@aitne/daemon 0.1.7 → 0.1.9

package/dist/core/scheduler.js

@@ -1,11 +1,23 @@
 import cron from "node-cron";
 import { randomUUID } from "node:crypto";
-import { createEvent, EventPriority, formatSqliteDatetime, getAgentDayBoundsUtc, nowInTimezone, } from "@aitne/shared";
+import { createEvent, EventPriority, formatSqliteDatetime, getAgentDayBoundsUtc, getAgentDayDateStr, isBackendId, isProcessTier, nowInTimezone, } from "@aitne/shared";
 import { runRetentionCleanup } from "./retention.js";
 import { cleanupSessionWorkdir, cleanupStaleWorkdirs, getSessionWorkdirPath } from "./workdir.js";
 import { discardStalePendingSchedules } from "./schedule-maintenance.js";
 import { createLogger } from "../logging.js";
 import { reconcileRecurringSchedules } from "../db/recurring-schedules.js";
+import { recordAgentFiringBlocked } from "./agents/firing-blocked.js";
+import { getStalledMorningRoutineWake, readMorningRoutineStallThresholdMinutes, } from "../bootstrap/schedule-helpers.js";
+import { readRuntimeState, writeRuntimeState } from "../db/runtime-state.js";
+import { recordProactiveForwardDeliveries } from "./channel-timeline.js";
+import { isInQuietHoursAt, nextQuietHoursEndMs } from "./quiet-hours.js";
+/**
+ * Runtime-state key holding the agent-day date string (`YYYY-MM-DD`) on
+ * which the watchdog last sent an owner DM about the morning routine
+ * being stuck. Per-day dedup: the watchdog fires at most once per
+ * agent-day even if the cron tick that owns it runs every minute.
+ */
+const MORNING_ROUTINE_STALL_ALERT_KEY = "morning_routine.stall_alert_day";
 const logger = createLogger("scheduler");
 /**
  * True iff `intervalMinutes` cleanly fits inside an hour, so the firing
@@ -105,6 +117,29 @@ export function buildUserProfileSweepMorningCronExpr(dayBoundaryHour) {
  * track the same config knob in lockstep.
  */
 export const USER_PROFILE_SWEEP_EVENING_CRON_EXPR = "50 17 * * *";
+/**
+ * Cron expression for the daemon-side roadmap mechanical maintenance
+ * pass: fixed at 17:45 local — 15 min before Evening Review's fixed
+ * 18:00 and 5 min before the evening user-profile sweep at 17:50.
+ * The ordering matters: this job must release its lock before the
+ * surviving evening_review Step 2 (Long-term Plans promotion + Review:
+ * fire) acquires `roadmap_write_lock`. See
+ * `docs/design/appendices/evening-review-slimdown.md` §2.2.
+ */
+export const ROADMAP_MAINTENANCE_CRON_EXPR = "45 17 * * *";
+/**
+ * Cron expression for the BROWSER_HISTORY_INTEGRATION_PLAN §5.F2 P4a
+ * pre-morning digest: 60 min before the day boundary, wrapping
+ * backward across midnight (so `dayBoundaryHour = 4` → "0 3 * * *",
+ * `dayBoundaryHour = 0` → "0 23 * * *"). Extracted as a pure helper
+ * so the wrap arithmetic — identical in shape to
+ * `buildUserProfileSweepMorningCronExpr` but at the top of the hour —
+ * is asserted without standing up node-cron in tests.
+ */
+export function buildBrowserHistoryPreMorningDigestCronExpr(dayBoundaryHour) {
+    const hour = (dayBoundaryHour - 1 + 24) % 24;
+    return `0 ${hour} * * *`;
+}
 /**
  * AgentScheduler — manages recurring cron jobs and the DB-driven ScheduleWatcher.
  *
@@ -152,6 +187,31 @@ export class AgentScheduler {
      * morning flow reads it. The observer owns the run-once guard.
      */
     onContextIndexReconcile = null;
+    /**
+     * Evening-review slimdown §2.2 — daily mechanical roadmap.md
+     * maintenance pass at 17:45 local, 15 min before evening_review.
+     * Wraps `runRoadmapMechanicalMaintenance` so substeps 2a / 2b / 2d
+     * run in-process inside the daemon rather than inside a Sonnet
+     * routine that would otherwise re-derive the same date math. The
+     * callback is fire-and-forget (no return value contract): the
+     * implementation owns its own lock acquisition, audit emission, and
+     * agent/journal.md append.
+     */
+    onRoadmapMaintenance = null;
+    /**
+     * BROWSER_HISTORY_INTEGRATION_PLAN §5.F2 P4a — pre-morning digest
+     * builder. Fires at `dayBoundaryHour − 1` local each night so the
+     * morning Stage B journal reads a static `context/browser/yesterday-<date>.md`
+     * file (pre-warmed) rather than calling `GET /api/browser-history/
+     * yesterday-summary` at 04:00. The callback is deterministic Node
+     * code (no LLM in the path); the scheduler treats it as
+     * fire-and-forget like the roadmap-maintenance and context-index
+     * callbacks above. A failure here logs but never cascades into the
+     * 04:00 morning routine — the journal task-flow has a documented
+     * fallback to the `/api/browser-history/pre-morning-digest/{date}`
+     * endpoint.
+     */
+    onBrowserHistoryPreMorningDigest = null;
     /**
      * Setup gate — returns a skip reason when autonomous work should be
      * paused (initial setup incomplete, or setup conversation active).
@@ -162,26 +222,39 @@ export class AgentScheduler {
     autonomousGate = () => null;
     lastGateBlockLoggedAt = 0;
     /**
-     * Aborted by `stop()` to interrupt the ScheduleWatcher's between-poll sleep
-     * immediately. Without this, SIGTERM has to wait up to
-     * `schedulePollIntervalSeconds` before the loop notices `this.shutdown`.
-     *
-     * Also aborted by `nudgeWatcher()` so a freshly-INSERTed `agent_schedule`
-     * row with `scheduled_for = now` (e.g. the post-setup morning-routine wake)
-     * is picked up on the next event-loop tick instead of waiting up to a
-     * full poll interval. `sleepInterruptible` replaces the controller after
-     * consuming an abort so subsequent sleeps start fresh.
