@capybara-hq/kernel 0.1.0-rc.24 → 0.1.0-rc.25

package/dist/schedules/job-ids.d.ts

@@ -1,4 +1,5 @@
-/** The scheduled tasks' jobs (a leaf module: no imports). */
+import type { OutboxService } from "../infra/outbox/outbox.service.js";
+/** The scheduled tasks' jobs (a leaf module: type imports only). */
 /**
  * The once-a-minute `@LockedCron` that turns due tasks into task runs (spec §6); its name enqueued
  * on the maintenance queue runs one scan (`ScheduledRuns.runNow`).
@@ -13,20 +14,68 @@ export interface SchedFireJobData {
 /** The fire job's id: `sched-fire-<taskRunId>` (no `:`, task run ids are UUIDs). */
 export declare const schedFireJobId: (taskRunId: string) => string;
 /**
- * The fire job of one task run. Removed when done, so the scanner's repair can enqueue it again
- * after a lost job; the fire is idempotent on the task run's status, so retries are safe.
- */
-export declare function schedFireJob(taskRunId: string): {
-    name: string;
-    data: SchedFireJobData;
-    opts: {
-        jobId: string;
-        attempts: number;
-        backoff: {
-            type: "exponential";
-            delay: number;
-        };
-        removeOnComplete: true;
-        removeOnFail: true;
-    };
+ * Owes the fire job of task run `taskRunId` in the transaction in context (transactional outbox
+ * spec §8.1): the transaction that writes a pending task run (the scan's tick, a person's "run
+ * now") owes its fire, so a tick is never left unfired. The job's options are its outbox registry
+ * entry's; the fire is idempotent on the task run's status.
+ */
+export declare function oweSchedFire(outbox: Pick<OutboxService, "add">, taskRunId: string, orgId: string): Promise<boolean>;
+/**
+ * The delayed job that settles a task run left pending (ruling R26, fix round 1), on
+ * `cap-kernel-maintenance`. Two kinds:
+ * - the claimed check, owed by the fire job's claim: the run tracker links, settles or releases a
+ *   run claimed but never started (`sched-settle-<taskRunId>`, then `-<check>`);
+ * - the unfired check, owed with the task run itself (the scan's tick, "run now"): a run its fire
+ *   job never claimed (the job failed for good before its claim) is skipped, `missed` for a tick,
+ *   `removed` for a "run now", so it never blocks the task's later ticks as an overlap
+ *   (`sched-settle-<taskRunId>-unfired`).
+ */
+export declare const SCHED_SETTLE_JOB = "sched-settle";
+/**
+ * The data of a {@link SCHED_SETTLE_JOB}: the claimed check (`check` counts the checks before this
+ * one) or the unfired check.
+ */
+export type SchedSettleJobData = {
+    taskRunId: string;
+    check: number;
+} | {
+    taskRunId: string;
+    unfired: true;
 };
+/**
+ * The first claimed check: 10 minutes after the claim, when the start's retries (seconds) are long
+ * over and the run tracker's start grace (`START_GRACE_MS`, 5 minutes) has passed, so a run that
+ * left no trace is released at once. Also the unfired check's delay after a "run now".
+ */
+export declare const SCHED_SETTLE_AFTER_MS: number;
+/**
+ * A claimed run still in flight at a check (its item queued, its message posted and not yet taken
+ * by a run) is checked again hourly. The chain ends with the first check that finds the run
+ * started, ended or released: the queued item is consumed or removed, the message taken by a run.
+ * A chain past {@link SCHED_SETTLE_LONG_CHECKS} checks (a week) is logged as a warning, once.
+ */
+export declare const SCHED_SETTLE_RECHECK_MS: number;
+/** A week of hourly checks: the claimed check warns at this one (a run in flight that long). */
+export declare const SCHED_SETTLE_LONG_CHECKS = 168;
+/**
+ * How long past the org's catch-up window a tick's fire may come before the tick is missed (the
+ * fire job's own rule, and when a tick's unfired check runs): the scan fires a tick still inside
+ * the window, and its fire job follows within seconds.
