@deepseek-ai/dsh-schedule 0.1.7-alpha.2 → 0.1.7-rc.2

package/lib/types/domain.js

@@ -2,11 +2,24 @@
  * Strict Schedule decoding, replay, time validation, and framing.
  * @module @deepseek-ai/dsh-schedule
  */
+import { Temporal } from '@js-temporal/polyfill';
 import { SessionLogOffset } from '@deepseek-ai/dsh-session';
 /** Durable Schedule protocol version implemented by this package. */
 export const SCHEDULE_CHANGE_VERSION = 1;
 /** Fixed v1 lower bound for a fixed-rate reminder. */
-export const MIN_EVERY_INTERVAL_SECONDS = 300;
+export const MIN_EVERY_INTERVAL_SECONDS = 60;
+/** Fixed v1 upper bound for a stored task title. */
+export const MAX_TITLE_LENGTH = 120;
+/**
+ * Longest forward or backward walk of the cron date search, in years.
+ *
+ * The proleptic Gregorian leap-year and weekday alignment repeats every 400
+ * years, so a rule that matches any local date has a match within this window;
+ * walking further can only reach a rule that never matches. Bounding the walk
+ * keeps a valid but unsatisfiable rule's creation and decision cost fixed
+ * instead of enumerating candidate dates toward the four-digit-year ceiling.
+ */
+export const CRON_SEARCH_HORIZON_YEARS = 400;
 const MIN_FOUR_DIGIT_YEAR_MS = Date.parse('0001-01-01T00:00:00.000Z');
 const MAX_FOUR_DIGIT_YEAR_MS = Date.parse('9999-12-31T23:59:59.999Z');
 const UTC_INSTANT = /^(?!0000)\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])T(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d\.\d{3}Z$/;
@@ -16,8 +29,8 @@ const OFFSET_INSTANT = new RegExp(String.raw `^(?<year>\d{4})-(?<month>\d{2})-(?
     + String.raw `(?<offsetHour>\d{2}):(?<offsetMinute>\d{2}))$`);
 const LOCAL_DATE = /^(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})$/;
 const LOCAL_TIME = /^(?<hour>\d{2}):(?<minute>\d{2}):(?<second>\d{2})(?:\.(?<fraction>\d{1,3}))?$/;
+const LOCAL_CLOCK_TIME = /^(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d{1,3})?$/;
 const IANA_ZONE = /^[A-Za-z][A-Za-z0-9_+.-]*(?:\/[A-Za-z0-9_+.-]+)+$/;
-const OFFSET_NAME = /^GMT(?:(?<sign>[+-])(?<hour>\d{2}):(?<minute>\d{2})(?::(?<second>\d{2}))?)?$/;
 /** Error from malformed or transition-invalid durable Schedule data. */
 export class ScheduleLogError extends Error {
     /** Stable machine-readable error code. */
@@ -61,9 +74,87 @@ function isRecord(value) {
 }
 /** Require exactly the named durable object keys. */
 function hasExactKeys(value, expected) {
-    const keys = Object.keys(value).sort();
-    const wanted = [...expected].sort();
-    return keys.length === wanted.length && keys.every((key, index) => key === wanted[index]);
+    const allowed = new Set(expected);
+    return expected.every(key => key in value) && Object.keys(value).every(key => allowed.has(key));
+}
+/** Require the named durable keys while admitting further optional members. */
+function hasExactKeysWithOptional(value, required, optional) {
+    const allowed = new Set([...required, ...optional]);
+    return required.every(key => key in value) && Object.keys(value).every(key => allowed.has(key));
+}
+/** Stable diagnostic for a title that is missing or empty after trimming. */
+export const REQUIRED_TITLE_MESSAGE = 'title is required and must be non-empty after trimming.';
+/**
+ * Validate the title supplied at creation.
+ *
+ * Creation requires an explicit title: a missing, blank-after-trim, or over-long
+ * value throws instead of deriving a name from the instruction.
+ * @param title - Task name supplied at creation.
+ * @returns The trimmed title; an invalid title throws ScheduleInputError.