+     * AGENT_DEFINITIONS_DESIGN.md §7.1 — per-built-in enabled gate. Wired from
+     * the Phase-7 boot path via {@link setAgentEnabledCache}; until then (and in
+     * tests that construct a bare scheduler) it is `null` and the gate is a
+     * no-op, so disabling is opt-in and never accidentally stops a routine.
      */
-    pollAbort = null;
+    agentEnabledCache = null;
     /**
-     * Pending-nudge flag — set by `nudgeWatcher()` and consumed at the top of
-     * `sleepInterruptible`. Covers the race where `nudgeWatcher()` fires
-     * between two sleeps (after the previous sleep's abort listener cleared
-     * the flag, but before the next sleep is entered). The AbortController
-     * alone cannot carry this signal across sleeps because a fresh controller
-     * is created per sleep.
+     * Single source of truth for the ScheduleWatcher's between-poll wake
+     * signaling, unifying what was previously a (pollAbort: AbortController
+     * + hasPendingNudge: boolean) pair (v4.14 audit, Task #3).
+     *
+     * Mechanics:
+     *   - `nudgeSeq` is monotonically incremented by every `nudgeWatcher()`
+     *     call (and `stop()` reuses it to break the sleep too).
+     *   - `observedSeq` is advanced when a nudge has been consumed —
+     *     either at the top of `sleepInterruptible` (between-sleep case)
+     *     or by the resolver path inside `nudgeWatcher()` / `stop()` when
+     *     they wake an in-flight sleep.
+     *   - `sleepWaiter` holds the resolver + timer for the currently-pending
+     *     sleep, if any. The ScheduleWatcher loop awaits sequentially, so
+     *     at most one waiter exists at a time.
+     *
+     * Why this replaces the AbortController pair: with a monotonic counter
+     * we cannot lose a nudge across a sleep boundary — a `nudgeWatcher()`
+     * call that arrives between two sleeps simply leaves `nudgeSeq >
+     * observedSeq`, and the next sleep entry consumes it. The two-stage
+     * (flag + signal) scheme was correct on paper but required readers to
+     * trace the precise synchronous ordering of three branches in
+     * `sleepInterruptible`; the counter compresses that to one branch.
      */
-    hasPendingNudge = false;
+    nudgeSeq = 0;
+    observedSeq = 0;
+    sleepWaiter = null;
     constructor(eventBus, db, config) {
         this.eventBus = eventBus;
         this.db = db;
@@ -221,6 +294,28 @@ export class AgentScheduler {
     setContextIndexReconcilerCallback(fn) {
         this.onContextIndexReconcile = fn;
     }
+    /**
+     * Register the daily roadmap mechanical maintenance callback. Called
+     * at 17:45 local; the callback is fire-and-forget — it owns its own
+     * lock acquisition, validation, audit emission, and journal append.
+     * Failures are logged but do NOT cascade into the 18:00
+     * evening_review.
+     */
+    setRoadmapMaintenanceCallback(fn) {
+        this.onRoadmapMaintenance = fn;
+    }
+    /**
+     * Register the BROWSER_HISTORY_INTEGRATION_PLAN §5.F2 P4a
+     * pre-morning digest cron callback. Fires at `dayBoundaryHour − 1`
+     * local; the callback is fire-and-forget — it builds the digest
+     * from `browser_visits` / `browser_research_clusters` /
+     * `browser_pending_offers` and writes the markdown + JSON sidecar
+     * into the daemon-owned `context/browser/` directory. Failures
+     * inside the callback log but do not throw outward.
+     */
+    setBrowserHistoryPreMorningDigestCallback(fn) {
+        this.onBrowserHistoryPreMorningDigest = fn;
+    }
     /**
      * Register the autonomous-work gate. Returning null allows autonomous work;
      * any non-null string is treated as a skip reason and surfaced in logs.
@@ -228,6 +323,39 @@ export class AgentScheduler {
     setAutonomousGate(fn) {
         this.autonomousGate = fn;
     }
+    /**
+     * Wire the live built-in enabled cache (AGENT_DEFINITIONS_DESIGN.md §7.1).
+     * The loader watcher + the `PATCH /api/agents/:slug` handler call
+     * `cache.invalidate()` so the next firing re-queries the DB.
+     */
+    setAgentEnabledCache(cache) {
+        this.agentEnabledCache = cache;
+    }
+    /**
+     * Per-built-in enabled gate (§7.1), checked BEFORE `autonomousGate()` in
+     * every built-in routine's cron callback. Returns `true` to proceed; on a
+     * disabled Agent returns `false` and records a throttled `agent.firing_blocked`
+     * audit row (one per agent-day, then `detail.suppressed_count++` — §12.3). It
+     * is placed AFTER each callback's runtime gates (monthly last-day, hourly
+     * interval, skill-curation cadence) so a per-minute hourly tick that is not a
+     * real firing never inflates the suppressed count. A `null` cache (unwired /
+     * tests) always proceeds.
+     */
+    isAgentEnabledForFiring(slug, cronLabel) {
+        if (this.agentEnabledCache === null)
+            return true;
+        if (this.agentEnabledCache.isEnabled(slug))
+            return true;
+        try {
+            const agentDay = getAgentDayDateStr(this.config.timezone || undefined, this.config.dayBoundaryHour, new Date());
+            recordAgentFiringBlocked(this.db, { slug, agentDay, reason: "disabled" });
+        }
+        catch (err) {
+            logger.warn({ err, slug, cron: cronLabel }, "Failed to record agent.firing_blocked");
+        }
+        logger.debug({ slug, cron: cronLabel }, "Agent disabled — routine firing blocked");
+        return false;
+    }
     /** Log gate blocks at most once every 5 minutes to avoid spam. */
     logGateBlock(reason, context) {
         const now = Date.now();
@@ -236,6 +364,112 @@ export class AgentScheduler {
         this.lastGateBlockLoggedAt = now;
         logger.info({ ...context, reason }, "Autonomous work paused (setup gate)");
     }
+    /**
+     * In-process re-entrance mutex for the stall watchdog. The hourly cron
+     * fires the watchdog as a fire-and-forget promise; a slow `sendDm`
+     * (DM hub latency, owner channel reconnect) could overlap with the
+     * next hourly tick. Without serialization both invocations would pass
+     * the dedup-marker read (the marker isn't written until AFTER the DM
+     * succeeds, see below) and emit duplicate alerts. The mutex is
+     * process-local — fine, since a single scheduler instance is the only
+     * watchdog firing path.