+ */
+export declare const SCHED_LATE_FIRE_SLACK_MS: number;
+/** The claimed check's id: `sched-settle-<taskRunId>`, then `-<check>` for the later checks. */
+export declare const schedSettleJobId: (taskRunId: string, check: number) => string;
+/** The unfired check's id: `sched-settle-<taskRunId>-unfired`. */
+export declare const schedSettleUnfiredJobId: (taskRunId: string) => string;
+/**
+ * Owes claimed check number `check` of task run `taskRunId` in the transaction in context, due
+ * `after` milliseconds from now.
+ */
+export declare function oweSchedSettle(outbox: Pick<OutboxService, "add">, taskRunId: string, orgId: string, check: number, after: number): Promise<boolean>;
+/**
+ * Owes the unfired check of task run `taskRunId` in the transaction that writes the run: for a
+ * tick of the schedule (`catchUpWindowMinutes` given) when the fire job would itself call the
+ * tick missed (its tick plus the window plus {@link SCHED_LATE_FIRE_SLACK_MS}, at least
+ * {@link SCHED_SETTLE_AFTER_MS} on); for a "run now" (null) {@link SCHED_SETTLE_AFTER_MS} on.
+ */
+export declare function oweSchedSettleUnfired(outbox: Pick<OutboxService, "add">, taskRunId: string, orgId: string, scheduledFor: Date, catchUpWindowMinutes: number | null): Promise<boolean>;

package/dist/schedules/job-ids.js

@@ -1,4 +1,4 @@
-/** The scheduled tasks' jobs (a leaf module: no imports). */
+/** The scheduled tasks' jobs (a leaf module: type imports only). */
 /**
  * The once-a-minute `@LockedCron` that turns due tasks into task runs (spec §6); its name enqueued
  * on the maintenance queue runs one scan (`ScheduledRuns.runNow`).
@@ -9,19 +9,87 @@ export const SCHED_FIRE_JOB = "sched-fire";
 /** The fire job's id: `sched-fire-<taskRunId>` (no `:`, task run ids are UUIDs). */
 export const schedFireJobId = (taskRunId) => `${SCHED_FIRE_JOB}-${taskRunId}`;
 /**
- * The fire job of one task run. Removed when done, so the scanner's repair can enqueue it again
- * after a lost job; the fire is idempotent on the task run's status, so retries are safe.
+ * Owes the fire job of task run `taskRunId` in the transaction in context (transactional outbox
+ * spec §8.1): the transaction that writes a pending task run (the scan's tick, a person's "run
+ * now") owes its fire, so a tick is never left unfired. The job's options are its outbox registry
+ * entry's; the fire is idempotent on the task run's status.
  */
-export function schedFireJob(taskRunId) {
-    return {
+export function oweSchedFire(outbox, taskRunId, orgId) {
+    return outbox.add({
+        queue: "cap-kernel-maintenance",
         name: SCHED_FIRE_JOB,
+        jobId: schedFireJobId(taskRunId),
         data: { taskRunId },
-        opts: {
-            jobId: schedFireJobId(taskRunId),
-            attempts: 3,
-            backoff: { type: "exponential", delay: 2_000 },
-            removeOnComplete: true,
-            removeOnFail: true,
-        },
-    };
+        orgId,
+    });
+}
+/**
+ * The delayed job that settles a task run left pending (ruling R26, fix round 1), on
+ * `cap-kernel-maintenance`. Two kinds:
+ * - the claimed check, owed by the fire job's claim: the run tracker links, settles or releases a
+ *   run claimed but never started (`sched-settle-<taskRunId>`, then `-<check>`);
+ * - the unfired check, owed with the task run itself (the scan's tick, "run now"): a run its fire
+ *   job never claimed (the job failed for good before its claim) is skipped, `missed` for a tick,
+ *   `removed` for a "run now", so it never blocks the task's later ticks as an overlap
+ *   (`sched-settle-<taskRunId>-unfired`).
