db_test.go b/internal/core/model_attempts_db_test.go
index f3e3f9b5..09e95cdf 100644
--- a/internal/core/model_attempts_db_test.go
+++ b/internal/core/model_attempts_db_test.go
@@ -40,7 +40,7 @@ func seedModelAttemptScene(t *testing.T) modelAttemptScene {
 	_, err = s.transact(t.Context(), func(tx *transaction) Object {
 		input := tx.one("SELECT input FROM issue_runs WHERE id=$1", scene.run).O("input")
 		input["agentPluginId"] = "official/ora-space.opencode"
-		bindRunModel(tx, scene.run, uid, input)
+		bindRunModel(tx, scene.run, uid, input, "")
 		binding = input.S("modelBindingId")
 		return nil
 	})
diff --git a/internal/core/model_connections_db_test.go b/internal/core/model_connections_db_test.go
index 140965a3..d04c2f0f 100644
--- a/internal/core/model_connections_db_test.go
+++ b/internal/core/model_connections_db_test.go
@@ -248,7 +248,7 @@ func TestModelGrantsScopeRenewalFreezeAndRevocation(t *testing.T) {
 		r := tx.one("SELECT * FROM issue_runs WHERE id=$1", scene.run)
 		input := r.O("input")
 		input["agentPluginId"] = "official/ora-space.opencode"
-		bindRunModel(tx, scene.run, uid, input)
+		bindRunModel(tx, scene.run, uid, input, "")
 		bindingID = input.S("modelBindingId")
 		return Object{}
 	})
diff --git a/internal/core/model_run_binding.go b/internal/core/model_run_binding.go
index b38648b7..b485fb0a 100644
--- a/internal/core/model_run_binding.go
+++ b/internal/core/model_run_binding.go
@@ -20,8 +20,8 @@ func defaultExecutorGap(t *transaction, uid string) (reason string, connection,
 