+ */
+export function scheduleTitle(title) {
+    if (typeof title !== 'string' || title.trim().length === 0) {
+        throw new ScheduleInputError('invalid_prompt', REQUIRED_TITLE_MESSAGE);
+    }
+    const normalized = title.trim();
+    if (normalized.length > MAX_TITLE_LENGTH) {
+        throw new ScheduleInputError('invalid_prompt', `title must be at most ${MAX_TITLE_LENGTH} characters.`);
+    }
+    return normalized;
+}
+/**
+ * Validate one required stored title at the durable boundary.
+ *
+ * Only records written after titles became required are read: a missing,
+ * blank-after-trim, untrimmed, or over-long stored title is invalid, and no name
+ * is derived from the instruction.
+ * @param value - Untrusted durable title field.
+ * @returns The stored title; an invalid title throws ScheduleLogError.
+ */
+export function decodeStoredTitle(value) {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new ScheduleLogError(REQUIRED_TITLE_MESSAGE);
+    }
+    if (value.length > MAX_TITLE_LENGTH) {
+        throw new ScheduleLogError(`title must be at most ${MAX_TITLE_LENGTH} characters`);
+    }
+    if (value.trim() !== value) {
+        throw new ScheduleLogError('title must be a trimmed string');
+    }
+    return value;
+}
+/**
+ * Decode the required stored title of one durable Host record, then require its exact key set.
+ *
+ * The title decodes first so that a record without the key reports the title
+ * diagnostic rather than the record's required-key list.
+ * @param value - Untrusted durable record already known to be an object.
+ * @param expected - Exact keys the record must carry, including `title`.
+ * @param message - Diagnostic naming the record's required keys.
+ * @returns The stored title; an invalid title or key set throws ScheduleLogError.
+ */
+function decodeRecordTitle(value, expected, message) {
+    const title = decodeStoredTitle(value['title']);
+    if (!hasExactKeys(value, expected))
+        throw new ScheduleLogError(message);
+    return title;
+}
+/**
+ * Decode the stored title of one historical `schedule/change` create record.
+ *
+ * A version-1 event written before names existed has no `title` member, so the
+ * key set is required without it and the absent member decodes as undefined. A
+ * present title stays subject to the canonical stored form.
+ * @param value - Untrusted durable record already known to be an object.
+ * @param expected - Exact keys the record may carry; `title` is optional within them.
+ * @param message - Diagnostic naming the record's keys.
+ * @returns The stored title, or undefined when the historical record predates it.
+ */
+function decodeHistoricalRecordTitle(value, expected, message) {
+    const keys = expected.filter(key => key !== 'title');
+    if (!hasExactKeysWithOptional(value, keys, ['title']))
+        throw new ScheduleLogError(message);
+    return value['title'] === undefined ? undefined : decodeStoredTitle(value['title']);
 }
 /** Validate one stable session-local id at the durable boundary. */
 function decodeId(value) {
@@ -207,88 +298,25 @@ function parseLocalAt(value) {
     calendarEpoch(parts);
     return parts;
 }
-/** Format one epoch into exact local fields and the zone offset that produced them. */
-function localProjection(formatter, epoch) {
-    const values = Object.fromEntries(formatter.formatToParts(epoch).map(part => [part.type, part.value]));
-    const zoneName = values['timeZoneName'];
-    /* v8 ignore next -- a formatter configured with longOffset always emits this part. */
-    const offsetMatch = typeof zoneName === 'string' ? OFFSET_NAME.exec(zoneName) : null;
-    const offsetGroups = offsetMatch?.groups;
-    /* v8 ignore next -- the formatter requested longOffset, whose part is defined by Intl. */
-    if (offsetMatch === null || offsetGroups === undefined) {
-        throw new ScheduleInputError('invalid_time_zone', 'time_zone did not expose a usable UTC offset.');
-    }
-    const direction = offsetGroups['sign'] === '-' ? -1 : 1;
-    /* v8 ignore next -- some Intl builds spell UTC as bare GMT instead of GMT+00:00. */
