@capybara-hq/kernel 0.1.0-rc.23 → 0.1.0-rc.25

package/dist/schedules/scan.job.js

@@ -8,31 +8,22 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { randomUUID } from "node:crypto";
-import { getQueueToken } from "@nestjs/bullmq";
 import { Inject, Injectable } from "@nestjs/common";
-import { sql } from "kysely";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
-import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { LockService } from "../infra/lock/lock.service.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { LockedCron } from "../infra/schedule/locked-cron.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
-import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
 import { readScheduleSettings } from "./effective-settings.js";
-import { SCHED_SCAN_JOB, schedFireJob } from "./job-ids.js";
+import { oweSchedFire, oweSchedSettleUnfired, SCHED_SCAN_JOB } from "./job-ids.js";
 import { pauseTaskIn } from "./pause.js";
-import { lockTaskRow, ScheduledTaskRunTracker } from "./run-tracker.js";
-import { dueTicks, nextTick } from "./schedule-math.js";
+import { scanStep } from "./schedule-math.js";
 import { ScheduledTaskStore } from "./store.js";
 /** Due tasks per scan; what is left waits for the next minute. */
 const MAX_TASKS = 2000;
-/** A pending task run never fired this long after its tick: its fire job is enqueued again. */
-const REPAIR_AFTER_MS = 10 * 60_000;
-/** ... and this long after its tick it is given up (`skipped`, `missed`). */
-const GIVE_UP_AFTER_MS = 60 * 60_000;
-const REPAIR_BATCH = 100;
 /**
  * The schedule math could not evaluate a due task's stored trigger (its transaction rolled back);
  * the scan pauses it. Only the math raises it: a database error fails the scan pass instead (the
@@ -51,32 +42,28 @@ class TaskScanFailed extends Error {
  * same task): the ticks missed outside the org's `catchUpWindowMinutes` become one `skipped` run
  * (`missed`, at the first missed tick), the latest tick in the window gets its run (the unique
  * `(task_id, scheduled_for)` key makes a second insert a no-op), `next_run_at` moves to the next
- * tick plus the task's jitter (or a `once` task ends, or one past its `expires_at`), and after the
- * commit `sched-fire-<taskRunId>` is enqueued. A task whose stored trigger the schedule math cannot
- * evaluate is paused (`invalid_schedule`) instead of failing the scan; a database error fails the
- * pass (the next minute retries) and pauses nothing.
- *
- * Then the repair: a run still `pending` and unfired 10 minutes after its tick has its fire job
- * enqueued again, and is given up (`skipped`, `missed`) after an hour; a run fired an hour ago and
- * still `pending` (its start failed for good) goes through the run tracker's check, which links,
- * settles or releases it, so a `once` task's last run never stays pending.
+ * tick plus the task's jitter (or a `once` task ends, or one past its `expires_at`), and the same
+ * transaction owes `sched-fire-<taskRunId>` (transactional outbox spec §8.1), so a written tick is
+ * never left unfired and the scan needs no repair of lost fire jobs (a fire delivered too late
+ * marks its tick missed itself, `ScheduledTaskFirer`), and the run's unfired settle check (a fire
+ * job that failed for good before its claim: the tick is missed, `job-ids.ts`). A task whose stored trigger the schedule
+ * math cannot evaluate is paused (`invalid_schedule`) instead of failing the scan; a database
+ * error fails the pass (the next minute retries) and pauses nothing.
  */
 let ScheduledTaskScanJob = class ScheduledTaskScanJob {
     kdb;
     txHost;
     config;
     store;
-    tracker;
-    maintenance;
+    outbox;
     lockService;
     log;
-    constructor(kdb, txHost, config, store, tracker, maintenance, lockService, log) {
+    constructor(kdb, txHost, config, store, outbox, lockService, log) {
         this.kdb = kdb;
         this.txHost = txHost;
         this.config = config;
         this.store = store;
-        this.tracker = tracker;
-        this.maintenance = maintenance;
+        this.outbox = outbox;
         this.lockService = lockService;
         this.log = log;
     }
@@ -86,34 +73,25 @@ let ScheduledTaskScanJob = class ScheduledTaskScanJob {
     async scan() {
         await this.scanAt(new Date());
     }
-    /**
-     * One scan as of `now` (tests pass their own); returns how many due tasks it handled. The repair
-     * runs even when the scan loop failed (its error is rethrown afterwards). `repairBatch`: how many
-     * rows each repair step takes (tests pass a small one).