 // bindRunModel freezes personal model and declared Agent configuration in the run's creation
 // transaction. Missing configuration rolls back the comment, interaction, activity and run.
-func bindRunModel(t *transaction, runID, uid string, input Object) {
-	handled, c, m := declaredAgentRunModel(t, runID, uid, input)
+func bindRunModel(t *transaction, runID, uid string, input Object, selectedModel string) {
+	handled, c, m := declaredAgentRunModel(t, runID, uid, input, selectedModel)
 	if !handled && input.S("agentPluginId") != opencodeAgentCLI {
 		return
 	}
@@ -30,6 +30,13 @@ func bindRunModel(t *transaction, runID, uid string, input Object) {
 	reason := ""
 	if !handled {
 		reason, c, m = defaultExecutorGap(t, uid)
+		// An undeclared OpenCode run has no declaration protocol gates, so a scheduled override is
+		// still resolved and frozen against the owner's current default connection here. Declared
+		// agents resolve the override inside resolveDeclaredAgentRun so its protocol checks apply.
+		if selectedModel != "" {
+			defaultSelection := modelDefault(t, uid)
+			reason, c, m = personalExecutorGap(t, uid, defaultSelection.S("connectionId"), selectedModel)
+		}
 	}
 	switch reason {
 	case "":
diff --git a/internal/core/personal_agent_configurations_db_test.go b/internal/core/personal_agent_configurations_db_test.go
index 8870b909..2fe4fbd4 100644
--- a/internal/core/personal_agent_configurations_db_test.go
+++ b/internal/core/personal_agent_configurations_db_test.go
@@ -179,7 +179,7 @@ func TestPersonalAgentRunFreezeAndUnavailableAdapter(t *testing.T) {
 	}
 	input := Object{"agentPluginId": claudeAgentCLI, "agentPluginVersion": "1.0.0"}
 	_, err = s.store.transact(context.Background(), func(tx *transaction) Object {
-		bindRunModel(tx, s.seed.run, s.uid, input)
+		bindRunModel(tx, s.seed.run, s.uid, input, "")
 		return nil
 	})
 	expectModelFault(t, err, "agent_adapter_unavailable")
@@ -189,7 +189,7 @@ func TestPersonalAgentRunFreezeAndUnavailableAdapter(t *testing.T) {
 	}
 	s.store.PersonalAgentRuntime = &PersonalAgentRuntime{Target: "x86_64-unknown-linux-gnu", ContractVersion: 1, Protocols: []string{"anthropic-messages"}}
 	_, err = s.store.transact(context.Background(), func(tx *transaction) Object {
-		bindRunModel(tx, s.seed.run, s.uid, input)
+		bindRunModel(tx, s.seed.run, s.uid, input, "")
 		return nil
 	})
 	if err != nil {
@@ -319,7 +319,7 @@ func TestPersonalAgentThreadOwnershipAndPermanentRevocation(t *testing.T) {
 	s.store.PersonalAgentRuntime = &PersonalAgentRuntime{Target: "linux", ContractVersion: 1, Protocols: []string{"anthropic-messages"}}
 	_, err := s.store.transact(context.Background(), func(tx *transaction) Object {
 		input := Object{"agentPluginId": claudeAgentCLI, "agentPluginVersion": "1.0.0"}
-		bindRunModel(tx, s.seed.run, s.uid, input)
+		bindRunModel(tx, s.seed.run, s.uid, input, "")
 		run := tx.one("SELECT * FROM issue_runs WHERE id=$1", s.seed.run)
 		run["threadState"] = "idle"
 		owner := threadModelPermissions(tx, run, s.uid)
@@ -351,7 +351,7 @@ func TestPersonalAgentInvalidDeclarationCannotUseLegacyFallback(t *testing.T) {
 	_, err = s.request("GET", "", "", nil)
 	expectModelFault(t, err, "agent_declaration_invalid")
 	_, err = s.store.transact(context.Background(), func(tx *transaction) Object {
-		_, _, _ = resolveDeclaredAgentRun(tx, s.uid, s.space, claudeAgentCLI, "1.0.0")
+		_, _, _ = resolveDeclaredAgentRun(tx, s.uid, s.space, claudeAgentCLI, "1.0.0", "")
 		return nil
 	})
 	expectModelFault(t, err, "agent_declaration_invalid")
@@ -447,7 +447,7 @@ func TestPersonalAgentOpenCodeUsesGlobalDefaultAndRepairsRemovedSettings(t *test
 		t.Fatal(err)
 	}
 	_, err = s.store.transact(context.Background(), func(tx *transaction) Object {
-		_, _, _ = resolveDeclaredAgentRun(tx, s.uid, s.space, opencodeAgentCLI, "1.0.0")
+		_, _, _ = resolveDeclaredAgentRun(tx, s.uid, s.space, opencodeAgentCLI, "1.0.0", "")
 		return nil
 	})
 	expectModelFault(t, err, "agent_configuration_repair_required")
diff --git a/internal/core/personal_agent_readiness_db_test.go b/internal/core/personal_agent_readiness_db_test.go
index 8e97788f..7f7085a7 100644
--- a/internal/core/personal_agent_readiness_db_test.go
+++ b/internal/core/personal_agent_readiness_db_test.go
@@ -47,7 +47,7 @@ func TestPersonalAgentReadinessAndAdmissionUsePublicModelGaps(t *testing.T) {
 				t.Fatalf("unusable Claude readiness = %v, want %v", page["agentReadiness"], want)
 			}
 			_, err = s.store.transact(context.Background(), func(tx *transaction) Object {
-				bindRunModel(tx, s.seed.run, s.uid, Object{"agentPluginId": claudeAgentCLI, "agentPluginVersion": "1.0.0"})
+				bindRunModel(tx, s.seed.run, s.uid, Object{"agentPluginId": claudeAgentCLI, "agentPluginVersion": "1.0.0"}, "")
 				return nil
 			})
 			expectModelFault(t, err, test.code)
diff --git a/internal/core/personal_agent_run.go b/internal/core/personal_agent_run.go
index b8e71cd5..4d1e5dc6 100644
--- a/internal/core/personal_agent_run.go
+++ b/internal/core/personal_agent_run.go
@@ -20,8 +20,11 @@ var agentPackageDigest = regexp.MustCompile(`^[a-f0-9]{64}$`)
 
