@aitne/daemon 0.1.6 → 0.1.8

package/dist/core/scheduler.js

@@ -1,11 +1,21 @@
 import cron from "node-cron";
 import { randomUUID } from "node:crypto";
-import { createEvent, EventPriority, formatSqliteDatetime, getAgentDayBoundsUtc, nowInTimezone, } from "@aitne/shared";
+import { createEvent, EventPriority, formatSqliteDatetime, getAgentDayBoundsUtc, getAgentDayDateStr, isBackendId, isProcessTier, nowInTimezone, } from "@aitne/shared";
 import { runRetentionCleanup } from "./retention.js";
 import { cleanupSessionWorkdir, cleanupStaleWorkdirs, getSessionWorkdirPath } from "./workdir.js";
 import { discardStalePendingSchedules } from "./schedule-maintenance.js";
 import { createLogger } from "../logging.js";
 import { reconcileRecurringSchedules } from "../db/recurring-schedules.js";
+import { getStalledMorningRoutineWake, readMorningRoutineStallThresholdMinutes, } from "../bootstrap/schedule-helpers.js";
+import { readRuntimeState, writeRuntimeState } from "../db/runtime-state.js";
+import { recordProactiveForwardDeliveries } from "./channel-timeline.js";
+/**
+ * Runtime-state key holding the agent-day date string (`YYYY-MM-DD`) on
+ * which the watchdog last sent an owner DM about the morning routine
+ * being stuck. Per-day dedup: the watchdog fires at most once per
+ * agent-day even if the cron tick that owns it runs every minute.
+ */
+const MORNING_ROUTINE_STALL_ALERT_KEY = "morning_routine.stall_alert_day";
 const logger = createLogger("scheduler");
 /**
  * True iff `intervalMinutes` cleanly fits inside an hour, so the firing
@@ -105,6 +115,16 @@ export function buildUserProfileSweepMorningCronExpr(dayBoundaryHour) {
  * track the same config knob in lockstep.
  */
 export const USER_PROFILE_SWEEP_EVENING_CRON_EXPR = "50 17 * * *";
+/**
+ * Cron expression for the daemon-side roadmap mechanical maintenance
+ * pass: fixed at 17:45 local — 15 min before Evening Review's fixed
+ * 18:00 and 5 min before the evening user-profile sweep at 17:50.
+ * The ordering matters: this job must release its lock before the
+ * surviving evening_review Step 2 (Long-term Plans promotion + Review:
+ * fire) acquires `roadmap_write_lock`. See
+ * `docs/design/appendices/evening-review-slimdown.md` §2.2.
+ */
+export const ROADMAP_MAINTENANCE_CRON_EXPR = "45 17 * * *";
 /**
  * AgentScheduler — manages recurring cron jobs and the DB-driven ScheduleWatcher.
  *
@@ -152,6 +172,17 @@ export class AgentScheduler {
      * morning flow reads it. The observer owns the run-once guard.
      */
     onContextIndexReconcile = null;
+    /**
+     * Evening-review slimdown §2.2 — daily mechanical roadmap.md
+     * maintenance pass at 17:45 local, 15 min before evening_review.
+     * Wraps `runRoadmapMechanicalMaintenance` so substeps 2a / 2b / 2d
+     * run in-process inside the daemon rather than inside a Sonnet
+     * routine that would otherwise re-derive the same date math. The
+     * callback is fire-and-forget (no return value contract): the
+     * implementation owns its own lock acquisition, audit emission, and
+     * agent/journal.md append.
+     */
+    onRoadmapMaintenance = null;
     /**
      * Setup gate — returns a skip reason when autonomous work should be
      * paused (initial setup incomplete, or setup conversation active).
@@ -162,26 +193,32 @@ export class AgentScheduler {
     autonomousGate = () => null;
     lastGateBlockLoggedAt = 0;
     /**
-     * Aborted by `stop()` to interrupt the ScheduleWatcher's between-poll sleep
-     * immediately. Without this, SIGTERM has to wait up to
-     * `schedulePollIntervalSeconds` before the loop notices `this.shutdown`.
+     * Single source of truth for the ScheduleWatcher's between-poll wake
+     * signaling, unifying what was previously a (pollAbort: AbortController
+     * + hasPendingNudge: boolean) pair (v4.14 audit, Task #3).