+ */
+export const SCHED_SETTLE_JOB = "sched-settle";
+/**
+ * The first claimed check: 10 minutes after the claim, when the start's retries (seconds) are long
+ * over and the run tracker's start grace (`START_GRACE_MS`, 5 minutes) has passed, so a run that
+ * left no trace is released at once. Also the unfired check's delay after a "run now".
+ */
+export const SCHED_SETTLE_AFTER_MS = 10 * 60_000;
+/**
+ * A claimed run still in flight at a check (its item queued, its message posted and not yet taken
+ * by a run) is checked again hourly. The chain ends with the first check that finds the run
+ * started, ended or released: the queued item is consumed or removed, the message taken by a run.
+ * A chain past {@link SCHED_SETTLE_LONG_CHECKS} checks (a week) is logged as a warning, once.
+ */
+export const SCHED_SETTLE_RECHECK_MS = 60 * 60_000;
+/** A week of hourly checks: the claimed check warns at this one (a run in flight that long). */
+export const SCHED_SETTLE_LONG_CHECKS = 168;
+/**
+ * How long past the org's catch-up window a tick's fire may come before the tick is missed (the
+ * fire job's own rule, and when a tick's unfired check runs): the scan fires a tick still inside
+ * the window, and its fire job follows within seconds.
+ */
+export const SCHED_LATE_FIRE_SLACK_MS = 10 * 60_000;
+/** The claimed check's id: `sched-settle-<taskRunId>`, then `-<check>` for the later checks. */
+export const schedSettleJobId = (taskRunId, check) => check === 0 ? `${SCHED_SETTLE_JOB}-${taskRunId}` : `${SCHED_SETTLE_JOB}-${taskRunId}-${check}`;
+/** The unfired check's id: `sched-settle-<taskRunId>-unfired`. */
+export const schedSettleUnfiredJobId = (taskRunId) => `${SCHED_SETTLE_JOB}-${taskRunId}-unfired`;
+/**
+ * Owes claimed check number `check` of task run `taskRunId` in the transaction in context, due
+ * `after` milliseconds from now.
+ */
+export function oweSchedSettle(outbox, taskRunId, orgId, check, after) {
+    return outbox.add({
+        queue: "cap-kernel-maintenance",
+        name: SCHED_SETTLE_JOB,
+        jobId: schedSettleJobId(taskRunId, check),
+        data: { taskRunId, check },
+        runAt: new Date(Date.now() + after),
+        orgId,
+    });
+}
+/**
+ * Owes the unfired check of task run `taskRunId` in the transaction that writes the run: for a
+ * tick of the schedule (`catchUpWindowMinutes` given) when the fire job would itself call the
+ * tick missed (its tick plus the window plus {@link SCHED_LATE_FIRE_SLACK_MS}, at least
+ * {@link SCHED_SETTLE_AFTER_MS} on); for a "run now" (null) {@link SCHED_SETTLE_AFTER_MS} on.