 // declaredAgentRunModel resolves and freezes the private Agent configuration in the run's
 // creation transaction. False preserves only existing undeclared routes; Claude never falls
-// back to a host login or OpenCode's default when its declaration is absent.
-func declaredAgentRunModel(t *transaction, runID, uid string, input Object) (handled bool, connection, model Object) {
+// back to a host login or OpenCode's default when its declaration is absent. A non-empty
+// selectedModel is a scheduled definition's explicit override: it is resolved and validated by the
+// same protocol gates as the declared configuration, so an incompatible override is refused here
+// rather than frozen into a binding the adapter cannot execute.
+func declaredAgentRunModel(t *transaction, runID, uid string, input Object, selectedModel string) (handled bool, connection, model Object) {
 	pluginID := input.S("agentPluginId")
 	context := t.one(`SELECT sa.space_id
 		FROM issue_runs r JOIN space_agents sa ON sa.id=r.executor_id AND sa.tenant_id=r.tenant_id
@@ -30,7 +33,7 @@ func declaredAgentRunModel(t *transaction, runID, uid string, input Object) (han
 		require(pluginID != claudeAgentCLI, 409, "agent_declaration_required")
 		return false, nil, nil
 	}
-	frozen, connection, model := resolveDeclaredAgentRun(t, uid, context.S("spaceId"), pluginID, input.S("agentPluginVersion"))
+	frozen, connection, model := resolveDeclaredAgentRun(t, uid, context.S("spaceId"), pluginID, input.S("agentPluginVersion"), selectedModel)
 	if frozen == nil {
 		return false, nil, nil
 	}
@@ -45,7 +48,11 @@ func declaredAgentRunModel(t *transaction, runID, uid string, input Object) (han
 
 // resolveDeclaredAgentRun is the read-only policy shared by readiness, queue admission and
 // final run creation. The caller either reports its fault or atomically persists its result.
-func resolveDeclaredAgentRun(t *transaction, uid, spaceID, pluginID, pluginVersion string) (snapshot, connection, model Object) {
+// selectedModel is a scheduled definition's optional model override: when set, it replaces the
+// declared connection/model and the full protocol gates below judge the final pair, so an override
+// that lands on a connection the Agent or runtime cannot execute fails here exactly like a broken
+// declaration instead of being frozen and rejected later by the adapter.
+func resolveDeclaredAgentRun(t *transaction, uid, spaceID, pluginID, pluginVersion, selectedModel string) (snapshot, connection, model Object) {
 	namespace, identifier, ok := pluginIdentity(pluginID)
 	require(ok, 400, "invalid_plugin_id")
 	selected := t.spacePluginRow(spaceID, namespace, identifier)
@@ -68,6 +75,14 @@ func resolveDeclaredAgentRun(t *transaction, uid, spaceID, pluginID, pluginVersi
 	} else {
 		reason, connection, model = personalExecutorGap(t, uid, configuration.S("connectionId"), configuration.S("modelId"))
 	}
+	// A scheduled definition may pin a model on the creator's current default connection. Resolve it
+	// before the protocol gates below: the override must be judged by the same rules as the declared
+	// pair, so a Claude declaration backed by Anthropic plus a task model on an OpenAI default cannot
+	// produce an OpenAI binding the Claude runtime refuses after dispatch.
+	if selectedModel != "" {
+		selection := modelDefault(t, uid)
+		reason, connection, model = personalExecutorGap(t, uid, selection.S("connectionId"), selectedModel)
+	}
 	require(reason == "", 409, safeAgentModelGap(reason))
 	require(slices.Contains(declaration.ModelAccess.Protocols, connection.S("protocol")), 409, "agent_model_protocol_mismatch")
 	require(pluginID != claudeAgentCLI || connection.S("protocol") == "anthropic-messages", 409, "agent_model_protocol_mismatch")
diff --git a/internal/core/public.go b/internal/core/public.go
index 9cf0dd23..5fc55a4d 100644
--- a/internal/core/public.go
+++ b/internal/core/public.go
@@ -244,6 +244,9 @@ func (s *Store) Public(ctx context.Context, r *PublicRequest) (Object, int, erro
 			} else {
 				out = Object{"resource": resolved}
 			}
+			// D7：任务定义或历史随写变更，发 Space 失效事件让任务列表与历史刷新。事件带任务标识，
+			// 客户端据此决定刷新整个列表还是单个任务详情/历史。
+			events = append(events, SpaceEvent{Type: "space.scheduled_tasks_updated", SpaceID: soleSpace(t, r.TenantID).S("id"), ScheduledTaskID: r.ScheduledTaskID})
 			if r.Method == "POST" && !strings.HasSuffix(r.Path, "/history") {
 				status = 200
 			}
diff --git a/internal/core/scheduled_task.go b/internal/core/scheduled_task.go
index 807d7a35..d2aefed8 100644
--- a/internal/core/scheduled_task.go
+++ b/internal/core/scheduled_task.go
@@ -355,6 +355,22 @@ func creatorModelReady(t *transaction, creatorID, pluginID string) bool {
 		  AND c.enabled AND c.deleted_at IS NULL AND c.credential_id IS NOT NULL`, creatorID) != nil
 }
 