      *
-     * Also aborted by `nudgeWatcher()` so a freshly-INSERTed `agent_schedule`
-     * row with `scheduled_for = now` (e.g. the post-setup morning-routine wake)
-     * is picked up on the next event-loop tick instead of waiting up to a
-     * full poll interval. `sleepInterruptible` replaces the controller after
-     * consuming an abort so subsequent sleeps start fresh.
-     */
-    pollAbort = null;
-    /**
-     * Pending-nudge flag — set by `nudgeWatcher()` and consumed at the top of
-     * `sleepInterruptible`. Covers the race where `nudgeWatcher()` fires
-     * between two sleeps (after the previous sleep's abort listener cleared
-     * the flag, but before the next sleep is entered). The AbortController
-     * alone cannot carry this signal across sleeps because a fresh controller
-     * is created per sleep.
+     * Mechanics:
+     *   - `nudgeSeq` is monotonically incremented by every `nudgeWatcher()`
+     *     call (and `stop()` reuses it to break the sleep too).
+     *   - `observedSeq` is advanced when a nudge has been consumed —
+     *     either at the top of `sleepInterruptible` (between-sleep case)
+     *     or by the resolver path inside `nudgeWatcher()` / `stop()` when
+     *     they wake an in-flight sleep.
+     *   - `sleepWaiter` holds the resolver + timer for the currently-pending
+     *     sleep, if any. The ScheduleWatcher loop awaits sequentially, so
+     *     at most one waiter exists at a time.
+     *
+     * Why this replaces the AbortController pair: with a monotonic counter
+     * we cannot lose a nudge across a sleep boundary — a `nudgeWatcher()`
+     * call that arrives between two sleeps simply leaves `nudgeSeq >
+     * observedSeq`, and the next sleep entry consumes it. The two-stage
+     * (flag + signal) scheme was correct on paper but required readers to
+     * trace the precise synchronous ordering of three branches in
+     * `sleepInterruptible`; the counter compresses that to one branch.
      */
-    hasPendingNudge = false;
+    nudgeSeq = 0;
+    observedSeq = 0;
+    sleepWaiter = null;
     constructor(eventBus, db, config) {
         this.eventBus = eventBus;
         this.db = db;
@@ -221,6 +258,16 @@ export class AgentScheduler {
     setContextIndexReconcilerCallback(fn) {
         this.onContextIndexReconcile = fn;
     }
+    /**
+     * Register the daily roadmap mechanical maintenance callback. Called
+     * at 17:45 local; the callback is fire-and-forget — it owns its own
+     * lock acquisition, validation, audit emission, and journal append.
+     * Failures are logged but do NOT cascade into the 18:00
+     * evening_review.
+     */
+    setRoadmapMaintenanceCallback(fn) {
+        this.onRoadmapMaintenance = fn;
+    }
     /**
      * Register the autonomous-work gate. Returning null allows autonomous work;
      * any non-null string is treated as a skip reason and surfaced in logs.
@@ -236,6 +283,112 @@ export class AgentScheduler {
         this.lastGateBlockLoggedAt = now;
         logger.info({ ...context, reason }, "Autonomous work paused (setup gate)");
     }
+    /**
+     * In-process re-entrance mutex for the stall watchdog. The hourly cron
+     * fires the watchdog as a fire-and-forget promise; a slow `sendDm`
+     * (DM hub latency, owner channel reconnect) could overlap with the
+     * next hourly tick. Without serialization both invocations would pass
+     * the dedup-marker read (the marker isn't written until AFTER the DM
+     * succeeds, see below) and emit duplicate alerts. The mutex is
+     * process-local — fine, since a single scheduler instance is the only
+     * watchdog firing path.
+     */
+    morningStallWatchdogRunning = false;
+    /**
+     * Watchdog for the silent-stall pattern documented in the v4.14 audit
+     * (CLAUDE.md "morning_routine wake stall"). When the morning routine
+     * never writes an `agent_actions.result='success'` row, the dedup
+     * inside `queueMorningRoutineWake` keeps the stuck wake row pinned in
+     * `pending`/`running` and the hourly-check pre-routine gate silently
+     * skips every subsequent autonomous tick. The user gets no morning
+     * brief, no evening review, no hourly check, and no error — the
+     * system is functionally dead until the wake row clears.