+     */
+    morningStallWatchdogRunning = false;
+    /**
+     * Watchdog for the silent-stall pattern documented in the v4.14 audit
+     * (CLAUDE.md "morning_routine wake stall"). When the morning routine
+     * never writes an `agent_actions.result='success'` row, the dedup
+     * inside `queueMorningRoutineWake` keeps the stuck wake row pinned in
+     * `pending`/`running` and the hourly-check pre-routine gate silently
+     * skips every subsequent autonomous tick. The user gets no morning
+     * brief, no evening review, no hourly check, and no error — the
+     * system is functionally dead until the wake row clears.
+     *
+     * Detection: oldest `task_type='wake'` row tied to
+     * `routine='morning_routine'` older than the configured threshold (see
+     * `readMorningRoutineStallThresholdMinutes`) with no matching
+     * `agent_actions.result='success'` row in the current agent-day window.
+     *
+     * Delivery & dedup: DM-then-mark, NOT mark-then-DM. A failed DM (DM
+     * hub error, missing owner channel) leaves the marker empty so the
+     * next hourly tick retries. Repeat alerts on a chronically-broken DM
+     * channel are accepted as the lesser evil vs. a silent miss. The
+     * `morningStallWatchdogRunning` mutex serialises overlapping
+     * invocations so a slow DM cannot produce duplicate alerts.
+     *
+     * Fire-and-forget: returns nothing, surfaces all failures via logger.
+     * The owner DM is best-effort — a sendDm failure logs and does NOT
+     * re-throw, so a missing or broken message hub cannot cascade into a
+     * cron-callback exception.
+     */
+    async checkMorningRoutineStall(now) {
+        if (this.morningStallWatchdogRunning) {
+            logger.debug("Morning routine stall watchdog already running — skipping overlap");
+            return;
+        }
+        this.morningStallWatchdogRunning = true;
+        try {
+            let stalled;
+            try {
+                const thresholdMinutes = readMorningRoutineStallThresholdMinutes(this.db);
+                stalled = getStalledMorningRoutineWake(this.db, this.config, thresholdMinutes, now);
+            }
+            catch (err) {
+                logger.warn({ err }, "Morning routine stall watchdog query failed");
+                return;
+            }
+            if (!stalled)
+                return;
+            let today;
+            try {
+                today = getAgentDayDateStr(this.config.timezone || undefined, this.config.dayBoundaryHour, now);
+            }
+            catch (err) {
+                // getAgentDayDateStr can throw on invalid timezone config. Surface
+                // and bail rather than mis-key the dedup marker.
+                logger.warn({ err }, "Morning routine stall watchdog: agent-day resolution failed");
+                return;
+            }
+            const lastAlertDay = readRuntimeState(this.db, MORNING_ROUTINE_STALL_ALERT_KEY);
+            if (lastAlertDay === today) {
+                logger.debug({ today, stalledRowId: stalled.id, ageMinutes: stalled.ageMinutes }, "Morning routine stall watchdog already alerted today");
+                return;
+            }
+            logger.warn({
+                stalledRowId: stalled.id,
+                ageMinutes: stalled.ageMinutes,
+                status: stalled.status,
+                scheduledFor: stalled.scheduledFor,
+            }, "Morning routine stall detected — alerting owner");
+            if (!this.sendDm) {
+                logger.warn({ stalledRowId: stalled.id }, "Morning routine stall watchdog: sendDm callback not registered; will retry next tick");
+                return;
+            }
+            const message = `Aitne: morning routine stalled ${stalled.ageMinutes} min `
+                + `(wake #${stalled.id}, status=${stalled.status}). Hourly check + `
+                + `evening review blocked. Check logs or \`aitne restart\`.`;
+            try {
+                await this.sendDm(message);
+            }
+            catch (err) {
+                logger.warn({ err, stalledRowId: stalled.id }, "Morning routine stall watchdog: sendDm failed; dedup marker NOT set — next tick will retry");
+                return;
+            }
+            // Mark dedup ONLY after a successful DM. A persistence failure here
+            // would produce one duplicate DM on the next tick — acceptable, and
+            // strictly better than the alternative (alert lost forever on
+            // transient sendDm failures).
+            try {
+                writeRuntimeState(this.db, MORNING_ROUTINE_STALL_ALERT_KEY, today);
+            }
+            catch (err) {
+                logger.warn({ err }, "Morning routine stall watchdog: failed to persist dedup marker; next tick may re-alert");
+            }
+        }
+        finally {
+            this.morningStallWatchdogRunning = false;
+        }
+    }
     start() {
         this.setupRecurringJobs();
         this.startScheduleWatcher();
@@ -243,9 +477,12 @@ export class AgentScheduler {
     }
     stop() {
         this.shutdown = true;
-        // Wake up the ScheduleWatcher's poll sleep so the loop returns immediately
-        // instead of waiting for the next interval tick.
-        this.pollAbort?.abort();
+        // Wake up the ScheduleWatcher's poll sleep so the loop returns
+        // immediately instead of waiting for the next interval tick. The
+        // sleepInterruptible body re-checks `shutdown` before re-entering
+        // its `new Promise` block, so simply resolving any in-flight waiter
+        // is enough — no need to broadcast through the nudge counter.
+        this.consumeWaiter();
         this.stopCronJobs();
         logger.info("Scheduler stopped");
     }
@@ -256,17 +493,35 @@ export class AgentScheduler {
      *
      * Safe to call any time after `start()` (and a no-op before): the public
      * surface is idempotent — multiple rapid calls coalesce into a single
-     * extra wake at the next sleep boundary. The pending-nudge flag covers
-     * the race where this method is invoked between sleeps; `sleepInterruptible`
-     * consumes it at the top of the next sleep cycle.