+// scheduledTaskModelReady validates an optional task-level model override against the creator's
+// current default connection. A task definition stores only a model ID; the connection and its
+// credential are resolved and frozen when the occurrence is admitted, so this check must use the
+// same policy as bindRunModel rather than treating an arbitrary ID as runnable.
+func scheduledTaskModelReady(t *transaction, creatorID, modelID string) bool {
+	if modelID == "" {
+		return true
+	}
+	selection := modelDefault(t, creatorID)
+	if selection.S("connectionId") == "" {
+		return false
+	}
+	reason, _, _ := personalExecutorGap(t, creatorID, selection.S("connectionId"), modelID)
+	return reason == ""
+}
+
 // scheduledFailureReason maps an eligibility failure kind to the root decision D7 reason set.
 func failScheduledOccurrenceWithReason(t *transaction, taskID string, due time.Time, kind string) {
 	failScheduledOccurrence(t, taskID, due, scheduledFailureReason(kind))
diff --git a/internal/core/scheduled_task_api.go b/internal/core/scheduled_task_api.go
index 7a8fc00c..0aee99dc 100644
--- a/internal/core/scheduled_task_api.go
+++ b/internal/core/scheduled_task_api.go
@@ -23,11 +23,13 @@ func managedScheduledTask(t *transaction, r *PublicRequest, uid string) Object {
 }
 
 // readableScheduledTask loads the task for a READ operation: every effective tenant member who can
-// read the bound issue may read the task and its history (D1 visibility follows the issue).
+// read the bound issue may read the task and its history (D1 visibility follows the issue). A task
+// whose bound issue has been deleted is not readable.
 func readableScheduledTask(t *transaction, r *PublicRequest) Object {
 	require(validID(r.ScheduledTaskID), 404, "not_found")
 	task := t.one("SELECT * FROM scheduled_tasks WHERE id=$1 AND tenant_id=$2 AND deleted_at IS NULL", r.ScheduledTaskID, r.TenantID)
 	require(task != nil, 404, "not_found")
+	require(scheduledTaskIssue(t, r.TenantID, task.S("issueId")) != nil, 404, "not_found")
 	return task
 }
 
@@ -45,9 +47,11 @@ func scheduledTaskOut(task Object) Object {
 	return Object{
 		"id":                    task.S("id"),
 		"issueId":               task.S("issueId"),
+		"creatorUserId":         task.S("creatorUserId"),
 		"name":                  task.S("name"),
 		"prompt":                task.S("prompt"),
 		"agentId":               task.S("agentId"),
+		"model":                 nilIfEmpty(task.S("model")),
 		"schedule":              task["schedule"],
 		"timezone":              task.S("timezone"),
 		"revision":              task["revision"],
@@ -70,14 +74,21 @@ func scheduledTaskCreate(t *transaction, r *PublicRequest, uid string) Object {
 	agentID := r.Body.S("agentId")
 	name := r.Body.S("name")
 	prompt := r.Body.S("prompt")
+	model := r.Body.S("model")
 	timezone := r.Body.S("timezone")
 	enabled := r.Body.B("enabled")
 	require(validID(issueID) && validID(agentID) && name != "" && prompt != "" && timezone != "", 400, "invalid_request")
 