+     *
+     * Detection: oldest `task_type='wake'` row tied to
+     * `routine='morning_routine'` older than the configured threshold (see
+     * `readMorningRoutineStallThresholdMinutes`) with no matching
+     * `agent_actions.result='success'` row in the current agent-day window.
+     *
+     * Delivery & dedup: DM-then-mark, NOT mark-then-DM. A failed DM (DM
+     * hub error, missing owner channel) leaves the marker empty so the
+     * next hourly tick retries. Repeat alerts on a chronically-broken DM
+     * channel are accepted as the lesser evil vs. a silent miss. The
+     * `morningStallWatchdogRunning` mutex serialises overlapping
+     * invocations so a slow DM cannot produce duplicate alerts.
+     *
+     * Fire-and-forget: returns nothing, surfaces all failures via logger.
+     * The owner DM is best-effort — a sendDm failure logs and does NOT
+     * re-throw, so a missing or broken message hub cannot cascade into a
+     * cron-callback exception.
+     */
+    async checkMorningRoutineStall(now) {
+        if (this.morningStallWatchdogRunning) {
+            logger.debug("Morning routine stall watchdog already running — skipping overlap");
+            return;
+        }
+        this.morningStallWatchdogRunning = true;
+        try {
+            let stalled;
+            try {
+                const thresholdMinutes = readMorningRoutineStallThresholdMinutes(this.db);
+                stalled = getStalledMorningRoutineWake(this.db, this.config, thresholdMinutes, now);
+            }
+            catch (err) {
+                logger.warn({ err }, "Morning routine stall watchdog query failed");
+                return;
+            }
+            if (!stalled)
+                return;
+            let today;
+            try {
+                today = getAgentDayDateStr(this.config.timezone || undefined, this.config.dayBoundaryHour, now);
+            }
+            catch (err) {
+                // getAgentDayDateStr can throw on invalid timezone config. Surface
+                // and bail rather than mis-key the dedup marker.
+                logger.warn({ err }, "Morning routine stall watchdog: agent-day resolution failed");
+                return;
+            }
+            const lastAlertDay = readRuntimeState(this.db, MORNING_ROUTINE_STALL_ALERT_KEY);
+            if (lastAlertDay === today) {
+                logger.debug({ today, stalledRowId: stalled.id, ageMinutes: stalled.ageMinutes }, "Morning routine stall watchdog already alerted today");
+                return;
+            }
+            logger.warn({
+                stalledRowId: stalled.id,
+                ageMinutes: stalled.ageMinutes,
+                status: stalled.status,
+                scheduledFor: stalled.scheduledFor,
+            }, "Morning routine stall detected — alerting owner");
+            if (!this.sendDm) {
+                logger.warn({ stalledRowId: stalled.id }, "Morning routine stall watchdog: sendDm callback not registered; will retry next tick");
+                return;
+            }
+            const message = `Aitne: morning routine stalled ${stalled.ageMinutes} min `
+                + `(wake #${stalled.id}, status=${stalled.status}). Hourly check + `
+                + `evening review blocked. Check logs or \`aitne restart\`.`;
+            try {
+                await this.sendDm(message);
+            }
+            catch (err) {
+                logger.warn({ err, stalledRowId: stalled.id }, "Morning routine stall watchdog: sendDm failed; dedup marker NOT set — next tick will retry");
+                return;
+            }
+            // Mark dedup ONLY after a successful DM. A persistence failure here
+            // would produce one duplicate DM on the next tick — acceptable, and
+            // strictly better than the alternative (alert lost forever on
+            // transient sendDm failures).
+            try {
+                writeRuntimeState(this.db, MORNING_ROUTINE_STALL_ALERT_KEY, today);
+            }
+            catch (err) {
+                logger.warn({ err }, "Morning routine stall watchdog: failed to persist dedup marker; next tick may re-alert");
+            }
+        }
+        finally {
+            this.morningStallWatchdogRunning = false;
+        }
+    }
     start() {
         this.setupRecurringJobs();
         this.startScheduleWatcher();
@@ -243,9 +396,12 @@ export class AgentScheduler {
     }
     stop() {
         this.shutdown = true;
-        // Wake up the ScheduleWatcher's poll sleep so the loop returns immediately
-        // instead of waiting for the next interval tick.
