@aitne/daemon 0.1.0

package/dist/core/scheduler.js

@@ -0,0 +1,896 @@
+import cron from "node-cron";
+import { randomUUID } from "node:crypto";
+import { createEvent, EventPriority, formatSqliteDatetime, getAgentDayBoundsUtc, nowInTimezone, } from "@aitne/shared";
+import { runRetentionCleanup } from "./retention.js";
+import { cleanupSessionWorkdir, cleanupStaleWorkdirs, getSessionWorkdirPath } from "./workdir.js";
+import { discardStalePendingSchedules } from "./schedule-maintenance.js";
+import { createLogger } from "../logging.js";
+import { reconcileRecurringSchedules } from "../db/recurring-schedules.js";
+const logger = createLogger("scheduler");
+/**
+ * True iff `intervalMinutes` cleanly fits inside an hour, so the firing
+ * minutes are predictable across every hour of the active window. We use
+ * this to decide whether to emit a tight minute-list cron expression vs.
+ * a minute-tick cron + in-callback gate.
+ */
+function isDivisorOfHour(intervalMinutes) {
+    return intervalMinutes >= 1 && intervalMinutes <= 60 && 60 % intervalMinutes === 0;
+}
+/**
+ * Build the cron expression that drives the hourly check.
+ *
+ * Two regimes:
+ *
+ * 1. **Divisor of 60** (`isDivisorOfHour(intervalMinutes)`, e.g. 1, 5, 15,
+ *    20, 30, 60): the firing minutes are predictable within every hour, so
+ *    we emit an exact minute list (`"0,15,30,45 4-23 * * *"`). The cron
+ *    only wakes on the actual firing minutes — no in-callback gating
+ *    needed.
+ *
+ * 2. **Arbitrary interval** (anything else, e.g. 7, 45, 90, 120, 720,
+ *    1440): we emit `"* <hourRange> * * *"` (every minute within active
+ *    hours). The caller is expected to gate each tick with
+ *    `shouldFireHourlyTickAt(...)`, which anchors the cadence to
+ *    `activeStartHour` via `((h*60 + m) - activeStartHour*60) %
+ *    intervalMinutes`. This anchor matters: a midnight-anchored modulo
+ *    plus `activeStartHour > 0` would silently drop intervals where the
+ *    only mod-zero point falls outside active hours (e.g. interval=1440
+ *    with startHour=4 — mod-zero only at 00:00, never inside the window).
+ *    Anchoring at `activeStartHour` guarantees the first fire of each
+ *    agent-day lands at the start of the window, then every N minutes
+ *    until the window closes.
+ *
+ * The minute-tick cron does fire 60× per hour even when most ticks are
+ * no-ops, but the callback's first action is the modulo check — overhead
+ * is negligible compared to the actual hourly-check work.
+ */
+export function buildHourlyCronExpr(intervalMinutes, startHour, endHourExclusive) {
+    const endHour = Math.max(startHour, endHourExclusive - 1);
+    const hourRange = startHour === endHour ? `${startHour}` : `${startHour}-${endHour}`;
+    if (isDivisorOfHour(intervalMinutes)) {
+        const minuteList = [];
+        for (let minute = 0; minute < 60; minute += intervalMinutes) {
+            minuteList.push(minute);
+        }
+        return `${minuteList.join(",")} ${hourRange} * * *`;
+    }
+    return `* ${hourRange} * * *`;
+}
+/**
+ * Returns true when a minute-tick of the hourly cron should actually fire.
+ *
+ * Only meaningful for arbitrary (non-divisor-of-60) intervals — divisor
+ * cases get exact firing minutes baked into the cron expression and don't
+ * need this gate (handled by the early-return).
+ *
+ * The cadence is anchored at `activeStartHour` so the first slot of each
+ * agent-day lies at the start of the active window. This is what allows
+ * intervals up to 1440 (24h) to work correctly: a midnight anchor would
+ * make `interval=1440` fire only at 00:00, which is excluded by typical
+ * active-hour configs (4–24) and the day-boundary skip.
+ *
+ * Note: divisor-of-60 intervals always also divide `activeStartHour*60`
+ * (since `activeStartHour` is an integer and `intervalMinutes` divides 60),
+ * so the divisor early-return doesn't change behavior — it's just
+ * explicit about which path the cron expression itself handles.
+ */
+export function shouldFireHourlyTickAt(localHour, localMinute, intervalMinutes, activeStartHour) {
+    if (isDivisorOfHour(intervalMinutes))
+        return true;
+    const minutesSinceMidnight = localHour * 60 + localMinute;
+    const anchor = activeStartHour * 60;
+    // localHour < activeStartHour can't happen in normal operation (cron's
+    // hour range excludes those hours) but be defensive: a negative offset
+    // mod a positive interval is implementation-defined in JS (returns a
+    // negative or zero), which would falsely fire. Add a full day to keep
+    // the offset non-negative regardless.