-	approval := r.Body.O("approval")
-	require(approval.S("policy") == unattendedPolicyCloud, 400, "invalid_request")
-	// The consent instant is the server's, not the client's claim.
-	consentedAt := dbNow(t)
+	// A disabled definition is only a draft: it must not manufacture unattended consent from
+	// an invisible client value. Consent is frozen only for an explicitly enabled creation.
+	var policy, consentedAt any
+	if enabled {
+		approval := r.Body.O("approval")
+		require(approval.S("policy") == unattendedPolicyCloud, 400, "invalid_request")
+		policy = unattendedPolicyCloud
+		// The consent instant is the server's, not the client's claim.
+		consentedAt = dbNow(t)
+	}
 
 	schedule, err := parseScheduledTaskSchedule(r.Body["schedule"])
 	require(err == nil, 400, "invalid_request")
@@ -92,6 +103,7 @@ func scheduledTaskCreate(t *transaction, r *PublicRequest, uid string) Object {
 	require(ready, 409, "target_unavailable")
 	agentRunGate(t, issue, agent)
 	require(creatorModelReady(t, uid, agent.S("pluginId")), 409, "model_unavailable")
+	require(scheduledTaskModelReady(t, uid, model), 409, "model_unavailable")
 
 	// The unattended-consent risk statement (D5) is the creation form's own copy; the server
 	// freezes the policy name and the server's consent instant.
@@ -107,12 +119,12 @@ func scheduledTaskCreate(t *transaction, r *PublicRequest, uid string) Object {
 		enabledAt = consentedAt
 	}
 	t.exec(`INSERT INTO scheduled_tasks
-		(id, tenant_id, issue_id, creator_user_id, agent_id, name, prompt, schedule, timezone,
+		(id, tenant_id, issue_id, creator_user_id, agent_id, name, prompt, model, schedule, timezone,
 		 revision, version, enabled, enabled_at, disabled_reason,
 		 unattended_policy, unattended_consented_at)
-		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,1,1,$10,$11,NULL,$12,$13)`,
-		id, r.TenantID, issueID, uid, agentID, name, prompt, jsonText(scheduleDoc), timezone,
-		enabled, enabledAt, unattendedPolicyCloud, consentedAt)
+		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,1,1,$11,$12,NULL,$13,$14)`,
+		id, r.TenantID, issueID, uid, agentID, name, prompt, nilIfEmpty(model), jsonText(scheduleDoc), timezone,
+		enabled, enabledAt, policy, consentedAt)
 	task := t.one("SELECT * FROM scheduled_tasks WHERE id=$1", id)
 	return scheduledTaskOut(task)
 }
@@ -137,6 +149,10 @@ func scheduledTaskUpdate(t *transaction, r *PublicRequest, uid string) Object {
 		prompt = body.S("prompt")
 		require(prompt != "", 400, "invalid_request")
 	}
+	model := task.S("model")
+	if body["model"] != nil {
+		model = body.S("model")
+	}
 	agentID := task.S("agentId")
 	if body["agentId"] != nil {
 		agentID = body.S("agentId")
@@ -157,7 +173,8 @@ func scheduledTaskUpdate(t *transaction, r *PublicRequest, uid string) Object {
 		scheduleDoc = doc
 	}
 	revision := task.N("revision")
-	contentChanged := prompt != task.S("prompt") || agentID != task.S("agentId") ||
+	contentChanged := prompt != task.S("prompt") || model != task.S("model") ||
+		agentID != task.S("agentId") ||
 		timezone != task.S("timezone") || scheduleDocJSONChanged(scheduleDoc, task["schedule"])
 	if contentChanged {
 		revision = task.N("revision") + 1
@@ -173,12 +190,13 @@ func scheduledTaskUpdate(t *transaction, r *PublicRequest, uid string) Object {
 		agentRunGate(t, issue, agent)
 	}
 	require(creatorModelReady(t, uid, agent.S("pluginId")), 409, "model_unavailable")
+	require(scheduledTaskModelReady(t, uid, model), 409, "model_unavailable")
 
 	updated := t.execRows(`UPDATE scheduled_tasks
-		SET name=$1, prompt=$2, agent_id=$3, schedule=$4, timezone=$5,
-		    revision=$6, version=version+1, updated_at=now()
-		WHERE id=$7 AND tenant_id=$8 AND creator_user_id=$9 AND deleted_at IS NULL
-		  AND version=$10`, name, prompt, agentID, jsonText(scheduleDoc), timezone,
+		SET name=$1, prompt=$2, model=$3, agent_id=$4, schedule=$5, timezone=$6,
+		    revision=$7, version=version+1, updated_at=now()
+		WHERE id=$8 AND tenant_id=$9 AND creator_user_id=$10 AND deleted_at IS NULL
+		  AND version=$11`, name, prompt, nilIfEmpty(model), agentID, jsonText(scheduleDoc), timezone,
 		revision, task.S("id"), r.TenantID, uid, body.N("version"))
 	require(updated == 1, 409, "version_conflict")
 	return scheduledTaskOut(t.one("SELECT * FROM scheduled_tasks WHERE id=$1", task.S("id")))
@@ -217,10 +235,20 @@ func jsonChanged(left, right Object) bool {
 