+ */
+export function oweSchedSettleUnfired(outbox, taskRunId, orgId, scheduledFor, catchUpWindowMinutes) {
+    const soonest = Date.now() + SCHED_SETTLE_AFTER_MS;
+    const at = catchUpWindowMinutes === null
+        ? soonest
+        : Math.max(soonest, scheduledFor.getTime() + catchUpWindowMinutes * 60_000 + SCHED_LATE_FIRE_SLACK_MS);
+    return outbox.add({
+        queue: "cap-kernel-maintenance",
+        name: SCHED_SETTLE_JOB,
+        jobId: schedSettleUnfiredJobId(taskRunId),
+        data: { taskRunId, unfired: true },
+        runAt: new Date(at),
+        orgId,
+    });
 }

package/dist/schedules/run-tracker.js

@@ -114,7 +114,8 @@ let ScheduledTaskRunTracker = class ScheduledTaskRunTracker {
             await this.settle(tr, run.status);
             return false;
         }
-        // not started yet: its fire job is still to come (the scanner repairs a lost one)
+        // not claimed yet: its fire job is still to come (the run's unfired settle check skips it
+        // when the job failed for good before its claim)
         if (tr.fired_at === null)
             return true;
         // only a run with a target conversation is ever queued (`conversation`, `chat`): no scan of

package/dist/schedules/scan.job.d.ts

@@ -1,10 +1,9 @@
-import type { Queue } from "bullmq";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { LockService } from "../infra/lock/lock.service.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import type { KernelLogger } from "../log.js";
-import { ScheduledTaskRunTracker } from "./run-tracker.js";
 import { ScheduledTaskStore } from "./store.js";
 /**
  * The scheduled task scanner (spec §6), once a minute across replicas. Each due task in its own
@@ -12,34 +11,27 @@ import { ScheduledTaskStore } from "./store.js";
  * same task): the ticks missed outside the org's `catchUpWindowMinutes` become one `skipped` run
  * (`missed`, at the first missed tick), the latest tick in the window gets its run (the unique
  * `(task_id, scheduled_for)` key makes a second insert a no-op), `next_run_at` moves to the next
- * tick plus the task's jitter (or a `once` task ends, or one past its `expires_at`), and after the
- * commit `sched-fire-<taskRunId>` is enqueued. A task whose stored trigger the schedule math cannot
- * evaluate is paused (`invalid_schedule`) instead of failing the scan; a database error fails the
- * pass (the next minute retries) and pauses nothing.
- *
- * Then the repair: a run still `pending` and unfired 10 minutes after its tick has its fire job
- * enqueued again, and is given up (`skipped`, `missed`) after an hour; a run fired an hour ago and
- * still `pending` (its start failed for good) goes through the run tracker's check, which links,
- * settles or releases it, so a `once` task's last run never stays pending.
+ * tick plus the task's jitter (or a `once` task ends, or one past its `expires_at`), and the same
+ * transaction owes `sched-fire-<taskRunId>` (transactional outbox spec §8.1), so a written tick is
+ * never left unfired and the scan needs no repair of lost fire jobs (a fire delivered too late
+ * marks its tick missed itself, `ScheduledTaskFirer`), and the run's unfired settle check (a fire
+ * job that failed for good before its claim: the tick is missed, `job-ids.ts`). A task whose stored trigger the schedule
+ * math cannot evaluate is paused (`invalid_schedule`) instead of failing the scan; a database
+ * error fails the pass (the next minute retries) and pauses nothing.
  */
 export declare class ScheduledTaskScanJob {
     private readonly kdb;
     readonly txHost: TransactionHost;
     private readonly config;
     private readonly store;
-    private readonly tracker;
-    private readonly maintenance;
+    private readonly outbox;
     readonly lockService: LockService;
     readonly log: KernelLogger;
-    constructor(kdb: KernelDb, txHost: TransactionHost, config: Pick<KernelConfigService, "get">, store: ScheduledTaskStore, tracker: Pick<ScheduledTaskRunTracker, "inFlightIn">, maintenance: Pick<Queue, "add">, lockService: LockService, log: KernelLogger);
+    constructor(kdb: KernelDb, txHost: TransactionHost, config: Pick<KernelConfigService, "get">, store: ScheduledTaskStore, outbox: Pick<OutboxService, "add">, lockService: LockService, log: KernelLogger);
     private get db();
     scan(): Promise<void>;
-    /**
-     * One scan as of `now` (tests pass their own); returns how many due tasks it handled. The repair
-     * runs even when the scan loop failed (its error is rethrown afterwards). `repairBatch`: how many
-     * rows each repair step takes (tests pass a small one).