+    const offset = (minutesSinceMidnight - anchor + 24 * 60) % (24 * 60);
+    return offset % intervalMinutes === 0;
+}
+/**
+ * Cron expression for the morning user-profile sweep: 10 min before the
+ * day boundary, wrapping backward across midnight. For the default
+ * `dayBoundaryHour = 4`, returns `"50 3 * * *"`. Extracted as a pure
+ * helper so the arithmetic can be asserted without having to mock
+ * node-cron.
+ */
+export function buildUserProfileSweepMorningCronExpr(dayBoundaryHour) {
+    const hour = (dayBoundaryHour - 1 + 24) % 24;
+    return `50 ${hour} * * *`;
+}
+/**
+ * Cron expression for the evening user-profile sweep: fixed at 17:50
+ * local, which is 10 min before Evening Review's fixed 18:00. If
+ * Evening Review ever becomes time-configurable, this expression must
+ * track the same config knob in lockstep.
+ */
+export const USER_PROFILE_SWEEP_EVENING_CRON_EXPR = "50 17 * * *";
+/**
+ * AgentScheduler — manages recurring cron jobs and the DB-driven ScheduleWatcher.
+ *
+ * Cron jobs:
+ * - 04:00 daily: Morning Routine + daily cleanup + retention
+ * - 18:00 daily: Evening Review
+ * - 18:00 Friday: Weekly Review
+ * - 18:00 last day of month: Monthly Review
+ *
+ * ScheduleWatcher:
+ * - Polls agent_schedule table every N seconds for pending tasks
+ * - Handles agent-scheduled wake-ups and DMs
+ * - Uses optimistic locking to prevent duplicate execution
+ */
+export class AgentScheduler {
+    eventBus;
+    db;
+    config;
+    shutdown = false;
+    cronJobs = [];
+    noFutureTasksWarned = false;
+    onDayBoundary = null;
+    sendDm = null;
+    onHourlyCheck = null;
+    /**
+     * Phase 4 auth probe hook — fired on every hourly cron tick BEFORE
+     * `onHourlyCheck` so the probe gets a chance to refresh DB cache +
+     * emit DMs even when the observation-threshold gate would skip the
+     * hourly check itself. The AuthHealthMonitor.checkAll() method owns
+     * its own kill-switch and morning-routine skip; the scheduler only
+     * applies the same `autonomousGate` short-circuit that protects the
+     * other cron callbacks.
+     *
+     * See `docs/design/09-safety-cost.md` §9.5.4 for the gate
+     * ordering: morning-routine → hourly-already-running → auth probe
+     * → observation-threshold. Steps 1 + 2 are handled inside
+     * `triggerHourlyCheck`; step 3 is this callback; step 4 is the
+     * threshold gate inside `triggerHourlyCheck`.
+     */
+    onAuthProbe = null;
+    /**
+     * B-004 Phase 2a — nightly context-index reconciler callback (§4.1).
+     * Fires at 03:45 local (dayBoundaryHour - 15 min) via an internal cron
+     * job, BEFORE the morning routine so the index is fresh when the
+     * morning flow reads it. The observer owns the run-once guard.
+     */
+    onContextIndexReconcile = null;
+    /**
+     * Setup gate — returns a skip reason when autonomous work should be
+     * paused (initial setup incomplete, or setup conversation active).
+     * Returns null when autonomous work may proceed. Wired from EventDispatcher
+     * via setAutonomousGate() so the scheduler doesn't take a hard dependency
+     * on the dispatcher.
+     */
+    autonomousGate = () => null;
+    lastGateBlockLoggedAt = 0;
+    /**
+     * Aborted by stop() to interrupt the ScheduleWatcher's between-poll sleep
+     * immediately. Without this, SIGTERM has to wait up to
+     * `schedulePollIntervalSeconds` before the loop notices `this.shutdown`.
+     */
+    pollAbort = null;
+    constructor(eventBus, db, config) {
+        this.eventBus = eventBus;
+        this.db = db;
+        this.config = config;
+    }
+    /**
+     * Register a callback that runs at the day boundary (4 AM) BEFORE
+     * the morning routine and daily cleanup. Used for DM session summarization.
+     */
+    setDayBoundaryCallback(fn) {
+        this.onDayBoundary = fn;
+    }
+    /**
+     * Register a callback for sending direct DMs (scheduled via POST /api/schedule/dm).
+     * When a task_type='dm' row is due, the message is sent directly without an agent.
+     */
+    setSendDmCallback(fn) {
+        this.sendDm = fn;
+    }
+    setHourlyCheckCallback(fn) {
+        this.onHourlyCheck = fn;
+    }
+    /**
+     * Register the Phase 4 auth probe callback. Called on each hourly
+     * cron tick BEFORE the hourly-check observation threshold gate so
+     * the probe continues to run even when the hourly check itself
+     * would be skipped for lack of pending observations.
+     */
+    setAuthProbeCallback(fn) {
+        this.onAuthProbe = fn;
+    }
+    /**
+     * Register the context-index reconciler cron callback. Called every
+     * night at 03:45 local; the callback is expected to be fire-and-forget
+     * and enqueue a reconcile via the observer's run-once guard.
+     */
+    setContextIndexReconcilerCallback(fn) {
+        this.onContextIndexReconcile = fn;
+    }
+    /**
+     * Register the autonomous-work gate. Returning null allows autonomous work;
+     * any non-null string is treated as a skip reason and surfaced in logs.