 // scheduledTaskEnable turns the task on (POST .../enable). The ADR's enable-time checks run here —
 // the same table an admission would run, minus the parts that need a due point — and a failure
-// answers with its mapped reason so the form can explain what is missing (D5).
+// answers with its mapped reason so the form can explain what is missing (D5). After a consent
+// revocation the consent fact is cleared, so enabling again must carry a fresh explicit consent.
 func scheduledTaskEnable(t *transaction, r *PublicRequest, uid string) Object {
 	task := managedScheduledTask(t, r, uid)
-	require(task.S("unattendedPolicy") == unattendedPolicyCloud, 409, "approval_policy_invalid")
+	policy := task.S("unattendedPolicy")
+	consentedAt := task["unattendedConsentedAt"]
+	if policy == "" {
+		// D5: 撤销同意后重新同意——consent 已清空，启用必须携带新的显式同意。
+		approval := r.Body.O("approval")
+		require(approval.S("policy") == unattendedPolicyCloud, 409, "approval_policy_invalid")
+		policy = unattendedPolicyCloud
+		consentedAt = dbNow(t)
+	}
+	require(policy == unattendedPolicyCloud, 409, "approval_policy_invalid")
 	creator := task.S("creatorUserId")
 	require(creatorMembershipActive(t, task.S("id"), r.TenantID, creator), 409, "target_unavailable")
 	issue := scheduledTaskIssue(t, r.TenantID, task.S("issueId"))
@@ -229,10 +257,12 @@ func scheduledTaskEnable(t *transaction, r *PublicRequest, uid string) Object {
 	require(ready, 409, "target_unavailable")
 	agentRunGate(t, issue, agent)
 	require(creatorModelReady(t, creator, agent.S("pluginId")), 409, "model_unavailable")
+	require(scheduledTaskModelReady(t, creator, task.S("model")), 409, "model_unavailable")
 
 	t.exec(`UPDATE scheduled_tasks
-		SET enabled=true, enabled_at=now(), disabled_reason=NULL, updated_at=now()
-		WHERE id=$1 AND enabled=false`, task.S("id"))
+		SET enabled=true, enabled_at=now(), disabled_reason=NULL,
+		    unattended_policy=$2, unattended_consented_at=$3, updated_at=now()
+		WHERE id=$1 AND enabled=false`, task.S("id"), policy, consentedAt)
 	return scheduledTaskOut(t.one("SELECT * FROM scheduled_tasks WHERE id=$1", task.S("id")))
 }
 