-        this.pollAbort?.abort();
+        // Wake up the ScheduleWatcher's poll sleep so the loop returns
+        // immediately instead of waiting for the next interval tick. The
+        // sleepInterruptible body re-checks `shutdown` before re-entering
+        // its `new Promise` block, so simply resolving any in-flight waiter
+        // is enough — no need to broadcast through the nudge counter.
+        this.consumeWaiter();
         this.stopCronJobs();
         logger.info("Scheduler stopped");
     }
@@ -256,17 +412,35 @@ export class AgentScheduler {
      *
      * Safe to call any time after `start()` (and a no-op before): the public
      * surface is idempotent — multiple rapid calls coalesce into a single
-     * extra wake at the next sleep boundary. The pending-nudge flag covers
-     * the race where this method is invoked between sleeps; `sleepInterruptible`
-     * consumes it at the top of the next sleep cycle.
+     * extra wake at the next sleep boundary. Between-sleep nudges land on
+     * the monotonic `nudgeSeq` counter and are consumed at the top of the
+     * next `sleepInterruptible`; in-flight nudges resolve the active
+     * waiter directly. Both paths advance `observedSeq` so a single nudge
+     * skips exactly one sleep, never two.
      *
      * Wired today from `queueMorningRoutineWake` (post-setup, post-Google-auth,
      * catchup); other `INSERT INTO agent_schedule` sites use future-dated rows
      * and do not need a nudge.
      */
     nudgeWatcher() {
-        this.hasPendingNudge = true;
-        this.pollAbort?.abort();
+        this.nudgeSeq += 1;
+        if (this.sleepWaiter) {
+            this.observedSeq = this.nudgeSeq;
+            this.consumeWaiter();
+        }
+    }
+    /**
+     * Resolve and clear the active `sleepWaiter`, if any. Used by both
+     * `stop()` and `nudgeWatcher()` to break a running sleep. Safe to call
+     * when no waiter exists — it's a no-op.
+     */
+    consumeWaiter() {
+        const waiter = this.sleepWaiter;
+        if (!waiter)
+            return;
+        this.sleepWaiter = null;
+        clearTimeout(waiter.timer);
+        waiter.resolve();
     }
     /** Hot-reload cron schedules (e.g. after dayBoundaryHour changes) */
     reloadCrons() {
@@ -341,9 +515,33 @@ export class AgentScheduler {
             this.emitRoutine("user_profile_sweep", { phase: "evening" });
         }, { timezone: tz });
         this.cronJobs.push(sweepEveningJob);
-        // Weekly Review: Friday at 18:00
+        // Roadmap mechanical maintenance (evening-review slimdown §2.2):
+        // 17:45 local, 15 min before evening_review's 18:00 fire. Runs the
+        // typed in-process pass (substeps 2a / 2b / 2d) that legacy
+        // evening_review used to do via a Sonnet routine. The job is gated
+        // by `autonomousGate` like every other autonomous cron, but
+        // intentionally does NOT inherit the `morning_routine_pending_for_today`
+        // skip — mechanical roadmap maintenance is independent of whether
+        // the morning routine ran, and inheriting the gate would block
+        // maintenance on the very days the operator needs roadmap.md to
+        // stay clean.
+        const roadmapMaintenanceJob = cron.schedule(ROADMAP_MAINTENANCE_CRON_EXPR, () => {
+            const gateReason = this.autonomousGate();
+            if (gateReason !== null) {
+                this.logGateBlock(gateReason, { cron: "roadmap_maintenance" });
+                return;
+            }
+            try {
+                this.onRoadmapMaintenance?.();
+            }
+            catch (err) {
+                logger.warn({ err }, "Roadmap maintenance callback threw");
+            }
+        }, { timezone: tz });
+        this.cronJobs.push(roadmapMaintenanceJob);
+        // Weekly Review: Friday at 19:00 (one hour after evening_review)
         // Emits a separate routine event so the prompt can generate weekly/YYYY-Www.md
-        const weeklyJob = cron.schedule("0 18 * * 5", () => {
+        const weeklyJob = cron.schedule("0 19 * * 5", () => {
             const gateReason = this.autonomousGate();
             if (gateReason !== null) {
                 this.logGateBlock(gateReason, { cron: "weekly_review" });
@@ -354,8 +552,19 @@ export class AgentScheduler {
         this.cronJobs.push(weeklyJob);
         // Monthly Review: last day of month at 18:00
         // node-cron doesn't directly support "last day of month",
-        // so we run daily at 18:00 and check if tomorrow is the 1st
+        // so we run daily at 18:00 and check if tomorrow is the 1st.