+     */
+    setAutonomousGate(fn) {
+        this.autonomousGate = fn;
+    }
+    /** Log gate blocks at most once every 5 minutes to avoid spam. */
+    logGateBlock(reason, context) {
+        const now = Date.now();
+        if (now - this.lastGateBlockLoggedAt < 5 * 60 * 1000)
+            return;
+        this.lastGateBlockLoggedAt = now;
+        logger.info({ ...context, reason }, "Autonomous work paused (setup gate)");
+    }
+    start() {
+        this.setupRecurringJobs();
+        this.startScheduleWatcher();
+        logger.info("Scheduler started");
+    }
+    stop() {
+        this.shutdown = true;
+        // Wake up the ScheduleWatcher's poll sleep so the loop returns immediately
+        // instead of waiting for the next interval tick.
+        this.pollAbort?.abort();
+        this.stopCronJobs();
+        logger.info("Scheduler stopped");
+    }
+    /** Hot-reload cron schedules (e.g. after dayBoundaryHour changes) */
+    reloadCrons() {
+        this.stopCronJobs();
+        this.setupRecurringJobs();
+        logger.info("Cron jobs reloaded");
+    }
+    stopCronJobs() {
+        for (const job of this.cronJobs) {
+            job.stop();
+        }
+        this.cronJobs.length = 0;
+    }
+    setupRecurringJobs() {
+        const tz = this.config.timezone || undefined;
+        // Morning Routine: daily at dayBoundaryHour (default 04:00)
+        // Order: day boundary callback (DM summarize) → morning routine → cleanup
+        const morningJob = cron.schedule(`0 ${this.config.dayBoundaryHour} * * *`, () => {
+            const gateReason = this.autonomousGate();
+            if (gateReason !== null) {
+                this.logGateBlock(gateReason, { cron: "morning_routine" });
+                return;
+            }
+            void (async () => {
+                try {
+                    if (this.onDayBoundary) {
+                        await this.onDayBoundary();
+                    }
+                }
+                catch (err) {
+                    logger.error({ err }, "Day boundary callback failed");
+                }
+                this.dailyCleanup();
+                this.queueMorningRoutineWake("cron");
+            })();
+        }, { timezone: tz });
+        this.cronJobs.push(morningJob);
+        // Evening Review: daily at 18:00
+        const eveningJob = cron.schedule("0 18 * * *", () => {
+            const gateReason = this.autonomousGate();
+            if (gateReason !== null) {
+                this.logGateBlock(gateReason, { cron: "evening_review" });
+                return;
+            }
+            this.emitRoutine("evening_review");
+        }, { timezone: tz });
+        this.cronJobs.push(eveningJob);
+        // User-profile sweep (morning phase): 10 min before the day boundary.
+        // For dayBoundaryHour = 4 this is "50 3 * * *". Fires before the
+        // morning routine so the morning routine reads a freshly up-to-date
+        // user/profile.md when it loads <user>. See USER-PROFILE-CAPTURE-PLAN.md
+        // §Phase 2.
+        const sweepMorningJob = cron.schedule(buildUserProfileSweepMorningCronExpr(this.config.dayBoundaryHour), () => {
+            const gateReason = this.autonomousGate();
+            if (gateReason !== null) {
+                this.logGateBlock(gateReason, { cron: "user_profile_sweep_morning" });
+                return;
+            }
+            this.emitRoutine("user_profile_sweep", { phase: "morning" });
+        }, { timezone: tz });
+        this.cronJobs.push(sweepMorningJob);
+        // User-profile sweep (evening phase): 10 min before Evening Review.
+        // Evening Review's cron is fixed at 18:00, so this is always "50 17
+        // * * *". If Evening Review ever becomes time-configurable, this
+        // cron must track the same config knob in lockstep.
+        const sweepEveningJob = cron.schedule(USER_PROFILE_SWEEP_EVENING_CRON_EXPR, () => {
+            const gateReason = this.autonomousGate();
+            if (gateReason !== null) {
+                this.logGateBlock(gateReason, { cron: "user_profile_sweep_evening" });
+                return;
+            }
+            this.emitRoutine("user_profile_sweep", { phase: "evening" });
+        }, { timezone: tz });
+        this.cronJobs.push(sweepEveningJob);
+        // Weekly Review: Friday at 18:00
+        // Emits a separate routine event so the prompt can generate weekly/YYYY-Www.md
+        const weeklyJob = cron.schedule("0 18 * * 5", () => {
+            const gateReason = this.autonomousGate();
+            if (gateReason !== null) {
+                this.logGateBlock(gateReason, { cron: "weekly_review" });
+                return;
+            }
+            this.emitRoutine("weekly_review");
+        }, { timezone: tz });
+        this.cronJobs.push(weeklyJob);
+        // Monthly Review: last day of month at 18:00
+        // node-cron doesn't directly support "last day of month",
+        // so we run daily at 18:00 and check if tomorrow is the 1st
+        const monthlyJob = cron.schedule("0 18 * * *", () => {
+            // Check if tomorrow (in configured timezone) is the 1st
+            const tomorrow = new Date();
+            tomorrow.setDate(tomorrow.getDate() + 1);
+            const tomorrowLocal = nowInTimezone(tz, tomorrow);
+            if (tomorrowLocal.day === 1) {
+                const gateReason = this.autonomousGate();
+                if (gateReason !== null) {
+                    this.logGateBlock(gateReason, { cron: "monthly_review" });
+                    return;
+                }
+                this.emitRoutine("monthly_review");
+            }
+        }, { timezone: tz });
+        this.cronJobs.push(monthlyJob);
+        // Context-index reconciler (B-004 Phase 2a). Run 15 minutes before
+        // the day boundary so the index is fresh when the morning routine
+        // reads it. The callback's morning-routine lock gate defers the run
+        // if this cron happens to fire while a retrying morning routine still
+        // holds the lock.