-     */
-    scanAt(now: Date, repairBatch?: number): Promise<number>;
+    /** One scan as of `now` (tests pass their own); returns how many due tasks it handled. */
+    scanAt(now: Date): Promise<number>;
     /**
      * One due task in its own transaction (a task whose trigger cannot be evaluated rolls back
      * alone and is paused, so it cannot block the others): locked with `SKIP LOCKED`, so replicas take different tasks. False
@@ -48,17 +40,6 @@ export declare class ScheduledTaskScanJob {
     private scanOne;
     /** A task the scan cannot advance stops being due: paused with `invalid_schedule`. */
     private quarantine;
-    /** One due task (see the class); returns the id of the run to fire, if any. */
+    /** One due task (see the class); returns the run to fire, if any. */
     private advance;
-    /** Enqueues the fire jobs (after the commit; a failure is repaired by a later scan). */
-    private enqueue;
-    /** Lost fire jobs (see the class). */
-    private repair;
-    /** A run never fired an hour after its tick: given up, task row first (the one lock order). */
-    private giveUp;
-    /**
-     * A started run still pending long after: the tracker links, settles or releases it; one still
-     * in flight is stamped (`rechecked_at`) and goes to the back of the next rechecks.
-     */
-    private recheck;
 }

package/dist/schedules/scan.job.js

@@ -8,31 +8,22 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { randomUUID } from "node:crypto";
-import { getQueueToken } from "@nestjs/bullmq";
 import { Inject, Injectable } from "@nestjs/common";
-import { sql } from "kysely";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
-import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { LockService } from "../infra/lock/lock.service.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { LockedCron } from "../infra/schedule/locked-cron.decorator.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
-import { MAINTENANCE_QUEUE_NAME } from "../runtime/maintenance-queue.js";
 import { readScheduleSettings } from "./effective-settings.js";
-import { SCHED_SCAN_JOB, schedFireJob } from "./job-ids.js";
+import { oweSchedFire, oweSchedSettleUnfired, SCHED_SCAN_JOB } from "./job-ids.js";
 import { pauseTaskIn } from "./pause.js";
-import { lockTaskRow, ScheduledTaskRunTracker } from "./run-tracker.js";
 import { scanStep } from "./schedule-math.js";
 import { ScheduledTaskStore } from "./store.js";
 /** Due tasks per scan; what is left waits for the next minute. */
 const MAX_TASKS = 2000;
-/** A pending task run never fired this long after its tick: its fire job is enqueued again. */
-const REPAIR_AFTER_MS = 10 * 60_000;
-/** ... and this long after its tick it is given up (`skipped`, `missed`). */
-const GIVE_UP_AFTER_MS = 60 * 60_000;
-const REPAIR_BATCH = 100;
 /**
  * The schedule math could not evaluate a due task's stored trigger (its transaction rolled back);
  * the scan pauses it. Only the math raises it: a database error fails the scan pass instead (the
@@ -51,32 +42,28 @@ class TaskScanFailed extends Error {
  * same task): the ticks missed outside the org's `catchUpWindowMinutes` become one `skipped` run
  * (`missed`, at the first missed tick), the latest tick in the window gets its run (the unique
  * `(task_id, scheduled_for)` key makes a second insert a no-op), `next_run_at` moves to the next
- * tick plus the task's jitter (or a `once` task ends, or one past its `expires_at`), and after the
- * commit `sched-fire-<taskRunId>` is enqueued. A task whose stored trigger the schedule math cannot
- * evaluate is paused (`invalid_schedule`) instead of failing the scan; a database error fails the
- * pass (the next minute retries) and pauses nothing.
- *
- * Then the repair: a run still `pending` and unfired 10 minutes after its tick has its fire job
- * enqueued again, and is given up (`skipped`, `missed`) after an hour; a run fired an hour ago and
- * still `pending` (its start failed for good) goes through the run tracker's check, which links,
- * settles or releases it, so a `once` task's last run never stays pending.