@@ -318,7 +348,17 @@ func scheduledTaskHistory(t *transaction, r *PublicRequest) Object {
 				item["failureReason"] = "timeout"
 				break
 			}
-			item["outcome"] = status
+			// D6: project the run's own terminal state into the history vocabulary —
+			// completed→succeeded, failed/cancelled stay as they are, any non-terminal
+			// (queued/dispatched/running/deferred) shows as running.
+			switch status {
+			case "completed":
+				item["outcome"] = "succeeded"
+			case "failed", "cancelled":
+				item["outcome"] = status
+			default:
+				item["outcome"] = "running"
+			}
 			if entry["runFailureReason"] != nil {
 				item["failureReason"] = entry["runFailureReason"]
 			}
diff --git a/internal/core/scheduled_task_model_protocol_test.go b/internal/core/scheduled_task_model_protocol_test.go
new file mode 100644
index 00000000..59cac5d1
--- /dev/null
+++ b/internal/core/scheduled_task_model_protocol_test.go
@@ -0,0 +1,54 @@
+package core
+
+import (
+	"context"
+	"crypto/rand"
+	"testing"
+
+	"github.com/google/uuid"
+)
+
+// TestScheduledTaskModelOverrideProtocolCompatibility pins the override gate the review asked for:
+// a scheduled definition's selected model must be judged by the same declaration and runtime protocol
+// checks as the declared Agent configuration, so a Claude agent backed by Anthropic cannot admit an
+// OpenAI default-connection model into its binding.
+func TestScheduledTaskModelOverrideProtocolCompatibility(t *testing.T) {
+	scene := newPersonalAgentScene(t)
+	scene.store.PersonalAgentRuntime = &PersonalAgentRuntime{Target: "x86_64-unknown-linux-gnu", ContractVersion: 1, Protocols: []string{"anthropic-messages"}}
+	if _, err := scene.request("PUT", "", newID(), scene.body(0)); err != nil {
+		t.Fatal(err)
+	}
+
+	// Compatible: the selected model resolves on the Anthropic default and clears the Claude gate.
+	_, err := scene.store.transact(context.Background(), func(tx *transaction) Object {
+		_, connection, model := resolveDeclaredAgentRun(tx, scene.uid, scene.space, claudeAgentCLI, "1.0.0", "vendor/model-v1")
+		if connection.S("protocol") != "anthropic-messages" || model.S("id") != "vendor/model-v1" {
+			t.Fatalf("compatible override resolved to protocol=%q model=%q", connection.S("protocol"), model.S("id"))
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Incompatible: switch the personal default to an OpenAI connection. The same selected model now
+	// resolves onto a connection Claude cannot execute, and must be refused by the protocol gate.
+	openaiConn := modelRequest(t, scene.store, scene.claims, "POST", "/api/v1/me/model-connections", "", uuid.NewString(), modelBody("openai-completions")).O("resource")
+	credentialID := uuid.NewString()
+	ciphertext := make([]byte, 64)
+	if _, err := rand.Read(ciphertext); err != nil {
+		t.Fatal(err)
+	}
+	updated, err := scene.store.PutModelCredential(context.Background(), scene.claims, openaiConn.S("id"), openaiConn.N("version"), "", credentialID, ciphertext, "test-key")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := scene.store.Pool.Exec(`UPDATE personal_model_defaults SET connection_id=$1, model_id=$2, version=version+1 WHERE user_id=$3`, updated.S("id"), "vendor/model-v1", scene.uid); err != nil {
+		t.Fatal(err)
+	}
+	_, err = scene.store.transact(context.Background(), func(tx *transaction) Object {
+		_, _, _ = resolveDeclaredAgentRun(tx, scene.uid, scene.space, claudeAgentCLI, "1.0.0", "vendor/model-v1")
+		return nil
+	})
+	expectModelFault(t, err, "agent_model_protocol_mismatch")
+}
diff --git a/internal/core/scheduled_task_worker.go b/internal/core/scheduled_task_worker.go
index 90884266..6423b997 100644
--- a/internal/core/scheduled_task_worker.go
+++ b/internal/core/scheduled_task_worker.go
@@ -184,10 +184,14 @@ func admitScheduledTaskDue(t *transaction, taskID string) {
 		failScheduledOccurrenceWithReason(t, taskID, due, "model_unavailable")
 		return
 	}
+	if !scheduledTaskModelReady(t, task.S("creatorUserId"), task.S("model")) {
+		failScheduledOccurrenceWithReason(t, taskID, due, "model_unavailable")
+		return
+	}
 	// bindRunModel rejects after enqueueing for an invalid default or declared configuration. Probe
 	// the same read-only policy first so that rejection becomes this occurrence's durable D5 result
 	// instead of rolling back the ledger row and later being mistaken for a missed schedule point.
-	if personal, gap := taskAgentModelGap(t, task.S("creatorUserId"), agent); personal && gap != "" {
+	if personal, gap := taskAgentModelGap(t, task.S("creatorUserId"), agent, task.S("model")); personal && gap != "" {
 		failScheduledOccurrenceWithReason(t, taskID, due, scheduledAgentBindingReason(gap))
 		return
 	}
@@ -203,6 +207,9 @@ func admitScheduledTaskDue(t *transaction, taskID string) {
 	// （内部完成 bindRunModel 的模型冻结与 409 pending_run_exists 兜底）。触发证据指向本任务。
 	runContext := buildRunContext(t, issue, task.S("prompt"), "agent", task.S("agentId"), nil, nil)
 	input := snapshotAgentRunInput(runContext, agent)
+	// This is an internal handoff, not caller-controlled execution input. enqueueRunWithInvocation
+	// removes it before persistence and bindRunModel freezes the resolved model binding instead.
+	input["scheduledTaskModel"] = task.S("model")
 	run := enqueueAdmittedRun(t, task.S("tenantId"), task.S("issueId"), "agent", task.S("agentId"),
 		input, "scheduled_task", taskID, "user", task.S("creatorUserId"))
 
