After discussing with @quartzjer, it's clear that task.nextRun is safe in sandboxed setup (you can see it also updated start times and such). Wrt. to -1 case, we really want things to push things to T+5 or so.