+        const reconcilerHour = (this.config.dayBoundaryHour + 23) % 24;
+        const reconcilerCron = `45 ${reconcilerHour} * * *`;
+        const reconcilerJob = cron.schedule(reconcilerCron, () => {
+            const gateReason = this.autonomousGate();
+            if (gateReason !== null) {
+                this.logGateBlock(gateReason, { cron: "context_index_reconcile" });
+                return;
+            }
+            try {
+                this.onContextIndexReconcile?.();
+            }
+            catch (err) {
+                logger.warn({ err }, "Context-index reconcile callback threw");
+            }
+        }, { timezone: tz });
+        this.cronJobs.push(reconcilerJob);
+        if (this.config.hourlyCheckEnabled) {
+            const hourlyExpr = buildHourlyCronExpr(this.config.hourlyCheckIntervalMinutes, this.config.hourlyCheckActiveStartHour, this.config.hourlyCheckActiveEndHour);
+            const hourlyJob = cron.schedule(hourlyExpr, () => {
+                const now = new Date();
+                // Pull both hour and minute from the canonical timezone helper
+                // so the day-boundary skip and the interval gate observe the
+                // same local time. (The earlier inline `Intl.DateTimeFormat`
+                // calls were equivalent for 60-min intervals but obscured the
+                // fact that minute-extraction needs to round-trip through the
+                // same timezone.)
+                const local = nowInTimezone(tz, now);
+                if (local.hours === this.config.dayBoundaryHour) {
+                    return;
+                }
+                // Arbitrary intervals run on a `* <hours> * * *` cron and must
+                // be gated here. Anchor at `activeStartHour` so the first slot
+                // of each agent-day lands at the start of the active window —
+                // critical for intervals near or equal to the window length.
+                // Divisor-of-60 cases short-circuit inside the helper.
+                if (!shouldFireHourlyTickAt(local.hours, local.minutes, this.config.hourlyCheckIntervalMinutes, this.config.hourlyCheckActiveStartHour)) {
+                    return;
+                }
+                // triggerHourlyCheck has its own setup gate, but short-circuit
+                // here to avoid the in-progress flag toggling for no reason.
+                const gateReason = this.autonomousGate();
+                if (gateReason !== null) {
+                    this.logGateBlock(gateReason, { cron: "hourly_check" });
+                    return;
+                }
+                // Phase 4 auth probe runs BEFORE the hourly check so that the
+                // observation-threshold gate (which can skip `onHourlyCheck`
+                // entirely when there's no pending user activity) does not
+                // also stall auth health detection. The probe owns its own
+                // morning-routine / probe-disabled gating; we only respect
+                // the autonomous setup gate here.
+                if (this.onAuthProbe) {
+                    void this.onAuthProbe().catch((err) => {
+                        logger.warn({ err }, "Auth probe callback failed");
+                    });
+                }
+                if (this.onHourlyCheck) {
+                    void this.onHourlyCheck("cron");
+                }
+            }, { timezone: tz });
+            this.cronJobs.push(hourlyJob);
+        }
+        // P22 §6.3, §6.4 — skill curation. Registered only when the operator
+        // has opted in via /settings/self-learning (`enabled=true`). Always
+        // fires daily at 03:00; the gate inside the handler checks whether
+        // the cadence interval (daily=24 h, weekly=7 d, monthly=30 d) has
+        // elapsed since the last run's `started_at`. This makes manual runs
+        // (P22 §6.4) push the next auto-run forward by exactly one cadence
+        // interval — clicking "Run now" today on a daily cadence means the
+        // next auto-run fires tomorrow rather than today's 03:00. The
+        // dashboard PATCH that flips `enabled` calls `reloadCrons()` so this
+        // job is added live without a daemon restart.
+        if (isSkillCurationEnabled(this.db)) {
+            const skillCurationJob = cron.schedule("0 3 * * *", () => {
+                // Re-check on tick so a runtime disable suppresses the next run
+                // even before the next reloadCrons().