+ * tick plus the task's jitter (or a `once` task ends, or one past its `expires_at`), and the same
+ * transaction owes `sched-fire-<taskRunId>` (transactional outbox spec §8.1), so a written tick is
+ * never left unfired and the scan needs no repair of lost fire jobs (a fire delivered too late
+ * marks its tick missed itself, `ScheduledTaskFirer`), and the run's unfired settle check (a fire
+ * job that failed for good before its claim: the tick is missed, `job-ids.ts`). A task whose stored trigger the schedule
+ * math cannot evaluate is paused (`invalid_schedule`) instead of failing the scan; a database
+ * error fails the pass (the next minute retries) and pauses nothing.
  */
 let ScheduledTaskScanJob = class ScheduledTaskScanJob {
     kdb;
     txHost;
     config;
     store;
-    tracker;
-    maintenance;
+    outbox;
     lockService;
     log;
-    constructor(kdb, txHost, config, store, tracker, maintenance, lockService, log) {
+    constructor(kdb, txHost, config, store, outbox, lockService, log) {
         this.kdb = kdb;
         this.txHost = txHost;
         this.config = config;
         this.store = store;
-        this.tracker = tracker;
-        this.maintenance = maintenance;
+        this.outbox = outbox;
         this.lockService = lockService;
         this.log = log;
     }
@@ -86,34 +73,25 @@ let ScheduledTaskScanJob = class ScheduledTaskScanJob {
     async scan() {
         await this.scanAt(new Date());
     }
-    /**
-     * One scan as of `now` (tests pass their own); returns how many due tasks it handled. The repair
-     * runs even when the scan loop failed (its error is rethrown afterwards). `repairBatch`: how many
-     * rows each repair step takes (tests pass a small one).
-     */
-    async scanAt(now, repairBatch = REPAIR_BATCH) {
+    /** One scan as of `now` (tests pass their own); returns how many due tasks it handled. */
+    async scanAt(now) {
         const settings = new Map();
         let total = 0;
-        try {
-            for (; total < MAX_TASKS; total++) {
-                try {
-                    if (!(await this.scanOne(now, settings)))
-                        break;
-                }
-                catch (err) {
-                    if (!(err instanceof TaskScanFailed))
-                        throw err;
-                    // one task that cannot be advanced must not hold the others back every minute
-                    this.log.error("scheduled task cannot be advanced; paused", {
-                        taskId: err.taskId,
-                        err: err.cause,
-                    });
-                    await this.quarantine(err.taskId);
-                }
+        for (; total < MAX_TASKS; total++) {
+            try {
+                if (!(await this.scanOne(now, settings)))
+                    break;
+            }
+            catch (err) {
+                if (!(err instanceof TaskScanFailed))
+                    throw err;
+                // one task that cannot be advanced must not hold the others back every minute
+                this.log.error("scheduled task cannot be advanced; paused", {
+                    taskId: err.taskId,
+                    err: err.cause,
+                });
+                await this.quarantine(err.taskId);
             }
-        }
-        finally {
-            await this.repair(now, repairBatch);
         }
         return total;
     }
@@ -134,8 +112,8 @@ let ScheduledTaskScanJob = class ScheduledTaskScanJob {
         }
         const fired = await this.advance(t, task, now, s.catchUpWindowMinutes);
         if (fired !== null) {
-            const id = fired;
-            afterCommit(() => this.enqueue([id]));
+            await oweSchedFire(this.outbox, fired.id, task.orgId);
+            await oweSchedSettleUnfired(this.outbox, fired.id, task.orgId, fired.scheduledFor, s.catchUpWindowMinutes);
         }