-     */
-    async scanAt(now, repairBatch = REPAIR_BATCH) {
+    /** One scan as of `now` (tests pass their own); returns how many due tasks it handled. */
+    async scanAt(now) {
         const settings = new Map();
         let total = 0;
-        try {
-            for (; total < MAX_TASKS; total++) {
-                try {
-                    if (!(await this.scanOne(now, settings)))
-                        break;
-                }
-                catch (err) {
-                    if (!(err instanceof TaskScanFailed))
-                        throw err;
-                    // one task that cannot be advanced must not hold the others back every minute
-                    this.log.error("scheduled task cannot be advanced; paused", {
-                        taskId: err.taskId,
-                        err: err.cause,
-                    });
-                    await this.quarantine(err.taskId);
-                }
+        for (; total < MAX_TASKS; total++) {
+            try {
+                if (!(await this.scanOne(now, settings)))
+                    break;
+            }
+            catch (err) {
+                if (!(err instanceof TaskScanFailed))
+                    throw err;
+                // one task that cannot be advanced must not hold the others back every minute
+                this.log.error("scheduled task cannot be advanced; paused", {
+                    taskId: err.taskId,
+                    err: err.cause,
+                });
+                await this.quarantine(err.taskId);
             }
-        }
-        finally {
-            await this.repair(now, repairBatch);
         }
         return total;
     }
@@ -134,8 +112,8 @@ let ScheduledTaskScanJob = class ScheduledTaskScanJob {
         }
         const fired = await this.advance(t, task, now, s.catchUpWindowMinutes);
         if (fired !== null) {
-            const id = fired;
-            afterCommit(() => this.enqueue([id]));
+            await oweSchedFire(this.outbox, fired.id, task.orgId);
+            await oweSchedSettleUnfired(this.outbox, fired.id, task.orgId, fired.scheduledFor, s.catchUpWindowMinutes);
         }
         return true;
     }
@@ -143,136 +121,51 @@ let ScheduledTaskScanJob = class ScheduledTaskScanJob {
     async quarantine(taskId) {
         await pauseTaskIn(this.db, taskId, "invalid_schedule", null);
     }
-    /** One due task (see the class); returns the id of the run to fire, if any. */
+    /** One due task (see the class); returns the run to fire, if any. */
     async advance(t, task, now, catchUpWindowMinutes) {
-        const jitterMs = task.jitterSeconds * 1000;
-        // ticks are before jitter: the due tick is next_run_at - jitter, and a tick is due once
-        // tick + jitter <= now
-        const dueTick = new Date(task.nextRunAt.getTime() - jitterMs);
-        const until = new Date(now.getTime() - jitterMs);
         // the schedule math alone may mark the task broken; database errors fail this pass only
-        let ticks;
-        let next;
+        let step;
         try {
-            ticks = dueTicks(task.trigger, new Date(dueTick.getTime() - 1), until, catchUpWindowMinutes);
-            next = nextTick(task.trigger, until);
+            step = scanStep({
+                trigger: task.trigger,
+                nextRunAt: task.nextRunAt,
+                jitterSeconds: task.jitterSeconds,
+                expiresAt: task.expiresAt,
+            }, now, catchUpWindowMinutes);
         }
         catch (err) {
             throw new TaskScanFailed(task.id, err);
         }
-        const expires = task.expiresAt?.getTime() ?? Number.POSITIVE_INFINITY;
-        const fireAt = ticks.fire !== null && ticks.fire.getTime() <= expires ? ticks.fire : null;
-        const first = ticks.firstMissed;
-        if (first !== null && first.getTime() <= expires) {
+        if (step.missed !== null) {
             await this.store.insertRun(t, {
                 id: randomUUID(),
                 taskId: task.id,
                 orgId: task.orgId,