+                if (!isSkillCurationEnabled(this.db))
+                    return;
+                const cadence = readSkillCurationCadence(this.db);
+                if (!isCadenceIntervalElapsed(this.db, cadence)) {
+                    logger.debug({ cadence }, "skill_curation cadence interval not elapsed yet");
+                    return;
+                }
+                const gateReason = this.autonomousGate();
+                if (gateReason !== null) {
+                    this.logGateBlock(gateReason, { cron: "skill_curation" });
+                    return;
+                }
+                this.emitRoutine("skill_curation", { cadence });
+            }, { timezone: tz });
+            this.cronJobs.push(skillCurationJob);
+        }
+        logger.info({
+            morningHour: this.config.dayBoundaryHour,
+            timezone: tz ?? "system",
+            hourlyCheckEnabled: this.config.hourlyCheckEnabled,
+            hourlyCheckIntervalMinutes: this.config.hourlyCheckIntervalMinutes,
+        }, "Recurring cron jobs configured");
+    }
+    emitRoutine(routineName, data) {
+        const event = {
+            ...createEvent({
+                type: `routine.${routineName}`,
+                source: "scheduler",
+                priority: EventPriority.HIGH,
+                ...(data ? { data } : {}),
+            }),
+            routine: routineName,
+        };
+        void this.eventBus.put(event);
+        logger.info({ routine: routineName }, "Routine event emitted");
+    }
+    /**
+     * Queue the morning routine as a durable wake task.
+     *
+     * This serializes all morning-routine entry points (cron, startup catchup,
+     * Google auth hot-load) behind a single DB-backed dedup guard so we don't
+     * run multiple overlapping full-day regenerations.
+     */
+    queueMorningRoutineWake(source, options) {
+        const scheduledFor = formatSqliteDatetime(new Date());
+        const wakeEvent = createEvent({
+            type: "routine.morning_routine",
+            source,
+            priority: EventPriority.HIGH,
+        });
+        // `importance: "low"` keeps morning-routine wake tasks out of the
+        // roadmap refresh trigger — they fire within hours and the morning
+        // routine itself is the visible surface, not a roadmap entry.
+        const taskContext = JSON.stringify({
+            routine: "morning_routine",
+            source,
+            postCatchupRoutines: options?.postCatchupRoutines ?? [],
+            postCatchupHourlyCheck: options?.postCatchupHourlyCheck ?? false,
+            importance: "low",
+        });
+        const insertTxn = this.db.transaction(() => {
+            const existing = this.db
+                .prepare(`SELECT id, task_context
+             FROM agent_schedule
+            WHERE task_type = 'wake'
+              AND status IN ('pending', 'running')
+              AND json_extract(task_context, '$.routine') = 'morning_routine'
+            LIMIT 1`)
+                .get();
+            if (existing) {
+                const existingContext = JSON.parse(existing.task_context ?? "{}");
+                const mergedRoutines = Array.from(new Set([
+                    ...(Array.isArray(existingContext.postCatchupRoutines)
+                        ? existingContext.postCatchupRoutines
+                        : []),
+                    ...(options?.postCatchupRoutines ?? []),
+                ]));
+                const mergedHourlyCheck = existingContext.postCatchupHourlyCheck === true ||
+                    options?.postCatchupHourlyCheck === true;
+                const mergedContext = {
+                    routine: "morning_routine",
+                    source: existingContext.source ?? source,
+                    postCatchupRoutines: mergedRoutines,
+                    postCatchupHourlyCheck: mergedHourlyCheck,
+                    importance: "low",
+                };
+                this.db
+                    .prepare(`UPDATE agent_schedule
+                SET task_context = ?
+              WHERE id = ?`)
+                    .run(JSON.stringify(mergedContext), existing.id);
+                return { inserted: false, existingId: existing.id };
+            }
+            this.db
+                .prepare(`INSERT INTO agent_schedule
+             (scheduled_for, task_type, task_description, task_context, correlation_id, model, status)
+           VALUES (?, 'wake', ?, ?, ?, NULL, 'pending')`)
+                .run(scheduledFor, "Morning routine. Generate today.md and register the day schedule.", taskContext, wakeEvent.correlationId);
+            return { inserted: true };
+        });
+        const result = insertTxn();
+        if (result.inserted) {
+            logger.info({ source, scheduledFor }, "Morning routine wake queued");
+        }
+        else {
+            logger.info({ source, existingScheduleId: result.existingId }, "Morning routine wake deduped");
+        }
+        return result;
+    }
+    /**
+     * ScheduleWatcher — polls agent_schedule for pending tasks.
+     *
+     * Handles agent-scheduled wake-ups and DMs. Uses optimistic locking:
+     * only processes rows where
+     * UPDATE ... SET status='running' WHERE status='pending' succeeds.
+     */
+    startScheduleWatcher() {
+        this.pollAbort = new AbortController();
+        const loop = async () => {
+            while (!this.shutdown) {
+                try {
+                    const agentDayStartUtc = getAgentDayBoundsUtc(this.config.timezone || undefined, this.config.dayBoundaryHour).start;
+                    const discarded = discardStalePendingSchedules(this.db, agentDayStartUtc);
+                    if (discarded > 0) {
+                        logger.info({ discarded }, "Discarded stale pending schedules");
+                    }
+                    // Setup gate — leave due rows in 'pending' so ScheduleWatcher
+                    // picks them up on the next tick after setup completes. Direct DMs
+                    // (row.task_type === "dm") are also gated since the user cannot
+                    // have scheduled them before completing initial setup; any DMs
+                    // that happened to roll over a day boundary while setup was in
+                    // progress wait for setup to finish before sending.