-    const offset = offsetGroups['sign'] === undefined
-        ? 0
-        : direction * (groupNumber(offsetGroups, 'hour') * 3600
-            + groupNumber(offsetGroups, 'minute') * 60
-            + Number(offsetGroups['second'] ?? '0')) * 1_000;
-    return {
-        year: Number(values['year']),
-        month: Number(values['month']),
-        day: Number(values['day']),
-        hour: Number(values['hour']),
-        minute: Number(values['minute']),
-        second: Number(values['second']),
-        millisecond: Number(values['fractionalSecond']),
-        offset,
-    };
+/** Resolve only the earlier overlap instant; a gap fails the local-field round trip. */
+function localInstant(local, timeZone) {
+    const zoned = local.toZonedDateTime(timeZone, { disambiguation: 'earlier' });
+    return zoned.toPlainDateTime().equals(local) ? zoned.epochMilliseconds : undefined;
 }
-/** Resolve a local wall-clock value, choosing the first instant in an overlap and rejecting a gap. */
+/** Resolve a local one-shot, rejecting nonexistent wall-clock times. */
 function resolveLocalInstant(parts, timeZone) {
-    const localEpoch = calendarEpoch(parts);
-    const formatter = new Intl.DateTimeFormat('en-US-u-ca-iso8601-nu-latn', {
-        timeZone,
-        year: 'numeric',
-        month: '2-digit',
-        day: '2-digit',
-        hour: '2-digit',
-        minute: '2-digit',
-        second: '2-digit',
-        fractionalSecondDigits: 3,
-        hourCycle: 'h23',
-        timeZoneName: 'longOffset',
-    });
-    const offsets = new Set();
-    for (const delta of [-172_800_000, -86_400_000, 0, 86_400_000, 172_800_000]) {
-        const sample = Math.min(MAX_FOUR_DIGIT_YEAR_MS, Math.max(MIN_FOUR_DIGIT_YEAR_MS, localEpoch + delta));
-        offsets.add(localProjection(formatter, sample).offset);
-    }
-    const candidates = [];
-    let outOfRange = false;
-    for (const offset of offsets) {
-        const candidate = localEpoch - offset;
-        if (candidate < MIN_FOUR_DIGIT_YEAR_MS || candidate > MAX_FOUR_DIGIT_YEAR_MS) {
-            outOfRange = true;
-            continue;
-        }
-        const projected = localProjection(formatter, candidate);
-        if (projected.year === parts.year
-            && projected.month === parts.month
-            && projected.day === parts.day
-            && projected.hour === parts.hour
-            && projected.minute === parts.minute
-            && projected.second === parts.second
-            && projected.millisecond === parts.millisecond) {
-            candidates.push(candidate);
-        }
-    }
-    const first = candidates.sort((left, right) => left - right)[0];
-    if (first === undefined) {
-        if (outOfRange) {
-            throw new ScheduleInputError('time_out_of_range', 'The scheduled time must be representable as a four-digit-year RFC 3339 UTC instant.');
-        }
+    const target = localInstant(Temporal.PlainDateTime.from(parts, { overflow: 'reject' }), timeZone);
+    if (target === undefined) {
         throw new ScheduleInputError('invalid_rule', 'The local at time does not exist in the selected time zone.');
     }
-    return first;
+    return target;
 }
 /** Decode the exact v1 after record shape. */
 function decodeAfterRecord(value) {
-    if (!isRecord(value) || !hasExactKeys(value, ['id', 'kind', 'prompt', 'afterSeconds', 'scheduledAt'])) {
-        throw new ScheduleLogError('after schedule must contain exactly id, kind, prompt, afterSeconds, and scheduledAt');
-    }
+    /* v8 ignore next -- decodeLegacyScheduleRecord rejects a non-object before it dispatches here. */
+    if (!isRecord(value))
+        throw new ScheduleLogError('after schedule must be an object');
+    const title = decodeHistoricalRecordTitle(value, ['id', 'kind', 'title', 'prompt', 'afterSeconds', 'scheduledAt'], 'after schedule must contain exactly id, kind, title, prompt, afterSeconds, and scheduledAt');
     const prompt = value['prompt'];
     if (typeof prompt !== 'string' || prompt.length === 0 || prompt.trim() !== prompt) {