-                scheduledFor: first,
+                scheduledFor: step.missed,
                 trial: false,
                 status: "skipped",
                 skipReason: "missed",
             });
         }
         let fired = null;
-        if (fireAt !== null) {
+        if (step.fire !== null) {
             const run = await this.store.insertRun(t, {
                 id: randomUUID(),
                 taskId: task.id,
                 orgId: task.orgId,
-                scheduledFor: fireAt,
+                scheduledFor: step.fire,
                 trial: false,
             });
-            fired = run?.id ?? null;
+            fired = run ?? null;
         }
-        const patch = next === null
+        const patch = step.end === "done"
             ? { status: "ended", nextRunAt: null }
-            : next.getTime() > expires
+            : step.end === "expired"
                 ? { status: "ended", pauseReason: "expired", nextRunAt: null }
-                : { nextRunAt: new Date(next.getTime() + jitterMs) };
+                : { nextRunAt: step.nextRunAt };
         await this.store.updateTask(t, task.id, patch);
         return fired;
     }
-    /** Enqueues the fire jobs (after the commit; a failure is repaired by a later scan). */
-    async enqueue(ids) {
-        for (const id of ids) {
-            const job = schedFireJob(id);
-            try {
-                await this.maintenance.add(job.name, job.data, job.opts);
-            }
-            catch (err) {
-                this.log.warn("enqueueing a scheduled task run failed", { taskRunId: id, err });
-            }
-        }
-    }
-    /** Lost fire jobs (see the class). */
-    async repair(now, batch) {
-        const stale = await this.db
-            .selectFrom("scheduled_task_runs")
-            .select(["id", "scheduled_for"])
-            .where("status", "=", "pending")
-            .where("fired_at", "is", null)
-            .where("scheduled_for", "<", new Date(now.getTime() - REPAIR_AFTER_MS))
-            .orderBy("scheduled_for")
-            .limit(batch)
-            .execute();
-        const retry = [];
-        const lost = [];
-        for (const r of stale) {
-            const at = r.scheduled_for instanceof Date ? r.scheduled_for : new Date(r.scheduled_for);
-            (now.getTime() - at.getTime() > GIVE_UP_AFTER_MS ? lost : retry).push(r.id);
-        }
-        for (const id of lost)
-            await this.giveUp(id);
-        await this.enqueue(retry);
-        // the least recently rechecked first, so runs still in flight do not starve the others
-        const started = await this.db
-            .selectFrom("scheduled_task_runs")
-            .select("id")
-            .where("status", "=", "pending")
-            .where("fired_at", "<", new Date(now.getTime() - GIVE_UP_AFTER_MS))
-            .orderBy(sql `rechecked_at NULLS FIRST`)
-            .orderBy("scheduled_for")
-            .limit(batch)
-            .execute();
-        for (const r of started)
-            await this.recheck(r.id, now);
-    }
-    /** A run never fired an hour after its tick: given up, task row first (the one lock order). */
-    async giveUp(taskRunId) {
-        const owner = await this.db
-            .selectFrom("scheduled_task_runs")
-            .select("task_id")
-            .where("id", "=", taskRunId)
-            .executeTakeFirst();
-        if (!owner)
-            return;
-        await lockTaskRow(this.db, owner.task_id);
-        await this.db
-            .updateTable("scheduled_task_runs")
-            .set({ status: "skipped", skip_reason: "missed", error: "The run could not be started" })
-            .where("id", "=", taskRunId)
-            .where("status", "=", "pending")
-            .where("fired_at", "is", null)
-            .execute();
-    }
-    /**
-     * A started run still pending long after: the tracker links, settles or releases it; one still
-     * in flight is stamped (`rechecked_at`) and goes to the back of the next rechecks.