+        //
+        // Default OFF pre-release (see runtime-settings.ts:monthlyReviewEnabled).
+        // The cron is always registered, but the callback consults
+        // `this.config.monthlyReviewEnabled` at fire time so a runtime PATCH
+        // takes effect on the next month-end without restart — that is also
+        // why this key is intentionally absent from SCHEDULE_KEYS in
+        // dashboard/config.ts (no cron rebuild needed). The routine itself
+        // (task-flow, context-builder branch, retention coupling) stays in
+        // tree as a concept pending the Mirror+Prune redesign.
         const monthlyJob = cron.schedule("0 18 * * *", () => {
+            if (!this.config.monthlyReviewEnabled)
+                return;
             // Check if tomorrow (in configured timezone) is the 1st
             const tomorrow = new Date();
             tomorrow.setDate(tomorrow.getDate() + 1);
@@ -431,6 +640,13 @@ export class AgentScheduler {
                         logger.warn({ err }, "Auth probe callback failed");
                     });
                 }
+                // Morning-routine stall watchdog. Runs alongside the auth probe
+                // because both are observability hooks that should fire even
+                // when the hourly check itself gets gated (e.g., the gate
+                // skip is the *symptom* the watchdog needs to catch).
+                void this.checkMorningRoutineStall(now).catch((err) => {
+                    logger.warn({ err }, "Morning routine stall watchdog threw");
+                });
                 if (this.onHourlyCheck) {
                     void this.onHourlyCheck("cron");
                 }
@@ -537,11 +753,34 @@ export class AgentScheduler {
                     postCatchupHourlyCheck: mergedHourlyCheck,
                     importance: "low",
                 };
+                // Bump `scheduled_for` forward when the new caller's NOW lies
+                // after the existing row's stored timestamp. Closes a narrow but
+                // silent race around the agent-day boundary:
+                //
+                //   - existing wake row was inserted just before the boundary
+                //     (e.g. 03:59:59 local) with `scheduled_for = 03:59:59`;
+                //   - this caller (the 04:00 cron, or any post-boundary trigger)
+                //     dedup-merges instead of inserting;
+                //   - without bumping `scheduled_for`, the merged row keeps the
+                //     pre-boundary timestamp and the next ScheduleWatcher tick
+                //     marks it `skipped` via `discardStalePendingSchedules`
+                //     (which discards `pending` rows with `scheduled_for <
+                //     currentAgentDayStartUtc`), silently losing the wake.
+                //
+                // `MAX(scheduled_for, ?)` keeps legitimate future-dated retry
+                // rows (scheduleMorningRetry inserts with a +5/10/15 min back-
+                // off) at their original time — the retry chain's exponential
+                // back-off is preserved. Only past-dated rows get pulled forward,
+                // which is exactly the boundary-race shape this guards against.
+                // Both timestamps are produced by `formatSqliteDatetime` (the
+                // `YYYY-MM-DD HH:MM:SS` zero-padded form), so SQLite's string
+                // comparison ranks them chronologically.
                 this.db
                     .prepare(`UPDATE agent_schedule
-                SET task_context = ?
+                SET task_context = ?,
+                    scheduled_for = MAX(scheduled_for, ?)
               WHERE id = ?`)
-                    .run(JSON.stringify(mergedContext), existing.id);
+                    .run(JSON.stringify(mergedContext), scheduledFor, existing.id);
                 return { inserted: false, existingId: existing.id };
             }
             this.db
@@ -574,7 +813,6 @@ export class AgentScheduler {
      * UPDATE ... SET status='running' WHERE status='pending' succeeds.
      */
     startScheduleWatcher() {
-        this.pollAbort = new AbortController();
         const loop = async () => {
             while (!this.shutdown) {
                 try {
@@ -644,16 +882,30 @@ export class AgentScheduler {
                                     taskContext: JSON.parse(row.task_context ?? "{}"),
                                     correlationId: row.correlation_id ?? base.correlationId,
                                     scheduleId: row.id,
-                                    // `agent_schedule.model` is operator-supplied. If it matches
-                                    // the binary `requestedModel` shape ("sonnet" / "opus") use
-                                    // that; otherwise pass the literal model id through
-                                    // `requestedModelId` so non-Claude rows (e.g. "haiku",
-                                    // "gpt-5.5", "gemini-2.5-flash") aren't silently demoted to
-                                    // Sonnet by the legacy two-tier coercion.