+                    const gateReason = this.autonomousGate();
+                    if (gateReason !== null) {
+                        this.logGateBlock(gateReason, { poll: "schedule_watcher" });
+                        await this.sleepInterruptible(this.config.schedulePollIntervalSeconds * 1000);
+                        continue;
+                    }
+                    // Reconcile recurring schedules: generate next agent_schedule
+                    // rows for any enabled recurring schedule with no pending/running row.
+                    try {
+                        const reconciled = reconcileRecurringSchedules(this.db);
+                        if (reconciled > 0) {
+                            logger.info({ reconciled }, "Reconciled recurring schedules");
+                        }
+                    }
+                    catch (err) {
+                        logger.error({ err }, "Recurring schedule reconciliation failed");
+                    }
+                    const nowUtc = formatSqliteDatetime(new Date());
+                    const rows = this.db
+                        .prepare("SELECT * FROM agent_schedule WHERE status = 'pending' AND scheduled_for <= ? ORDER BY scheduled_for ASC LIMIT 3")
+                        .all(nowUtc);
+                    for (const row of rows) {
+                        // Optimistic lock: only proceed if we successfully claim the row
+                        const result = this.db
+                            .prepare("UPDATE agent_schedule SET status = 'running' WHERE id = ? AND status = 'pending'")
+                            .run(row.id);
+                        if (result.changes === 0)
+                            continue;
+                        // Per-row try/catch: if the row body throws (e.g. malformed
+                        // task_context JSON), flip the claim to 'failed' so the row
+                        // doesn't stay 'running' forever and the watcher can move on.
+                        try {
+                            // Direct DM: send message without running an agent
+                            if (row.task_type === "dm") {
+                                await this.handleDirectDm(row);
+                                continue;
+                            }
+                            // SCHEDULED-DM-IMPLEMENTATION-PLAN §5.5 — DM-tone scheduled
+                            // session. Same shape as scheduled.task; the type field is
+                            // the routing axis that downstream uses to pick the
+                            // conversational profile + DM-flavored context blocks.
+                            if (row.task_type === "dm_session") {
+                                const base = createEvent({
+                                    type: "scheduled.dm",
+                                    source: row.task_type,
+                                    priority: EventPriority.NORMAL,
+                                });
+                                const event = {
+                                    ...base,
+                                    // task_prompt overrides task_description as the agent body
+                                    // when set; falls back to the description otherwise.
+                                    task: row.task_prompt ?? row.task_description,
+                                    taskContext: JSON.parse(row.task_context ?? "{}"),
+                                    correlationId: row.correlation_id ?? base.correlationId,
+                                    scheduleId: row.id,
+                                    // `agent_schedule.model` is operator-supplied. If it matches
+                                    // the binary `requestedModel` shape ("sonnet" / "opus") use
+                                    // that; otherwise pass the literal model id through
+                                    // `requestedModelId` so non-Claude rows (e.g. "haiku",
+                                    // "gpt-5.5", "gemini-2.5-flash") aren't silently demoted to
+                                    // Sonnet by the legacy two-tier coercion.
+                                    ...(row.model === "sonnet" || row.model === "opus"
+                                        ? { requestedModel: row.model }
+                                        : row.model
+                                            ? { requestedModelId: row.model }
+                                            : {}),
+                                };
+                                await this.eventBus.put(event);
+                                logger.info({ taskId: row.id, taskType: row.task_type }, "Scheduled DM session dispatched");
+                                continue;
+                            }
+                            const base = createEvent({
+                                type: "scheduled.task",
+                                source: row.task_type,
+                                priority: EventPriority.NORMAL,
+                            });
+                            const event = {
+                                ...base,
+                                // task_prompt overrides task_description as the agent body
+                                // when set; falls back to the description otherwise.
+                                task: row.task_prompt ?? row.task_description,
+                                taskContext: JSON.parse(row.task_context ?? "{}"),
+                                correlationId: row.correlation_id ?? base.correlationId,
+                                scheduleId: row.id,
+                                // `agent_schedule.model` is operator-supplied. If it matches
+                                // the binary `requestedModel` shape ("sonnet" / "opus") use
+                                // that; otherwise pass the literal model id through
+                                // `requestedModelId` so non-Claude rows (e.g. "haiku",
+                                // "gpt-5.5", "gemini-2.5-flash") aren't silently demoted to
+                                // Sonnet by the legacy two-tier coercion.
+                                ...(row.model === "sonnet" || row.model === "opus"
+                                    ? { requestedModel: row.model }
+                                    : row.model
+                                        ? { requestedModelId: row.model }
+                                        : {}),
+                            };
+                            await this.eventBus.put(event);
+                            logger.info({ taskId: row.id, taskType: row.task_type }, "Scheduled task dispatched");
+                        }
+                        catch (rowErr) {
+                            // Without this catch the row stays 'running' forever (claim
+                            // already committed) and the watcher silently never retries.