+     * extra wake at the next sleep boundary. Between-sleep nudges land on
+     * the monotonic `nudgeSeq` counter and are consumed at the top of the
+     * next `sleepInterruptible`; in-flight nudges resolve the active
+     * waiter directly. Both paths advance `observedSeq` so a single nudge
+     * skips exactly one sleep, never two.
      *
      * Wired today from `queueMorningRoutineWake` (post-setup, post-Google-auth,
      * catchup); other `INSERT INTO agent_schedule` sites use future-dated rows
      * and do not need a nudge.
      */
     nudgeWatcher() {
-        this.hasPendingNudge = true;
-        this.pollAbort?.abort();
+        this.nudgeSeq += 1;
+        if (this.sleepWaiter) {
+            this.observedSeq = this.nudgeSeq;
+            this.consumeWaiter();
+        }
+    }
+    /**
+     * Resolve and clear the active `sleepWaiter`, if any. Used by both
+     * `stop()` and `nudgeWatcher()` to break a running sleep. Safe to call
+     * when no waiter exists — it's a no-op.
+     */
+    consumeWaiter() {
+        const waiter = this.sleepWaiter;
+        if (!waiter)
+            return;
+        this.sleepWaiter = null;
+        clearTimeout(waiter.timer);
+        waiter.resolve();
     }
     /** Hot-reload cron schedules (e.g. after dayBoundaryHour changes) */
     reloadCrons() {
@@ -285,6 +540,8 @@ export class AgentScheduler {
         // Morning Routine: daily at dayBoundaryHour (default 04:00)
         // Order: day boundary callback (DM summarize) → morning routine → cleanup
         const morningJob = cron.schedule(`0 ${this.config.dayBoundaryHour} * * *`, () => {
+            if (!this.isAgentEnabledForFiring("morning-routine", "morning_routine"))
+                return;
             const gateReason = this.autonomousGate();
             if (gateReason !== null) {
                 this.logGateBlock(gateReason, { cron: "morning_routine" });
@@ -306,6 +563,8 @@ export class AgentScheduler {
         this.cronJobs.push(morningJob);
         // Evening Review: daily at 18:00
         const eveningJob = cron.schedule("0 18 * * *", () => {
+            if (!this.isAgentEnabledForFiring("evening-review", "evening_review"))
+                return;
             const gateReason = this.autonomousGate();
             if (gateReason !== null) {
                 this.logGateBlock(gateReason, { cron: "evening_review" });
@@ -320,6 +579,8 @@ export class AgentScheduler {
         // user/profile.md when it loads <user>. See USER-PROFILE-CAPTURE-PLAN.md
         // §Phase 2.
         const sweepMorningJob = cron.schedule(buildUserProfileSweepMorningCronExpr(this.config.dayBoundaryHour), () => {
+            if (!this.isAgentEnabledForFiring("user-profile-sweep-morning", "user_profile_sweep_morning"))
+                return;
             const gateReason = this.autonomousGate();
             if (gateReason !== null) {
                 this.logGateBlock(gateReason, { cron: "user_profile_sweep_morning" });
@@ -333,6 +594,8 @@ export class AgentScheduler {
         // * * *". If Evening Review ever becomes time-configurable, this
         // cron must track the same config knob in lockstep.
         const sweepEveningJob = cron.schedule(USER_PROFILE_SWEEP_EVENING_CRON_EXPR, () => {
+            if (!this.isAgentEnabledForFiring("user-profile-sweep-evening", "user_profile_sweep_evening"))
+                return;
             const gateReason = this.autonomousGate();
             if (gateReason !== null) {
                 this.logGateBlock(gateReason, { cron: "user_profile_sweep_evening" });
@@ -341,9 +604,37 @@ export class AgentScheduler {
             this.emitRoutine("user_profile_sweep", { phase: "evening" });
         }, { timezone: tz });
         this.cronJobs.push(sweepEveningJob);
-        // Weekly Review: Friday at 18:00
+        // Roadmap mechanical maintenance (evening-review slimdown §2.2):
+        // 17:45 local, 15 min before evening_review's 18:00 fire. Runs the
+        // typed in-process pass (substeps 2a / 2b / 2d) that legacy
+        // evening_review used to do via a Sonnet routine. The job is gated
+        // by `autonomousGate` like every other autonomous cron, but
+        // intentionally does NOT inherit the `morning_routine_pending_for_today`
+        // skip — mechanical roadmap maintenance is independent of whether
+        // the morning routine ran, and inheriting the gate would block
+        // maintenance on the very days the operator needs roadmap.md to
+        // stay clean.
+        const roadmapMaintenanceJob = cron.schedule(ROADMAP_MAINTENANCE_CRON_EXPR, () => {
+            if (!this.isAgentEnabledForFiring("roadmap-maintenance", "roadmap_maintenance"))
+                return;
+            const gateReason = this.autonomousGate();
+            if (gateReason !== null) {
+                this.logGateBlock(gateReason, { cron: "roadmap_maintenance" });
+                return;
+            }
+            try {
+                this.onRoadmapMaintenance?.();
+            }
+            catch (err) {
+                logger.warn({ err }, "Roadmap maintenance callback threw");
+            }
+        }, { timezone: tz });
+        this.cronJobs.push(roadmapMaintenanceJob);
+        // Weekly Review: Friday at 19:00 (one hour after evening_review)
         // Emits a separate routine event so the prompt can generate weekly/YYYY-Www.md
-        const weeklyJob = cron.schedule("0 18 * * 5", () => {
+        const weeklyJob = cron.schedule("0 19 * * 5", () => {
+            if (!this.isAgentEnabledForFiring("weekly-review", "weekly_review"))
+                return;
             const gateReason = this.autonomousGate();
             if (gateReason !== null) {
                 this.logGateBlock(gateReason, { cron: "weekly_review" });
@@ -354,13 +645,26 @@ export class AgentScheduler {
         this.cronJobs.push(weeklyJob);
         // Monthly Review: last day of month at 18:00
         // node-cron doesn't directly support "last day of month",
-        // so we run daily at 18:00 and check if tomorrow is the 1st
+        // so we run daily at 18:00 and check if tomorrow is the 1st.
+        //
+        // Default OFF pre-release (see runtime-settings.ts:monthlyReviewEnabled).