diff --git a/internal/core/task_conversation_messages.go b/internal/core/task_conversation_messages.go
index 35499339..4c095f85 100644
--- a/internal/core/task_conversation_messages.go
+++ b/internal/core/task_conversation_messages.go
@@ -110,7 +110,7 @@ func taskConversationSend(t *transaction, s *Store, r *PublicRequest, uid string
 		}
 	}
 	if state == "waiting" {
-		_, gap := taskAgentModelGap(t, uid, agent)
+		_, gap := taskAgentModelGap(t, uid, agent, "")
 		require(gap == "", 409, gap)
 	}
 	t.exec(`INSERT INTO task_conversation_messages(id,tenant_id,issue_id,seq,user_id,agent_id,body,state,run_id,thread_seq) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)`, id, r.TenantID, i.S("id"), seq, uid, agentID, body, state, runID, threadSeq)
diff --git a/internal/core/task_conversation_queue.go b/internal/core/task_conversation_queue.go
index 7981fd33..0c373619 100644
--- a/internal/core/task_conversation_queue.go
+++ b/internal/core/task_conversation_queue.go
@@ -111,7 +111,7 @@ func (s *Store) dispatchTaskMessage(ctx context.Context, messageID string) (stri
 			taskMessageFail(t, message, "project_unavailable")
 			return Object{}
 		}
-		if _, code := taskAgentModelGap(t, message.S("userId"), agent); code != "" {
+		if _, code := taskAgentModelGap(t, message.S("userId"), agent, ""); code != "" {
 			taskMessageFail(t, message, code)
 			return Object{}
 		}
diff --git a/internal/core/task_conversation_readiness.go b/internal/core/task_conversation_readiness.go
index 96d37ae3..1a1dce10 100644
--- a/internal/core/task_conversation_readiness.go
+++ b/internal/core/task_conversation_readiness.go
@@ -21,7 +21,7 @@ func taskAgentReadiness(t *transaction, task Object, uid string) []Object {
 	project := t.one("SELECT space_id FROM projects WHERE id=$1 AND tenant_id=$2 AND deleted_at IS NULL", nullable(task.S("projectRef")), task.S("tenantId"))
 	readiness := make([]Object, 0, len(agents))
 	for _, agent := range agents {
-		personal, gap := taskAgentModelGap(t, uid, agent)
+		personal, gap := taskAgentModelGap(t, uid, agent, "")
 		if project == nil || project.S("spaceId") != agent.S("spaceId") {
 			gap = "issue_project_required"
 		}
@@ -31,8 +31,10 @@ func taskAgentReadiness(t *transaction, task Object, uid string) []Object {
 }
 
 // taskAgentModelGap translates only expected admission faults into a safe read projection.
-// Database failures still abort the transaction; the resolver performs no writes.
-func taskAgentModelGap(t *transaction, uid string, agent Object) (personal bool, gap string) {
+// Database failures still abort the transaction; the resolver performs no writes. selectedModel is a
+// scheduled definition's optional override: it is resolved and protocol-checked by the same
+// authoritative resolver, so an incompatible override reports its fault instead of being admitted.
+func taskAgentModelGap(t *transaction, uid string, agent Object, selectedModel string) (personal bool, gap string) {
 	pluginID := agent.S("pluginId")
 	personal = pluginID == opencodeAgentCLI || pluginID == claudeAgentCLI
 	defer func() {
@@ -49,7 +51,7 @@ func taskAgentModelGap(t *transaction, uid string, agent Object) (personal bool,
 		return personal, "invalid_plugin_id"
 	}
 	selection := t.spacePluginRow(agent.S("spaceId"), namespace, identifier)
-	frozen, _, _ := resolveDeclaredAgentRun(t, uid, agent.S("spaceId"), pluginID, selection.S("desiredVersion"))
+	frozen, _, _ := resolveDeclaredAgentRun(t, uid, agent.S("spaceId"), pluginID, selection.S("desiredVersion"), selectedModel)
 	if frozen != nil {
 		return true, ""
 	}