+                                    // Tier override takes precedence over the legacy model
+                                    // field at dispatch (the dispatcher inspects
+                                    // requestedTier ahead of requestedModel). The schema
+                                    // CHECK already constrains the column to lite/medium/high,
+                                    // so the in-cast is safe.
+                                    ...(isProcessTier(row.tier_override)
+                                        ? { requestedTier: row.tier_override }
+                                        : {}),
+                                    // `agent_schedule.model` is operator-supplied. Three
+                                    // resolution branches (SCHEDULE_API_REDESIGN_PLAN §4.3a):
+                                    //   1. legacy alias 'sonnet' / 'opus' → `requestedModel`
+                                    //   2. registered model id paired with backend_id →
+                                    //      emit BOTH `requestedBackendId` and
+                                    //      `requestedModelId` so the dispatcher's override
+                                    //      block (which guards on both fields together)
+                                    //      actually fires. Without the backend companion the
+                                    //      pin is silently dropped.
+                                    //   3. model present but backend_id NULL (legacy rows or
+                                    //      pure-tier rows) → fall through to no-override so
+                                    //      the row resolves via process-key defaults.
                                     ...(row.model === "sonnet" || row.model === "opus"
                                         ? { requestedModel: row.model }
-                                        : row.model
-                                            ? { requestedModelId: row.model }
+                                        : row.model && row.backend_id && isBackendId(row.backend_id)
+                                            ? { requestedBackendId: row.backend_id, requestedModelId: row.model }
                                             : {}),
                                 };
                                 await this.eventBus.put(event);
@@ -689,16 +941,22 @@ export class AgentScheduler {
                                 ...(liftedReplyTarget
                                     ? { data: { ...base.data, reply_target: liftedReplyTarget } }
                                     : {}),
-                                // `agent_schedule.model` is operator-supplied. If it matches
-                                // the binary `requestedModel` shape ("sonnet" / "opus") use
-                                // that; otherwise pass the literal model id through
-                                // `requestedModelId` so non-Claude rows (e.g. "haiku",
-                                // "gpt-5.5", "gemini-2.5-flash") aren't silently demoted to
-                                // Sonnet by the legacy two-tier coercion.
+                                // Tier override takes precedence over the legacy model
+                                // field at dispatch (the dispatcher inspects
+                                // requestedTier ahead of requestedModel). The schema
+                                // CHECK already constrains the column to lite/medium/high.
+                                ...(isProcessTier(row.tier_override)
+                                    ? { requestedTier: row.tier_override }
+                                    : {}),
+                                // `agent_schedule.model` is operator-supplied. See the
+                                // scheduled.dm branch above (SCHEDULE_API_REDESIGN_PLAN
+                                // §4.3a) for the three resolution branches. Same shape —
+                                // a registered full model id requires the `backend_id`
+                                // companion or it falls through to process-key defaults.
                                 ...(row.model === "sonnet" || row.model === "opus"
                                     ? { requestedModel: row.model }
-                                    : row.model
-                                        ? { requestedModelId: row.model }
+                                    : row.model && row.backend_id && isBackendId(row.backend_id)
+                                        ? { requestedBackendId: row.backend_id, requestedModelId: row.model }
                                         : {}),
                             };
                             await this.eventBus.put(event);
@@ -741,50 +999,47 @@ export class AgentScheduler {
         void loop();
     }
     /**
-     * Sleep for `ms` milliseconds, but resolve early if `pollAbort` aborts.
-     * Used by the ScheduleWatcher between polls so `stop()` and
-     * `nudgeWatcher()` can interrupt it.
+     * Sleep for `ms` milliseconds, but resolve early when `stop()` or
+     * `nudgeWatcher()` fire. Used by the ScheduleWatcher between polls so
+     * shutdown / "wake now" signals interrupt the wait.
      *
-     * Resolution order:
+     * Resolution order (single linear sequence — no branch fan-out):
      *   1. `shutdown` → immediate resolve.
-     *   2. pending nudge flag (set by `nudgeWatcher()` while we were processing
-     *      the previous batch) → consume and immediate resolve.