         throw new ScheduleLogError('after prompt must be non-empty and already trimmed');
@@ -300,6 +328,7 @@ function decodeAfterRecord(value) {
     return Object.freeze({
         id: decodeId(value['id']),
         kind: 'after',
+        ...(title === undefined ? {} : { title }),
         prompt,
         afterSeconds: afterSeconds,
         scheduledAt: decodeInstant(value['scheduledAt']),
@@ -307,9 +336,10 @@ function decodeAfterRecord(value) {
 }
 /** Decode the exact v1 absolute one-shot record shape. */
 function decodeAtRecord(value) {
-    if (!isRecord(value) || !hasExactKeys(value, ['id', 'kind', 'prompt', 'scheduledAt'])) {
-        throw new ScheduleLogError('at schedule must contain exactly id, kind, prompt, and scheduledAt');
-    }
+    /* v8 ignore next -- decodeLegacyScheduleRecord rejects a non-object before it dispatches here. */
+    if (!isRecord(value))
+        throw new ScheduleLogError('at schedule must be an object');
+    const title = decodeHistoricalRecordTitle(value, ['id', 'kind', 'title', 'prompt', 'scheduledAt'], 'at schedule must contain exactly id, kind, title, prompt, and scheduledAt');
     const prompt = value['prompt'];
     if (typeof prompt !== 'string' || prompt.length === 0 || prompt.trim() !== prompt) {
         throw new ScheduleLogError('at prompt must be non-empty and already trimmed');
@@ -317,16 +347,17 @@ function decodeAtRecord(value) {
     return Object.freeze({
         id: decodeId(value['id']),
         kind: 'at',
+        ...(title === undefined ? {} : { title }),
         prompt,
         scheduledAt: decodeInstant(value['scheduledAt']),
     });
 }
 /** Decode the exact v1 fixed-rate record shape. */
 function decodeEveryRecord(value) {
-    if (!isRecord(value)
-        || !hasExactKeys(value, ['id', 'kind', 'prompt', 'everySeconds', 'scheduledAt'])) {
-        throw new ScheduleLogError('every schedule must contain exactly id, kind, prompt, everySeconds, and scheduledAt');
-    }
+    /* v8 ignore next -- decodeLegacyScheduleRecord rejects a non-object before it dispatches here. */
+    if (!isRecord(value))
+        throw new ScheduleLogError('every schedule must be an object');
+    const title = decodeHistoricalRecordTitle(value, ['id', 'kind', 'title', 'prompt', 'everySeconds', 'scheduledAt'], 'every schedule must contain exactly id, kind, title, prompt, everySeconds, and scheduledAt');
     const prompt = value['prompt'];
     if (typeof prompt !== 'string' || prompt.length === 0 || prompt.trim() !== prompt) {
         throw new ScheduleLogError('every prompt must be non-empty and already trimmed');
@@ -341,13 +372,206 @@ function decodeEveryRecord(value) {
     return Object.freeze({
         id: decodeId(value['id']),
         kind: 'every',
+        ...(title === undefined ? {} : { title }),
         prompt,
         everySeconds: everySeconds,
         scheduledAt: decodeInstant(value['scheduledAt']),
     });
 }
-/** Decode one current durable record variant by its exact discriminator. */
-function decodeScheduleRecord(value) {
+/**
+ * Parse one strict local clock time shared by the wall-clock selectors.
+ * @param value - Candidate `HH:mm:ss` time with optional one-to-three fractional digits.
+ * @param selector - Public selector name used in the diagnostic.
+ * @returns The parsed plain time; malformed input throws ScheduleInputError.
+ */
+function localClockTime(value, selector) {
+    if (!LOCAL_CLOCK_TIME.test(value)) {
+        throw new ScheduleInputError('invalid_rule', `${selector}.time must use HH:mm:ss with optional 1-3 fractional digits, without leap seconds or 24:00.`);
+    }
+    return Temporal.PlainTime.from(value);
+}
+/** Parse strictly before Temporal can constrain or coerce the supplied time. */
+function dailyTime(value) {
+    return localClockTime(value, 'daily');
+}
+/**
+ * Parse one strict local clock time accepted by the weekly selector.
+ * @param value - Candidate `HH:mm:ss` time with optional one-to-three fractional digits.
+ * @returns The parsed plain time; malformed input throws ScheduleInputError.