+        // The cron is always registered, but the callback consults
+        // `this.config.monthlyReviewEnabled` at fire time so a runtime PATCH
+        // takes effect on the next month-end without restart — that is also
+        // why this key is intentionally absent from SCHEDULE_KEYS in
+        // dashboard/config.ts (no cron rebuild needed). The routine itself
+        // (task-flow, context-builder branch, retention coupling) stays in
+        // tree as a concept pending the Mirror+Prune redesign.
         const monthlyJob = cron.schedule("0 18 * * *", () => {
+            if (!this.config.monthlyReviewEnabled)
+                return;
             // Check if tomorrow (in configured timezone) is the 1st
             const tomorrow = new Date();
             tomorrow.setDate(tomorrow.getDate() + 1);
             const tomorrowLocal = nowInTimezone(tz, tomorrow);
             if (tomorrowLocal.day === 1) {
+                if (!this.isAgentEnabledForFiring("monthly-review", "monthly_review"))
+                    return;
                 const gateReason = this.autonomousGate();
                 if (gateReason !== null) {
                     this.logGateBlock(gateReason, { cron: "monthly_review" });
@@ -378,6 +682,8 @@ export class AgentScheduler {
         const reconcilerHour = (this.config.dayBoundaryHour + 23) % 24;
         const reconcilerCron = `45 ${reconcilerHour} * * *`;
         const reconcilerJob = cron.schedule(reconcilerCron, () => {
+            if (!this.isAgentEnabledForFiring("context-index-reconcile", "context_index_reconcile"))
+                return;
             const gateReason = this.autonomousGate();
             if (gateReason !== null) {
                 this.logGateBlock(gateReason, { cron: "context_index_reconcile" });
@@ -391,6 +697,34 @@ export class AgentScheduler {
             }
         }, { timezone: tz });
         this.cronJobs.push(reconcilerJob);
+        // BROWSER_HISTORY_INTEGRATION_PLAN §5.F2 Stage 1 — pre-morning
+        // digest at `dayBoundaryHour − 1` (default 03:00 when
+        // `dayBoundaryHour=4`). Same hour as the context-index reconciler
+        // above (03:45) but at :00 instead of :45 so the digest's snapshot
+        // is taken BEFORE the reconciler nudges the prompt context — the
+        // morning routine's task-flow then sees both the reconciled index
+        // AND the freshly-written digest in its first turn.
+        //
+        // Gated by `autonomousGate` like every other autonomous cron;
+        // setup-incomplete + setup-active states pause the build.
+        // Fire-and-forget: the callback handles its own failure logging
+        // (see `safeRunPreMorningDigestJob`), and any uncaught throw lands
+        // in the local catch block here rather than escaping the cron.
+        const browserDigestCron = buildBrowserHistoryPreMorningDigestCronExpr(this.config.dayBoundaryHour);
+        const browserDigestJob = cron.schedule(browserDigestCron, () => {
+            const gateReason = this.autonomousGate();
+            if (gateReason !== null) {
+                this.logGateBlock(gateReason, { cron: "browser_history_pre_morning_digest" });
+                return;
+            }
+            try {
+                this.onBrowserHistoryPreMorningDigest?.();
+            }
+            catch (err) {
+                logger.warn({ err }, "browser-history pre-morning digest callback threw");
+            }
+        }, { timezone: tz });
+        this.cronJobs.push(browserDigestJob);
         if (this.config.hourlyCheckEnabled) {
             const hourlyExpr = buildHourlyCronExpr(this.config.hourlyCheckIntervalMinutes, this.config.hourlyCheckActiveStartHour, this.config.hourlyCheckActiveEndHour);
             const hourlyJob = cron.schedule(hourlyExpr, () => {
@@ -413,6 +747,10 @@ export class AgentScheduler {
                 if (!shouldFireHourlyTickAt(local.hours, local.minutes, this.config.hourlyCheckIntervalMinutes, this.config.hourlyCheckActiveStartHour)) {
                     return;
                 }
+                // Per-built-in enabled gate, AFTER the interval gate so a
+                // per-minute non-firing tick never inflates the suppressed count.
+                if (!this.isAgentEnabledForFiring("hourly-check", "hourly_check"))
+                    return;
                 // triggerHourlyCheck has its own setup gate, but short-circuit
                 // here to avoid the in-progress flag toggling for no reason.
                 const gateReason = this.autonomousGate();
@@ -431,6 +769,13 @@ export class AgentScheduler {
                         logger.warn({ err }, "Auth probe callback failed");
                     });
                 }
+                // Morning-routine stall watchdog. Runs alongside the auth probe
+                // because both are observability hooks that should fire even
+                // when the hourly check itself gets gated (e.g., the gate
+                // skip is the *symptom* the watchdog needs to catch).
+                void this.checkMorningRoutineStall(now).catch((err) => {
+                    logger.warn({ err }, "Morning routine stall watchdog threw");
+                });
                 if (this.onHourlyCheck) {
                     void this.onHourlyCheck("cron");
                 }
@@ -458,6 +803,8 @@ export class AgentScheduler {
                     logger.debug({ cadence }, "skill_curation cadence interval not elapsed yet");
                     return;
                 }
+                if (!this.isAgentEnabledForFiring("skill-curation", "skill_curation"))
+                    return;
                 const gateReason = this.autonomousGate();
                 if (gateReason !== null) {
                     this.logGateBlock(gateReason, { cron: "skill_curation" });
@@ -537,18 +884,45 @@ export class AgentScheduler {
                     postCatchupHourlyCheck: mergedHourlyCheck,
                     importance: "low",
                 };
+                // Bump `scheduled_for` forward when the new caller's NOW lies
+                // after the existing row's stored timestamp. Closes a narrow but
+                // silent race around the agent-day boundary:
+                //
+                //   - existing wake row was inserted just before the boundary
+                //     (e.g. 03:59:59 local) with `scheduled_for = 03:59:59`;
+                //   - this caller (the 04:00 cron, or any post-boundary trigger)
+                //     dedup-merges instead of inserting;
+                //   - without bumping `scheduled_for`, the merged row keeps the
+                //     pre-boundary timestamp and the next ScheduleWatcher tick
+                //     marks it `skipped` via `discardStalePendingSchedules`
+                //     (which discards `pending` rows with `scheduled_for <
+                //     currentAgentDayStartUtc`), silently losing the wake.