+                            logger.error({ err: rowErr, taskId: row.id, taskType: row.task_type }, "Scheduled row dispatch failed — marking failed");
+                            try {
+                                this.db
+                                    .prepare("UPDATE agent_schedule SET status = 'failed' WHERE id = ? AND status = 'running'")
+                                    .run(row.id);
+                            }
+                            catch (markErr) {
+                                logger.error({ err: markErr, taskId: row.id }, "Failed to mark scheduled row as failed");
+                            }
+                        }
+                    }
+                    // Health check: warn once when no pending or running tasks exist
+                    const activeCount = this.db
+                        .prepare("SELECT COUNT(*) as cnt FROM agent_schedule WHERE status IN ('pending', 'running')")
+                        .get();
+                    if (activeCount.cnt === 0 && !this.noFutureTasksWarned) {
+                        this.noFutureTasksWarned = true;
+                        logger.warn("No pending tasks in schedule — next execution relies on cron routines");
+                    }
+                    else if (activeCount.cnt > 0) {
+                        this.noFutureTasksWarned = false;
+                    }
+                }
+                catch (err) {
+                    logger.error({ err }, "ScheduleWatcher error");
+                }
+                // Wait before next poll. Aborts immediately on stop() so SIGTERM
+                // doesn't have to wait up to schedulePollIntervalSeconds.
+                await this.sleepInterruptible(this.config.schedulePollIntervalSeconds * 1000);
+            }
+        };
+        void loop();
+    }
+    /**
+     * Sleep for `ms` milliseconds, but resolve early if `pollAbort` aborts.
+     * Used by the ScheduleWatcher between polls so stop() can interrupt it.
+     */
+    sleepInterruptible(ms) {
+        if (this.shutdown)
+            return Promise.resolve();
+        const signal = this.pollAbort?.signal;
+        if (signal?.aborted)
+            return Promise.resolve();
+        return new Promise((resolve) => {
+            const onAbort = () => {
+                clearTimeout(timer);
+                resolve();
+            };
+            const timer = setTimeout(() => {
+                signal?.removeEventListener("abort", onAbort);
+                resolve();
+            }, ms);
+            signal?.addEventListener("abort", onAbort, { once: true });
+        });
+    }
+    /**
+     * Handle a direct DM task: send the message directly via the registered
+     * callback, bypassing the agent pipeline entirely. This is zero-cost
+     * compared to running an AI agent for a pre-composed message.
+     *
+     * Quiet hours and rate limits are intentionally skipped — the user
+     * explicitly scheduled this DM, so it should fire at the requested time.
+     */
+    async handleDirectDm(row) {
+        try {
+            if (!this.sendDm) {
+                logger.warn({ taskId: row.id }, "sendDm callback not registered, cannot send direct DM");
+                this.db
+                    .prepare("UPDATE agent_schedule SET status = 'failed' WHERE id = ?")
+                    .run(row.id);
+                return;
+            }
+            const ctx = JSON.parse(row.task_context ?? "{}");
+            const delivery = await this.sendDm(row.task_description, Array.isArray(ctx.platforms)
+                ? ctx.platforms
+                : typeof ctx.platform === "string"
+                    ? [ctx.platform]
+                    : undefined);
+            const dispatchId = randomUUID();
+            const summary = (row.task_description ?? "").slice(0, 200);
+            const insert = this.db.prepare(`INSERT INTO notification_log (
+           dispatch_id,
+           notification_type,
+           priority,
+           platform,
+           delivery_channel,
+           delivery_message_id,
+           content_summary,
+           status,
+           created_at,
+           delivered_at
+         )
+         VALUES (?, 'scheduled_dm', 'normal', ?, ?, ?, ?, 'delivered', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`);
+            for (const item of delivery) {
+                insert.run(dispatchId, item.platform, item.channel, item.messageId ?? null, summary);
+            }
+            this.db
+                .prepare("UPDATE agent_schedule SET status = 'completed' WHERE id = ?")
+                .run(row.id);
+            logger.info({ taskId: row.id }, "Direct DM sent");
+        }
+        catch (err) {
+            this.db
+                .prepare("UPDATE agent_schedule SET status = 'failed' WHERE id = ?")
+                .run(row.id);
+            logger.error({ err, taskId: row.id }, "Failed to send direct DM");
+        }
+    }
+    /** Daily cleanup: expire sessions, run retention */
+    dailyCleanup() {
+        try {
+            const agentDayStartUtc = getAgentDayBoundsUtc(this.config.timezone || undefined, this.config.dayBoundaryHour).start;
+            const discarded = discardStalePendingSchedules(this.db, agentDayStartUtc);
+            if (discarded > 0) {
+                logger.info({ discarded }, "Discarded previous-agent-day pending schedules");
+            }
+            // Idle-expire long-silent sessions.