+ */
+export function weeklyTime(value) {
+    return localClockTime(value, 'weekly');
+}
+/** Fail already-typed durable values without wrapping the stored-data diagnostic. */
+function rethrowLogError(error) {
+    /* v8 ignore next -- every wrapped call raises ScheduleInputError, so this pass-through never fires. */
+    if (error instanceof ScheduleLogError)
+        throw error;
+    throw new ScheduleLogError(String(error));
+}
+/** Decode a Host daily rule without re-resolving its committed UTC target. */
+function decodeDailyRecord(value) {
+    const title = decodeRecordTitle(value, ['id', 'kind', 'title', 'prompt', 'time', 'timeZone', 'scheduledAt'], 'daily schedule must contain exactly id, kind, title, prompt, time, timeZone, and scheduledAt');
+    const prompt = value['prompt'];
+    if (typeof prompt !== 'string' || prompt.length === 0 || prompt.trim() !== prompt) {
+        throw new ScheduleLogError('daily prompt must be non-empty and already trimmed');
+    }
+    const time = value['time'];
+    const timeZone = value['timeZone'];
+    if (typeof time !== 'string' || typeof timeZone !== 'string') {
+        throw new ScheduleLogError('daily time and timeZone must be strings');
+    }
+    let normalized;
+    try {
+        normalized = dailyTime(time).toString({ fractionalSecondDigits: 3 });
+        canonicalizeTimeZone(timeZone);
+    }
+    catch (error) {
+        rethrowLogError(error);
+    }
+    if (time !== normalized)
+        throw new ScheduleLogError('daily time must be normalized to HH:mm:ss.SSS');
+    return Object.freeze({
+        id: decodeId(value['id']), kind: 'daily', title, prompt, time, timeZone,
+        scheduledAt: decodeInstant(value['scheduledAt']),
+    });
+}
+/**
+ * Normalize the explicit ISO weekday set of one weekly rule.
+ * @param weekdays - Untrusted candidate weekday values.
+ * @returns Frozen unique ascending weekdays from 1 (Monday) through 7 (Sunday).
+ */
+export function normalizeWeekdays(weekdays) {
+    if (!Array.isArray(weekdays) || weekdays.length === 0) {
+        throw new ScheduleInputError('invalid_rule', 'weekly.weekdays must be a non-empty array of ISO weekday numbers.');
+    }
+    const unique = new Set();
+    for (const weekday of weekdays) {
+        if (typeof weekday !== 'number' || !Number.isInteger(weekday) || weekday < 1 || weekday > 7) {
+            throw new ScheduleInputError('invalid_rule', 'Each weekly.weekdays entry must be an integer from 1 (Monday) through 7 (Sunday).');
+        }
+        if (unique.has(weekday)) {
+            throw new ScheduleInputError('invalid_rule', `weekly.weekdays must not repeat weekday ${weekday}.`);
+        }
+        unique.add(weekday);
+    }
+    const ordered = [...unique].sort((left, right) => left - right);
+    Object.freeze(ordered);
+    return ordered;
+}
+/**
+ * Decode a Host weekly rule without re-resolving its committed UTC target.
+ * @param value - Untrusted durable record already identified as weekly.
+ * @returns Detached frozen weekly record; malformed fields throw ScheduleLogError.
+ */
+function decodeWeeklyRecord(value) {
+    const title = decodeRecordTitle(value, ['id', 'kind', 'title', 'prompt', 'time', 'timeZone', 'weekdays', 'scheduledAt'], 'weekly schedule must contain exactly id, kind, title, prompt, time, timeZone, weekdays, and scheduledAt');
+    const prompt = value['prompt'];
+    if (typeof prompt !== 'string' || prompt.length === 0 || prompt.trim() !== prompt) {
+        throw new ScheduleLogError('weekly prompt must be non-empty and already trimmed');
+    }
+    const time = value['time'];
+    const timeZone = value['timeZone'];
+    if (typeof time !== 'string' || typeof timeZone !== 'string') {
+        throw new ScheduleLogError('weekly time and timeZone must be strings');
+    }
+    try {
+        canonicalizeTimeZone(timeZone);
+    }
+    catch (error) {
+        rethrowLogError(error);
+    }
+    let normalized;
+    try {
+        normalized = weeklyTime(time).toString({ fractionalSecondDigits: 3 });
+    }
+    catch (error) {
+        rethrowLogError(error);
+    }
+    if (time !== normalized)
+        throw new ScheduleLogError('weekly time must be normalized to HH:mm:ss.SSS');
+    // normalizeWeekdays proves the field is a number array before this check compares it to the decoded copy.