+                //
+                // `MAX(scheduled_for, ?)` keeps legitimate future-dated retry
+                // rows (scheduleMorningRetry inserts with a +5/10/15 min back-
+                // off) at their original time — the retry chain's exponential
+                // back-off is preserved. Only past-dated rows get pulled forward,
+                // which is exactly the boundary-race shape this guards against.
+                // Both timestamps are produced by `formatSqliteDatetime` (the
+                // `YYYY-MM-DD HH:MM:SS` zero-padded form), so SQLite's string
+                // comparison ranks them chronologically.
                 this.db
                     .prepare(`UPDATE agent_schedule
-                SET task_context = ?
+                SET task_context = ?,
+                    scheduled_for = MAX(scheduled_for, ?)
               WHERE id = ?`)
-                    .run(JSON.stringify(mergedContext), existing.id);
+                    .run(JSON.stringify(mergedContext), scheduledFor, existing.id);
                 return { inserted: false, existingId: existing.id };
             }
+            const morningInstruction = "Morning routine. Generate today.md and register the day schedule.";
             this.db
                 .prepare(`INSERT INTO agent_schedule
-             (scheduled_for, task_type, task_description, task_context, correlation_id, model, status)
-           VALUES (?, 'wake', ?, ?, ?, NULL, 'pending')`)
-                .run(scheduledFor, "Morning routine. Generate today.md and register the day schedule.", taskContext, wakeEvent.correlationId);
+             (scheduled_for, task_type, task_description, task_prompt, task_context, correlation_id, model, status)
+           VALUES (?, 'wake', ?, ?, ?, ?, NULL, 'pending')`)
+                .run(scheduledFor, 
+            // task_description (list label) doubles as task_prompt (agent
+            // instruction) for this system-generated row.
+            morningInstruction, morningInstruction, taskContext, wakeEvent.correlationId);
             return { inserted: true };
         });
         const result = insertTxn();
@@ -574,7 +948,6 @@ export class AgentScheduler {
      * UPDATE ... SET status='running' WHERE status='pending' succeeds.
      */
     startScheduleWatcher() {
-        this.pollAbort = new AbortController();
         const loop = async () => {
             while (!this.shutdown) {
                 try {
@@ -638,28 +1011,146 @@ export class AgentScheduler {
                                 });
                                 const event = {
                                     ...base,
-                                    // task_prompt overrides task_description as the agent body
-                                    // when set; falls back to the description otherwise.
-                                    task: row.task_prompt ?? row.task_description,
+                                    // task_prompt is the agent body. Every insert site sets it
+                                    // (and a backfill migration filled legacy rows), so the old
+                                    // `?? task_description` fallback is gone; `?? ""` is only a
+                                    // null-type guard that never fires in practice.
+                                    task: row.task_prompt ?? "",
                                     taskContext: JSON.parse(row.task_context ?? "{}"),
                                     correlationId: row.correlation_id ?? base.correlationId,
                                     scheduleId: row.id,
-                                    // `agent_schedule.model` is operator-supplied. If it matches
-                                    // the binary `requestedModel` shape ("sonnet" / "opus") use
-                                    // that; otherwise pass the literal model id through
-                                    // `requestedModelId` so non-Claude rows (e.g. "haiku",
-                                    // "gpt-5.5", "gemini-2.5-flash") aren't silently demoted to
-                                    // Sonnet by the legacy two-tier coercion.
+                                    // Tier override takes precedence over the legacy model
+                                    // field at dispatch (the dispatcher inspects
+                                    // requestedTier ahead of requestedModel). The schema
+                                    // CHECK already constrains the column to lite/medium/high,
+                                    // so the in-cast is safe.
+                                    ...(isProcessTier(row.tier_override)
+                                        ? { requestedTier: row.tier_override }
+                                        : {}),
+                                    // `agent_schedule.model` is operator-supplied. Four
+                                    // resolution branches (SCHEDULE_API_REDESIGN_PLAN §4.3a;
+                                    // branch 3 added 2026-06-01 —
+                                    // AGENT_DEFINITIONS_KNOWN_LIMITATIONS §1):
+                                    //   1. legacy alias 'sonnet' / 'opus' → `requestedModel`
+                                    //   2. registered model id paired with backend_id →
+                                    //      emit BOTH `requestedBackendId` and
+                                    //      `requestedModelId` so the dispatcher's override
+                                    //      block fires with an exact model pin.
+                                    //   3. backend_id WITHOUT a model → emit
+                                    //      `requestedBackendId` alone. resolveBinding's
+                                    //      backend-only branch resolves the model from the
+                                    //      row's tier / the backend default, so an engine-only
+                                    //      pin ("run this on codex") routes to that engine
+                                    //      instead of being silently dropped.
+                                    //   4. model present but backend_id NULL (legacy rows or
+                                    //      pure-tier rows) → fall through to no-override so
+                                    //      the row resolves via process-key defaults.
                                     ...(row.model === "sonnet" || row.model === "opus"
                                         ? { requestedModel: row.model }
-                                        : row.model
-                                            ? { requestedModelId: row.model }
-                                            : {}),
+                                        : row.model && row.backend_id && isBackendId(row.backend_id)
+                                            ? { requestedBackendId: row.backend_id, requestedModelId: row.model }
+                                            : row.backend_id && isBackendId(row.backend_id)
+                                                ? { requestedBackendId: row.backend_id }
+                                                : {}),
                                 };
                                 await this.eventBus.put(event);
                                 logger.info({ taskId: row.id, taskType: row.task_type }, "Scheduled DM session dispatched");
                                 continue;
                             }
+                            // BROWSER_TASK_REDESIGN_PLAN.md §6.2 + §12 Q#5 — open-ended
+                            // browser sub-agent firing at its scheduled time. The body
+                            // of the original POST lives in `task_context` (frozen at
+                            // schedule time); the dispatcher's `scheduled.browser_task`
+                            // handler is responsible for creating the `browser_task`
+                            // row at fire time and handing off to the runner.