-     */
-    async recheck(taskRunId, now) {
-        const run = await this.store.updateRun(this.db, taskRunId, {});
-        if (run?.status !== "pending")
-            return;
-        // inFlightIn takes the task row before the run (the one lock order)
-        if (await this.tracker.inFlightIn(run, now)) {
-            await this.db
-                .updateTable("scheduled_task_runs")
-                .set({ rechecked_at: now })
-                .where("id", "=", taskRunId)
-                .execute();
-        }
-    }
 };
 __decorate([
     LockedCron("* * * * *", { name: SCHED_SCAN_JOB })
@@ -283,21 +176,14 @@ __decorate([
 __decorate([
     Transactional()
 ], ScheduledTaskScanJob.prototype, "quarantine", null);
-__decorate([
-    Transactional()
-], ScheduledTaskScanJob.prototype, "giveUp", null);
-__decorate([
-    Transactional()
-], ScheduledTaskScanJob.prototype, "recheck", null);
 ScheduledTaskScanJob = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
     __param(2, Inject(KernelConfigService)),
     __param(3, Inject(ScheduledTaskStore)),
-    __param(4, Inject(ScheduledTaskRunTracker)),
-    __param(5, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME))),
-    __param(6, Inject(LockService)),
-    __param(7, Inject(KERNEL_LOGGER))
+    __param(4, Inject(OutboxService)),
+    __param(5, Inject(LockService)),
+    __param(6, Inject(KERNEL_LOGGER))
 ], ScheduledTaskScanJob);
 export { ScheduledTaskScanJob };

package/dist/schedules/schedule-math.d.ts

@@ -8,6 +8,48 @@ export declare function validateTrigger(t: ScheduleTrigger, now: Date): {
 };
 /** The first tick strictly after `after` (before jitter); null for a past once task. */
 export declare function nextTick(t: ScheduleTrigger, after: Date): Date | null;
+/** The first tick strictly after `after` (before jitter) of one trigger; null when none. */
+export type Ticker = (after: Date) => Date | null;
+/**
+ * The scanner's ticker for one trigger ({@link nextTick} without rebuilding its `CronTime`s per
+ * call), for callers that walk the same trigger many times ({@link ticksIn}).
+ */
+export declare function tickerOf(t: ScheduleTrigger): Ticker;
+/**
+ * The ticks in `(after, until]` (before jitter), at most `max`, from the same ticker
+ * {@link nextTick} and {@link dueTicks} use, so a list of planned runs equals what the scanner
+ * fires (calendar spec §5.2). `exhausted`: `max` ticks were taken before a tick past `until` was
+ * seen, so more may follow. A `once` trigger yields its one tick when it lies in the window.
+ * Costs one tick evaluation per tick returned, plus one when the walk reaches `until`. A caller
+ * that walks one trigger in many windows passes a {@link tickerOf} it built once.
+ */
+export declare function ticksIn(t: ScheduleTrigger | Ticker, after: Date, until: Date, max: number): {
+    ticks: Date[];
+    exhausted: boolean;
+};
+/** What one scan does to a due task (spec §6 step 1), as {@link scanStep} decides it. */
+export interface ScanStep {
+    /** The first missed tick, recorded as one skipped run (`missed`); null when none. */
+    missed: Date | null;
+    /** The tick whose run is recorded and fired; null when none. */
+    fire: Date | null;
+    /** The task's new `next_run_at` (jitter included); null when it ends. */
+    nextRunAt: Date | null;
+    /** Why the task ends: no tick left (`done`) or the next one lies past `expires_at`. */
+    end: "done" | "expired" | null;
+}
+/**
+ * One scan of a due task (`next_run_at <= now`) as of `now`, the schedule math alone: the ticks
+ * are before jitter, so the due tick is `nextRunAt - jitter` and a tick is due once
+ * `tick + jitter <= now`. The scanner applies the result; the calendar's parity test drives it.
+ * Throws when the trigger cannot be evaluated.
+ */
+export declare function scanStep(task: {
+    trigger: ScheduleTrigger;
+    nextRunAt: Date;
+    jitterSeconds: number;
+    expiresAt: Date | null;
+}, now: Date, catchUpWindowMinutes: number): ScanStep;
 /** The smallest gap, in minutes, among the next 50 fire times after `from`; null for once. */
 export declare function minGapMinutes(t: ScheduleTrigger, from: Date): number | null;
 /** A fixed per-task offset: `fnv1a32(id) mod min(floor(10 % of the interval), 300 s)`; once is 0. */

package/dist/schedules/schedule-math.js

@@ -104,6 +104,13 @@ export function validateTrigger(t, now) {
 export function nextTick(t, after) {
     return ticker(t)(after);
 }
+/**
+ * The scanner's ticker for one trigger ({@link nextTick} without rebuilding its `CronTime`s per
+ * call), for callers that walk the same trigger many times ({@link ticksIn}).