         return true;
     }
@@ -143,7 +121,7 @@ let ScheduledTaskScanJob = class ScheduledTaskScanJob {
     async quarantine(taskId) {
         await pauseTaskIn(this.db, taskId, "invalid_schedule", null);
     }
-    /** One due task (see the class); returns the id of the run to fire, if any. */
+    /** One due task (see the class); returns the run to fire, if any. */
     async advance(t, task, now, catchUpWindowMinutes) {
         // the schedule math alone may mark the task broken; database errors fail this pass only
         let step;
@@ -178,7 +156,7 @@ let ScheduledTaskScanJob = class ScheduledTaskScanJob {
                 scheduledFor: step.fire,
                 trial: false,
             });
-            fired = run?.id ?? null;
+            fired = run ?? null;
         }
         const patch = step.end === "done"
             ? { status: "ended", nextRunAt: null }
@@ -188,86 +166,6 @@ let ScheduledTaskScanJob = class ScheduledTaskScanJob {
         await this.store.updateTask(t, task.id, patch);
         return fired;
     }
-    /** Enqueues the fire jobs (after the commit; a failure is repaired by a later scan). */
-    async enqueue(ids) {
-        for (const id of ids) {
-            const job = schedFireJob(id);
-            try {
-                await this.maintenance.add(job.name, job.data, job.opts);
-            }
-            catch (err) {
-                this.log.warn("enqueueing a scheduled task run failed", { taskRunId: id, err });
-            }
-        }
-    }
-    /** Lost fire jobs (see the class). */
-    async repair(now, batch) {
-        const stale = await this.db
-            .selectFrom("scheduled_task_runs")
-            .select(["id", "scheduled_for"])
-            .where("status", "=", "pending")
-            .where("fired_at", "is", null)
-            .where("scheduled_for", "<", new Date(now.getTime() - REPAIR_AFTER_MS))
-            .orderBy("scheduled_for")
-            .limit(batch)
-            .execute();
-        const retry = [];
-        const lost = [];
-        for (const r of stale) {
-            const at = r.scheduled_for instanceof Date ? r.scheduled_for : new Date(r.scheduled_for);
-            (now.getTime() - at.getTime() > GIVE_UP_AFTER_MS ? lost : retry).push(r.id);
-        }
-        for (const id of lost)
-            await this.giveUp(id);
-        await this.enqueue(retry);
-        // the least recently rechecked first, so runs still in flight do not starve the others
-        const started = await this.db
-            .selectFrom("scheduled_task_runs")
-            .select("id")
-            .where("status", "=", "pending")
-            .where("fired_at", "<", new Date(now.getTime() - GIVE_UP_AFTER_MS))
-            .orderBy(sql `rechecked_at NULLS FIRST`)
-            .orderBy("scheduled_for")
-            .limit(batch)
-            .execute();
-        for (const r of started)
-            await this.recheck(r.id, now);
-    }
-    /** A run never fired an hour after its tick: given up, task row first (the one lock order). */
-    async giveUp(taskRunId) {
-        const owner = await this.db
-            .selectFrom("scheduled_task_runs")
-            .select("task_id")
-            .where("id", "=", taskRunId)
-            .executeTakeFirst();
-        if (!owner)
-            return;
-        await lockTaskRow(this.db, owner.task_id);
-        await this.db
-            .updateTable("scheduled_task_runs")
-            .set({ status: "skipped", skip_reason: "missed", error: "The run could not be started" })
-            .where("id", "=", taskRunId)
-            .where("status", "=", "pending")
-            .where("fired_at", "is", null)
-            .execute();
-    }
-    /**
-     * A started run still pending long after: the tracker links, settles or releases it; one still
-     * in flight is stamped (`rechecked_at`) and goes to the back of the next rechecks.