+                            //
+                            // Quiet-hours deferral: when `browserTaskRespectQuietHours`
+                            // is true (default) and the current wall-clock instant is
+                            // inside the configured quiet-hours window, the row is
+                            // pushed forward to the next quiet-hours-end boundary
+                            // instead of being dispatched. One `agent_actions` audit
+                            // row is written per deferral so the user can see the
+                            // delay; the row's status is reverted to `pending` so
+                            // the next ScheduleWatcher tick re-evaluates.
+                            if (row.task_type === "browser_task") {
+                                const fireAt = new Date();
+                                const respectQuietHours = this.config.browserTaskRespectQuietHours !== false;
+                                if (respectQuietHours) {
+                                    const quietHoursWindow = {
+                                        start: this.config.quietHoursStart,
+                                        end: this.config.quietHoursEnd,
+                                        timezone: this.config.timezone || undefined,
+                                    };
+                                    if (isInQuietHoursAt(fireAt, quietHoursWindow)) {
+                                        const deferUntilMs = nextQuietHoursEndMs(fireAt, quietHoursWindow);
+                                        if (deferUntilMs !== null) {
+                                            const deferredFor = formatSqliteDatetime(new Date(deferUntilMs));
+                                            this.db
+                                                .prepare(`UPDATE agent_schedule
+                              SET scheduled_for = ?, status = 'pending'
+                            WHERE id = ?`)
+                                                .run(deferredFor, row.id);
+                                            try {
+                                                this.db
+                                                    .prepare(`INSERT INTO agent_actions
+                               (action_type, detail, result, started_at, completed_at)
+                             VALUES (?, ?, 'success', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`)
+                                                    .run("browser_task.deferred_for_quiet_hours", JSON.stringify({
+                                                    scheduleId: row.id,
+                                                    originalScheduledFor: row.scheduled_for,
+                                                    deferredUntil: deferredFor,
+                                                    quietHoursStart: this.config.quietHoursStart,
+                                                    quietHoursEnd: this.config.quietHoursEnd,
+                                                }));
+                                            }
+                                            catch (auditErr) {
+                                                /* c8 ignore start -- defensive against schema partials */
+                                                logger.warn({ err: auditErr, scheduleId: row.id }, "Failed to record browser_task.deferred_for_quiet_hours audit");
+                                                /* c8 ignore stop */
+                                            }
+                                            logger.info({
+                                                scheduleId: row.id,
+                                                deferredUntil: deferredFor,
+                                                quietHoursStart: this.config.quietHoursStart,
+                                                quietHoursEnd: this.config.quietHoursEnd,
+                                            }, "scheduled.browser_task deferred for quiet hours");
+                                            continue;
+                                        }
+                                        // `nextQuietHoursEndMs` returning null inside a quiet-
+                                        // hours predicate that just returned true would mean
+                                        // a 24-hour window — the runtime-settings schema
+                                        // disallows this (equal start/end short-circuits the
+                                        // predicate), so it cannot occur in normal operation.
+                                        // Fall through to dispatch rather than re-deferring
+                                        // forever.
+                                    }
+                                }
+                                const base = createEvent({
+                                    type: "scheduled.browser_task",
+                                    source: row.task_type,
+                                    priority: EventPriority.NORMAL,
+                                });
+                                let parsedContext;
+                                try {
+                                    parsedContext = JSON.parse(row.task_context ?? "{}");
+                                }
+                                catch (parseErr) {
+                                    logger.error({ err: parseErr, scheduleId: row.id }, "scheduled.browser_task: task_context JSON parse failed — marking row failed");
+                                    this.db
+                                        .prepare("UPDATE agent_schedule SET status = 'failed' WHERE id = ? AND status = 'running'")
+                                        .run(row.id);
+                                    continue;
+                                }
+                                const event = {
+                                    ...base,
+                                    taskContext: parsedContext,
+                                    correlationId: row.correlation_id ?? base.correlationId,
+                                    scheduleId: row.id,
+                                };
+                                await this.eventBus.put(event);
+                                logger.info({ scheduleId: row.id, taskType: row.task_type }, "Scheduled browser-task dispatched");
+                                continue;
+                            }
                             const base = createEvent({
                                 type: "scheduled.task",
                                 source: row.task_type,
@@ -680,26 +1171,38 @@ export class AgentScheduler {
                                 : undefined;
                             const event = {
                                 ...base,
-                                // task_prompt overrides task_description as the agent body
-                                // when set; falls back to the description otherwise.
-                                task: row.task_prompt ?? row.task_description,
+                                // task_prompt is the agent body. Every insert site sets it
+                                // (and a backfill migration filled legacy rows), so the old
+                                // `?? task_description` fallback is gone; `?? ""` is only a
+                                // null-type guard that never fires in practice.
+                                task: row.task_prompt ?? "",
                                 taskContext: parsedTaskContext,
                                 correlationId: row.correlation_id ?? base.correlationId,
                                 scheduleId: row.id,
                                 ...(liftedReplyTarget
                                     ? { data: { ...base.data, reply_target: liftedReplyTarget } }
                                     : {}),
-                                // `agent_schedule.model` is operator-supplied. If it matches
-                                // the binary `requestedModel` shape ("sonnet" / "opus") use
-                                // that; otherwise pass the literal model id through
-                                // `requestedModelId` so non-Claude rows (e.g. "haiku",
-                                // "gpt-5.5", "gemini-2.5-flash") aren't silently demoted to
-                                // Sonnet by the legacy two-tier coercion.
+                                // Tier override takes precedence over the legacy model
+                                // field at dispatch (the dispatcher inspects
+                                // requestedTier ahead of requestedModel). The schema
+                                // CHECK already constrains the column to lite/medium/high.
+                                ...(isProcessTier(row.tier_override)
+                                    ? { requestedTier: row.tier_override }
+                                    : {}),
+                                // `agent_schedule.model` is operator-supplied. See the
+                                // scheduled.dm branch above (SCHEDULE_API_REDESIGN_PLAN
+                                // §4.3a) for the four resolution branches. Same shape — a
+                                // registered full model id pairs with `backend_id`; a
+                                // standalone `backend_id` (no model) emits `requestedBackendId`
+                                // alone (resolveBinding fills the model from tier / default);
+                                // a model with no backend_id falls through to defaults.