+ */
+export function tickerOf(t) {
+    return ticker(t);
+}
 /** How far back a DST transition can move a tick: longer than any gap (spec §5). */
 const TRANSITION_LOOKBACK_MS = 6 * 3600_000;
 /**
@@ -138,6 +145,51 @@ function ticker(t) {
         return null;
     };
 }
+/**
+ * The ticks in `(after, until]` (before jitter), at most `max`, from the same ticker
+ * {@link nextTick} and {@link dueTicks} use, so a list of planned runs equals what the scanner
+ * fires (calendar spec §5.2). `exhausted`: `max` ticks were taken before a tick past `until` was
+ * seen, so more may follow. A `once` trigger yields its one tick when it lies in the window.
+ * Costs one tick evaluation per tick returned, plus one when the walk reaches `until`. A caller
+ * that walks one trigger in many windows passes a {@link tickerOf} it built once.
+ */
+export function ticksIn(t, after, until, max) {
+    const ticks = [];
+    if (after.getTime() >= until.getTime())
+        return { ticks, exhausted: false };
+    const next = typeof t === "function" ? t : ticker(t);
+    let cursor = after;
+    while (ticks.length < max) {
+        const tick = next(cursor);
+        if (!tick || tick.getTime() > until.getTime())
+            return { ticks, exhausted: false };
+        ticks.push(tick);
+        cursor = tick;
+    }
+    return { ticks, exhausted: true };
+}
+/**
+ * One scan of a due task (`next_run_at <= now`) as of `now`, the schedule math alone: the ticks
+ * are before jitter, so the due tick is `nextRunAt - jitter` and a tick is due once
+ * `tick + jitter <= now`. The scanner applies the result; the calendar's parity test drives it.
+ * Throws when the trigger cannot be evaluated.
+ */
+export function scanStep(task, now, catchUpWindowMinutes) {
+    const jitterMs = task.jitterSeconds * 1000;
+    const dueTick = new Date(task.nextRunAt.getTime() - jitterMs);
+    const until = new Date(now.getTime() - jitterMs);
+    const ticks = dueTicks(task.trigger, new Date(dueTick.getTime() - 1), until, catchUpWindowMinutes);
+    const next = nextTick(task.trigger, until);
+    const expires = task.expiresAt?.getTime() ?? Number.POSITIVE_INFINITY;
+    const fire = ticks.fire !== null && ticks.fire.getTime() <= expires ? ticks.fire : null;
+    const first = ticks.firstMissed;
+    const missed = first !== null && first.getTime() <= expires ? first : null;
+    if (next === null)
+        return { missed, fire, nextRunAt: null, end: "done" };
+    if (next.getTime() > expires)
+        return { missed, fire, nextRunAt: null, end: "expired" };
+    return { missed, fire, nextRunAt: new Date(next.getTime() + jitterMs), end: null };
+}
 /** The wall clock of `at` in `timeZone`, read as if it were UTC (epoch ms, seconds dropped). */
 function localWallClock(at, timeZone) {
     return Math.floor(wallOf(at.getTime(), timeZone) / 60000) * 60000;

package/dist/schedules/scheduled-tasks.service.d.ts

@@ -1,4 +1,3 @@
-import type { Queue } from "bullmq";
 import { AgentLookup } from "../agents/agent-lookup.js";
 import type { ModelRef } from "../agents/definition.js";
 import { ConversationAccess } from "../conversations/access.js";
@@ -7,12 +6,14 @@ import { ExtensionRegistry } from "../extensions/registry.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { DevicePolicyService } from "../local-devices/device-policy.service.js";
 import type { KernelLogger } from "../log.js";
 import { OrgLock } from "../orgs/org-lock.js";
 import { ProviderRegistry } from "../runtime/providers.js";
 import { SandboxService } from "../sandbox/sandbox.service.js";
 import { ToolRegistry } from "../tools/registry.js";
+import { type CalendarAnswer, type CalendarLimits } from "./calendar.js";
 import { type GrantContext, type GrantRefusalCode, grantRefusal, grantRefusalOf, networkGrantRefusal } from "./grant-rules.js";