+            //
+            // Scope matrix:
+            //   - THREAD            (is_dm=0, Slack/Discord channel mentions) →
+            //                       channel safety timeout
+            //   - DASHBOARD_CHAT    (is_dm=1, scope='dashboard_chat')         →
+            //                       dashboard safety timeout (workdir preserved
+            //                       so the expired row remains resumable from the
+            //                       sidebar until retention prunes it)
+            //   - OWNER_DM          (is_dm=1, scope='owner_dm', messaging apps) →
+            //                       NOT idle-expired here. Messaging DMs persist
+            //                       all day and are ended at the 4 AM day-boundary
+            //                       summarization callback.
+            //
+            // We use a single `max(channel, dashboard)` safety window because the
+            // per-session expiry already happens in `getOrCreateDm` /
+            // `getOrCreateThread` on the next inbound event; this path only
+            // catches sessions that never see another event before retention
+            // deletes their row.
+            const idleSafetyTimeout = Math.max(this.config.sessionTimeoutChannelMinutes, this.config.sessionTimeoutDashboardMinutes);
+            const expiredRows = this.db
+                .prepare(`SELECT id, scope FROM conversation_sessions
+           WHERE status = 'active'
+             AND (
+               is_dm = 0
+               OR (is_dm = 1 AND scope = 'dashboard_chat')
+             )
+             AND last_message_at < datetime('now', '-' || ? || ' minutes')`)
+                .all(idleSafetyTimeout);
+            if (expiredRows.length > 0) {
+                this.db
+                    .prepare(`UPDATE conversation_sessions SET status = 'expired'
+             WHERE status = 'active'
+               AND (
+                 is_dm = 0
+                 OR (is_dm = 1 AND scope = 'dashboard_chat')
+               )
+               AND last_message_at < datetime('now', '-' || ? || ' minutes')`)
+                    .run(idleSafetyTimeout);
+                // Clean up workdirs for expired sessions — but preserve dashboard
+                // workdirs so the row stays resumable from the dashboard sidebar.
+                // The preservation logic mirrors `SessionManager.shouldPreserveResumeState`.
+                for (const row of expiredRows) {
+                    if (row.scope === "dashboard_chat")
+                        continue;
+                    cleanupSessionWorkdir(getSessionWorkdirPath(this.config.dataDir, row.id));
+                }
+            }
+            // Run data retention cleanup
+            const result = runRetentionCleanup(this.db, this.config);
+            // Clean up orphaned session workdirs left behind by daemon crashes or
+            // retention deletes. Inactive conversation rows may remain resumable
+            // from dashboard history until retention prunes them, so only remove
+            // dirs whose DB row no longer exists at all.
+            const existingRows = this.db
+                .prepare("SELECT id FROM conversation_sessions")
+                .all();
+            const existingIds = new Set(existingRows.map((r) => r.id));
+            cleanupStaleWorkdirs(this.config.dataDir, existingIds);
+            logger.info(result, "Daily cleanup completed");
+        }
+        catch (err) {
+            logger.error({ err }, "Daily cleanup failed");
+        }
+    }
+}
+// ── P22 — skill curation cron helpers ───────────────────────────────────
+function readSkillCurationCadence(db) {
+    // Tolerate test DBs that don't apply the full schema. The scheduler is
+    // re-instantiated across many small test setups; missing table → default.
+    try {
+        const row = db
+            .prepare(`SELECT value_json FROM runtime_state WHERE key = 'skill_curation.config'`)
+            .get();
+        if (!row)
+            return "weekly";
+        const v = JSON.parse(row.value_json);
+        return v.cadence ?? "weekly";
+    }
+    catch {
+        return "weekly";
+    }
+}
+function isSkillCurationEnabled(db) {
+    try {
+        const row = db
+            .prepare(`SELECT value_json FROM runtime_state WHERE key = 'skill_curation.config'`)
+            .get();
+        if (!row)
+            return false;
+        const v = JSON.parse(row.value_json);
+        return v.enabled === true;
+    }
+    catch {
+        return false;
+    }
+}
+/** P22 §6.3 — interval since the most recent run's `started_at`, used by
+ *  the daily 03:00 cron to gate auto-fires. Manual runs land in the same
+ *  table with `is_manual=1` and naturally push this forward, satisfying
+ *  the contract "manual click resets the cadence timer". */
+function cadenceIntervalMs(cadence) {
+    switch (cadence) {
+        case "daily": return 24 * 60 * 60 * 1000;
+        case "weekly": return 7 * 24 * 60 * 60 * 1000;
+        case "monthly": return 30 * 24 * 60 * 60 * 1000;
+    }
+}
+function isCadenceIntervalElapsed(db, cadence) {
+    try {
+        const row = db
+            .prepare(`SELECT MAX(started_at) AS last FROM skill_curation_runs`)
+            .get();
+        if (row.last === null)
+            return true; // never run before
+        // Tolerance: cron fires at 03:00 every day; a daily cadence run started
+        // at 03:00:01 yesterday should be eligible at 03:00:00 today. Without a
+        // tolerance the second run would slip a day on every cycle.
+        const tolerance = 5 * 60 * 1000; // 5 minutes
+        return Date.now() - row.last >= cadenceIntervalMs(cadence) - tolerance;
+    }
+    catch {
+        // Missing table (test bootstrap that skipped the schema apply) → run.
+        return true;
+    }
+}
+//# sourceMappingURL=scheduler.js.map