                                 ...(row.model === "sonnet" || row.model === "opus"
                                     ? { requestedModel: row.model }
-                                    : row.model
-                                        ? { requestedModelId: row.model }
-                                        : {}),
+                                    : row.model && row.backend_id && isBackendId(row.backend_id)
+                                        ? { requestedBackendId: row.backend_id, requestedModelId: row.model }
+                                        : row.backend_id && isBackendId(row.backend_id)
+                                            ? { requestedBackendId: row.backend_id }
+                                            : {}),
                             };
                             await this.eventBus.put(event);
                             logger.info({ taskId: row.id, taskType: row.task_type }, "Scheduled task dispatched");
@@ -741,50 +1244,47 @@ export class AgentScheduler {
         void loop();
     }
     /**
-     * Sleep for `ms` milliseconds, but resolve early if `pollAbort` aborts.
-     * Used by the ScheduleWatcher between polls so `stop()` and
-     * `nudgeWatcher()` can interrupt it.
+     * Sleep for `ms` milliseconds, but resolve early when `stop()` or
+     * `nudgeWatcher()` fire. Used by the ScheduleWatcher between polls so
+     * shutdown / "wake now" signals interrupt the wait.
      *
-     * Resolution order:
+     * Resolution order (single linear sequence — no branch fan-out):
      *   1. `shutdown` → immediate resolve.
-     *   2. pending nudge flag (set by `nudgeWatcher()` while we were processing
-     *      the previous batch) → consume and immediate resolve.
-     *   3. existing controller already aborted (legacy `stop()` contract, plus
-     *      the in-flight `nudgeWatcher()` path where `onAbort` already
-     *      consumed the flag) → replace controller and immediate resolve so
-     *      the next sleep starts fresh.
-     *   4. otherwise wait for either the timer or a fresh abort.
+     *   2. `nudgeSeq > observedSeq` → consume + immediate resolve. Covers
+     *      every nudge that arrived while no sleep was active (before the
+     *      first sleep ever ran, or between two consecutive sleeps).
+     *   3. otherwise install a `sleepWaiter` with a setTimeout and wait;
+     *      the resolver is invoked either by the timer or by a subsequent
+     *      `stop()` / `nudgeWatcher()` via `consumeWaiter()`.
      *
-     * Controller lifecycle: a new `AbortController` is installed on entry to
-     * step 4 so a previous abort cannot make this sleep return instantly.
-     * `nudgeWatcher()` always sets `hasPendingNudge` BEFORE calling `abort()`
-     * — the synchronous order is what closes the race against this method
-     * reading `pollAbort` and installing listeners.
+     * Invariant: `observedSeq` only advances on consumption, so a `nudgeSeq`
+     * bump that arrives during the active sleep is observed by the caller
+     * (`nudgeWatcher`) which advances `observedSeq` AND resolves the waiter
+     * in the same synchronous block. A bump that arrives between sleeps is
+     * still visible (`nudgeSeq > observedSeq`) on the next entry and gets
+     * consumed there. The counter therefore cannot lose a nudge across the
+     * sleep boundary that the previous AbortController scheme had to guard
+     * against with a separate `hasPendingNudge` flag.
      */
     sleepInterruptible(ms) {
         if (this.shutdown)
             return Promise.resolve();
-        if (this.hasPendingNudge) {
-            this.hasPendingNudge = false;
-            return Promise.resolve();
-        }
-        if (this.pollAbort?.signal.aborted) {
-            this.pollAbort = new AbortController();
+        if (this.nudgeSeq > this.observedSeq) {
+            this.observedSeq = this.nudgeSeq;
             return Promise.resolve();
         }
-        this.pollAbort = this.pollAbort ?? new AbortController();
-        const signal = this.pollAbort.signal;
         return new Promise((resolve) => {
-            const onAbort = () => {
-                this.hasPendingNudge = false;
-                clearTimeout(timer);
-                resolve();
-            };
             const timer = setTimeout(() => {
-                signal.removeEventListener("abort", onAbort);
+                // Natural timer expiry. Clear the waiter ONLY if it still points
+                // at this resolver — defensive against a `nudgeWatcher()` /
+                // `stop()` that interleaved between `setTimeout` firing and this
+                // callback running (the race window is microscopic but real).
+                if (this.sleepWaiter?.resolve === resolve) {
+                    this.sleepWaiter = null;
+                }
                 resolve();
             }, ms);
-            signal.addEventListener("abort", onAbort, { once: true });
+            this.sleepWaiter = { resolve, timer };
         });
     }
     /**
@@ -828,6 +1328,30 @@ export class AgentScheduler {
             for (const item of delivery) {
                 insert.run(dispatchId, item.platform, item.channel, item.messageId ?? null, summary);
             }
+            // DM-HISTORY-CONTINUITY-FIX H-1 — also record the dispatch into
+            // `messages` via the shared channel-timeline path. `notification_log`
+            // remains the source of truth for delivery telemetry / retry dedup;
+            // `messages` is the source of truth for conversational continuity
+            // (consumed by `<conversation_history>` and the cross-session bridge
+            // when the owner replies). Wrapped in its own try/catch so a
+            // messages-write failure cannot mask an otherwise-successful DM:
+            // the user already received the message, we only lose history
+            // continuity for this single turn.
+            try {
+                recordProactiveForwardDeliveries({
+                    db: this.db,
+                    config: this.config,
+                    deliveries: delivery,
+                    content: row.task_description ?? "",
+                    dispatchId,
+                    dispatchIds: [dispatchId],
+                    originSessionIds: [],
+                    notificationType: "scheduled_dm",
+                });
+            }
+            catch (recErr) {
+                logger.warn({ err: recErr, taskId: row.id, dispatchId }, "Failed to record scheduled DM into messages — delivery already succeeded");
+            }
             this.db
                 .prepare("UPDATE agent_schedule SET status = 'completed' WHERE id = ?")
                 .run(row.id);
@@ -974,4 +1498,3 @@ function isCadenceIntervalElapsed(db, cadence) {
         return true;
     }
 }
-//# sourceMappingURL=scheduler.js.map