-     */
-    async recheck(taskRunId, now) {
-        const run = await this.store.updateRun(this.db, taskRunId, {});
-        if (run?.status !== "pending")
-            return;
-        // inFlightIn takes the task row before the run (the one lock order)
-        if (await this.tracker.inFlightIn(run, now)) {
-            await this.db
-                .updateTable("scheduled_task_runs")
-                .set({ rechecked_at: now })
-                .where("id", "=", taskRunId)
-                .execute();
-        }
-    }
 };
 __decorate([
     LockedCron("* * * * *", { name: SCHED_SCAN_JOB })
@@ -278,21 +176,14 @@ __decorate([
 __decorate([
     Transactional()
 ], ScheduledTaskScanJob.prototype, "quarantine", null);
-__decorate([
-    Transactional()
-], ScheduledTaskScanJob.prototype, "giveUp", null);
-__decorate([
-    Transactional()
-], ScheduledTaskScanJob.prototype, "recheck", null);
 ScheduledTaskScanJob = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
     __param(2, Inject(KernelConfigService)),
     __param(3, Inject(ScheduledTaskStore)),
-    __param(4, Inject(ScheduledTaskRunTracker)),
-    __param(5, Inject(getQueueToken(MAINTENANCE_QUEUE_NAME))),
-    __param(6, Inject(LockService)),
-    __param(7, Inject(KERNEL_LOGGER))
+    __param(4, Inject(OutboxService)),
+    __param(5, Inject(LockService)),
+    __param(6, Inject(KERNEL_LOGGER))
 ], ScheduledTaskScanJob);
 export { ScheduledTaskScanJob };

package/dist/schedules/scheduled-tasks.service.d.ts

@@ -1,4 +1,3 @@
-import type { Queue } from "bullmq";
 import { AgentLookup } from "../agents/agent-lookup.js";
 import type { ModelRef } from "../agents/definition.js";
 import { ConversationAccess } from "../conversations/access.js";
@@ -7,6 +6,7 @@ import { ExtensionRegistry } from "../extensions/registry.js";
 import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
+import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { DevicePolicyService } from "../local-devices/device-policy.service.js";
 import type { KernelLogger } from "../log.js";
 import { OrgLock } from "../orgs/org-lock.js";
@@ -198,8 +198,8 @@ export declare class ScheduledTasksService {
     /** A task's model must resolve for the org and declare its effort (as a message's switch). */
     private readonly providers;
     private readonly log;
-    /** "Run now" enqueues the fire job (consumed by the worker role). */
-    private readonly maintenance;
+    /** "Run now" owes the fire job (consumed by the worker role). */
+    private readonly outbox;
     /** Network grants: the org's effective egress (network ask-to-allow spec §8.1). */
     private readonly sandbox;
     /** Network grants: the task's device's local policy summary (`remoteGrants`). */
@@ -207,8 +207,8 @@ export declare class ScheduledTasksService {
     constructor(db: KernelDb, txHost: TransactionHost, config: Pick<KernelConfigService, "get">, store: ScheduledTaskStore, orgLock: Pick<OrgLock, "lockAndAuthorize">, agents: Pick<AgentLookup, "get">, access: Pick<ConversationAccess, "isAccessible">, tools: Pick<ToolRegistry, "forAgent">, extensions: Pick<ExtensionRegistry, "list">, 
     /** A task's model must resolve for the org and declare its effort (as a message's switch). */
     providers: Pick<ProviderRegistry, "resolve">, log: Pick<KernelLogger, "warn">, 
-    /** "Run now" enqueues the fire job (consumed by the worker role). */
-    maintenance: Pick<Queue, "add">, 
+    /** "Run now" owes the fire job (consumed by the worker role). */
+    outbox: Pick<OutboxService, "add">, 
     /** Network grants: the org's effective egress (network ask-to-allow spec §8.1). */
     sandbox: Pick<SandboxService, "ceilingLimits" | "devicePolicy">, 
     /** Network grants: the task's device's local policy summary (`remoteGrants`). */
@@ -301,7 +301,7 @@ export declare class ScheduledTasksService {
     /**
      * "Run now" (spec §6), creator only: a task run for the request time, outside the schedule (no
      * unique-key conflict with a tick, and `next_run_at` does not move), fired at once through the
-     * fire job after the commit. `trial`: an attended trial run whose approvals become the task's
+     * fire job its transaction owes. `trial`: an attended trial run whose approvals become the task's
      * grants (§7). Counted in the rate limit like any run. An ended task cannot run; a paused one
      * can (only its creator gets here: the run is `manual`, which the fire's paused check lets by).
      */