-     *   3. existing controller already aborted (legacy `stop()` contract, plus
-     *      the in-flight `nudgeWatcher()` path where `onAbort` already
-     *      consumed the flag) → replace controller and immediate resolve so
-     *      the next sleep starts fresh.
-     *   4. otherwise wait for either the timer or a fresh abort.
+     *   2. `nudgeSeq > observedSeq` → consume + immediate resolve. Covers
+     *      every nudge that arrived while no sleep was active (before the
+     *      first sleep ever ran, or between two consecutive sleeps).
+     *   3. otherwise install a `sleepWaiter` with a setTimeout and wait;
+     *      the resolver is invoked either by the timer or by a subsequent
+     *      `stop()` / `nudgeWatcher()` via `consumeWaiter()`.
      *
-     * Controller lifecycle: a new `AbortController` is installed on entry to
-     * step 4 so a previous abort cannot make this sleep return instantly.
-     * `nudgeWatcher()` always sets `hasPendingNudge` BEFORE calling `abort()`
-     * — the synchronous order is what closes the race against this method
-     * reading `pollAbort` and installing listeners.
+     * Invariant: `observedSeq` only advances on consumption, so a `nudgeSeq`
+     * bump that arrives during the active sleep is observed by the caller
+     * (`nudgeWatcher`) which advances `observedSeq` AND resolves the waiter
+     * in the same synchronous block. A bump that arrives between sleeps is
+     * still visible (`nudgeSeq > observedSeq`) on the next entry and gets
+     * consumed there. The counter therefore cannot lose a nudge across the
+     * sleep boundary that the previous AbortController scheme had to guard
+     * against with a separate `hasPendingNudge` flag.
      */
     sleepInterruptible(ms) {
         if (this.shutdown)
             return Promise.resolve();
-        if (this.hasPendingNudge) {
-            this.hasPendingNudge = false;
+        if (this.nudgeSeq > this.observedSeq) {
+            this.observedSeq = this.nudgeSeq;
             return Promise.resolve();
         }
-        if (this.pollAbort?.signal.aborted) {
-            this.pollAbort = new AbortController();
-            return Promise.resolve();
-        }
-        this.pollAbort = this.pollAbort ?? new AbortController();
-        const signal = this.pollAbort.signal;
         return new Promise((resolve) => {
-            const onAbort = () => {
-                this.hasPendingNudge = false;
-                clearTimeout(timer);
-                resolve();
-            };
             const timer = setTimeout(() => {
-                signal.removeEventListener("abort", onAbort);
+                // Natural timer expiry. Clear the waiter ONLY if it still points
+                // at this resolver — defensive against a `nudgeWatcher()` /
+                // `stop()` that interleaved between `setTimeout` firing and this
+                // callback running (the race window is microscopic but real).
+                if (this.sleepWaiter?.resolve === resolve) {
+                    this.sleepWaiter = null;
+                }
                 resolve();
             }, ms);
-            signal.addEventListener("abort", onAbort, { once: true });
+            this.sleepWaiter = { resolve, timer };
         });
     }
     /**
@@ -828,6 +1083,30 @@ export class AgentScheduler {
             for (const item of delivery) {
                 insert.run(dispatchId, item.platform, item.channel, item.messageId ?? null, summary);
             }
+            // DM-HISTORY-CONTINUITY-FIX H-1 — also record the dispatch into
+            // `messages` via the shared channel-timeline path. `notification_log`
+            // remains the source of truth for delivery telemetry / retry dedup;
+            // `messages` is the source of truth for conversational continuity
+            // (consumed by `<conversation_history>` and the cross-session bridge
+            // when the owner replies). Wrapped in its own try/catch so a
+            // messages-write failure cannot mask an otherwise-successful DM:
+            // the user already received the message, we only lose history
+            // continuity for this single turn.
+            try {
+                recordProactiveForwardDeliveries({
+                    db: this.db,
+                    config: this.config,
+                    deliveries: delivery,
+                    content: row.task_description ?? "",
+                    dispatchId,
+                    dispatchIds: [dispatchId],
+                    originSessionIds: [],
+                    notificationType: "scheduled_dm",
+                });
+            }
+            catch (recErr) {
+                logger.warn({ err: recErr, taskId: row.id, dispatchId }, "Failed to record scheduled DM into messages — delivery already succeeded");
+            }
             this.db
                 .prepare("UPDATE agent_schedule SET status = 'completed' WHERE id = ?")
                 .run(row.id);