 import { ScheduledTaskStore } from "./store.js";
 import type { ScheduleChat, ScheduledTask, ScheduledTaskGrant, ScheduleMode, SchedulePauseReason, TaskRun } from "./types.js";
@@ -197,8 +198,8 @@ export declare class ScheduledTasksService {
     /** A task's model must resolve for the org and declare its effort (as a message's switch). */
     private readonly providers;
     private readonly log;
-    /** "Run now" enqueues the fire job (consumed by the worker role). */
-    private readonly maintenance;
+    /** "Run now" owes the fire job (consumed by the worker role). */
+    private readonly outbox;
     /** Network grants: the org's effective egress (network ask-to-allow spec §8.1). */
     private readonly sandbox;
     /** Network grants: the task's device's local policy summary (`remoteGrants`). */
@@ -206,8 +207,8 @@ export declare class ScheduledTasksService {
     constructor(db: KernelDb, txHost: TransactionHost, config: Pick<KernelConfigService, "get">, store: ScheduledTaskStore, orgLock: Pick<OrgLock, "lockAndAuthorize">, agents: Pick<AgentLookup, "get">, access: Pick<ConversationAccess, "isAccessible">, tools: Pick<ToolRegistry, "forAgent">, extensions: Pick<ExtensionRegistry, "list">, 
     /** A task's model must resolve for the org and declare its effort (as a message's switch). */
     providers: Pick<ProviderRegistry, "resolve">, log: Pick<KernelLogger, "warn">, 
-    /** "Run now" enqueues the fire job (consumed by the worker role). */
-    maintenance: Pick<Queue, "add">, 
+    /** "Run now" owes the fire job (consumed by the worker role). */
+    outbox: Pick<OutboxService, "add">, 
     /** Network grants: the org's effective egress (network ask-to-allow spec §8.1). */
     sandbox: Pick<SandboxService, "ceilingLimits" | "devicePolicy">, 
     /** Network grants: the task's device's local policy summary (`remoteGrants`). */
@@ -231,6 +232,21 @@ export declare class ScheduledTasksService {
         all?: boolean;
         conversationId?: string;
     }): Promise<ScheduledTaskListItem[]>;
+    /**
+     * The calendar between two instants (calendar spec §5): the runs and planned occurrences of the
+     * actor's own tasks, or with `all` (org admins only, else `forbidden`) every task of the org; with
+     * `taskId` only that task (one the actor may see, else `schedule.not_found`), never collapsed.
+     * Another creator's runs come without `conversationId`, `error` and `missingGrants` (§15 Q3).
+     * A range longer than 43 days (2 with `taskId`), or not forward, is `validation_failed`. `now`
+     * is for tests.
+     */
+    calendar(orgId: string, actor: ScheduleActor, q: {
+        from: Date;
+        to: Date;
+        timeZone: string;
+        all?: boolean;
+        taskId?: string;
+    }, now?: Date, limits?: CalendarLimits): Promise<CalendarAnswer>;
     /**
      * The tasks of `tasks` that post into the conversation: a `conversation` task naming it, or a
      * `chat` task whose chat the conversation is a thread of (spec §10 side panel).
@@ -285,7 +301,7 @@ export declare class ScheduledTasksService {
     /**
      * "Run now" (spec §6), creator only: a task run for the request time, outside the schedule (no
      * unique-key conflict with a tick, and `next_run_at` does not move), fired at once through the
-     * fire job after the commit. `trial`: an attended trial run whose approvals become the task's
+     * fire job its transaction owes. `trial`: an attended trial run whose approvals become the task's
      * grants (§7). Counted in the rate limit like any run. An ended task cannot run; a paused one
      * can (only its creator gets here: the run is `manual`, which the fire's paused check lets by).
      */