+    const stored = value['weekdays'];
+    let weekdays;
+    try {
+        weekdays = normalizeWeekdays(stored);
+    }
+    catch (error) {
+        rethrowLogError(error);
+    }
+    if (weekdays.some((weekday, index) => weekday !== stored[index])) {
+        throw new ScheduleLogError('weekly weekdays must be normalized to unique ascending ISO weekday numbers');
+    }
+    return Object.freeze({
+        id: decodeId(value['id']), kind: 'weekly', title, prompt, time, timeZone,
+        weekdays, scheduledAt: decodeInstant(value['scheduledAt']),
+    });
+}
+/**
+ * Decode a Host cron rule without re-resolving its committed UTC target.
+ * @param value - Untrusted durable record already identified as cron.
+ * @returns Detached frozen cron record; malformed fields throw ScheduleLogError.
+ */
+function decodeCronRecord(value) {
+    const title = decodeRecordTitle(value, ['id', 'kind', 'title', 'prompt', 'expression', 'timeZone', 'scheduledAt'], 'cron schedule must contain exactly id, kind, title, prompt, expression, timeZone, and scheduledAt');
+    const prompt = value['prompt'];
+    if (typeof prompt !== 'string' || prompt.length === 0 || prompt.trim() !== prompt) {
+        throw new ScheduleLogError('cron prompt must be non-empty and already trimmed');
+    }
+    const expression = value['expression'];
+    const timeZone = value['timeZone'];
+    if (typeof expression !== 'string' || typeof timeZone !== 'string') {
+        throw new ScheduleLogError('cron expression and timeZone must be strings');
+    }
+    try {
+        canonicalizeTimeZone(timeZone);
+    }
+    catch (error) {
+        rethrowLogError(error);
+    }
+    let canonical;
+    try {
+        canonical = parseCronExpression(expression).expression;
+    }
+    catch (error) {
+        rethrowLogError(error);
+    }
+    if (expression !== canonical)
+        throw new ScheduleLogError('cron expression must be canonical');
+    return Object.freeze({
+        id: decodeId(value['id']), kind: 'cron', title, prompt, expression, timeZone,
+        scheduledAt: decodeInstant(value['scheduledAt']),
+    });
+}
+/**
+ * Decode a current Host task record, preserving its committed target and stored zone spelling.
+ *
+ * Every variant of a stored Host task carries its title, so the historical
+ * one-shot variants are re-checked for that member after their shape decodes.
+ * @param value - Untrusted durable JSON record.
+ * @returns Detached frozen record; malformed fields throw ScheduleLogError.
+ */
+export function decodeScheduleRecord(value) {
+    if (isRecord(value) && value['kind'] === 'daily')
+        return decodeDailyRecord(value);
+    if (isRecord(value) && value['kind'] === 'weekly')
+        return decodeWeeklyRecord(value);
+    if (isRecord(value) && value['kind'] === 'cron')
+        return decodeCronRecord(value);
+    const record = decodeLegacyScheduleRecord(value);
+    if (record.title === undefined)
+        throw new ScheduleLogError(REQUIRED_TITLE_MESSAGE);
+    return record;
+}
+/**
+ * Decode only the variants admitted by historical version-1 Session events.
+ *
+ * A record written before titles existed decodes without that member, so the
+ * fold keeps reading a log that the current creation path could not write.
+ * @param value - Untrusted durable JSON record from a Session event.
+ * @returns Detached frozen record, without a title when the event omitted it.
+ */
+function decodeLegacyScheduleRecord(value) {
     if (!isRecord(value))
         throw new ScheduleLogError('schedule record must be an object');
     switch (value['kind']) {
@@ -376,7 +600,7 @@ export function decodeScheduleChange(value) {
             return Object.freeze({
                 version: SCHEDULE_CHANGE_VERSION,
                 operation: 'create',
-                schedule: decodeScheduleRecord(value['schedule']),
+                schedule: decodeLegacyScheduleRecord(value['schedule']),
             });
         case 'delete': {
             if (!hasExactKeys(value, ['version', 'operation', 'id'])) {
@@ -446,6 +670,286 @@ export function resolveEveryOccurrence(record, acceptedAt) {
         nextScheduledAt: new Date(next).toISOString(),
     });
 }
+/** Project an explicit instant into a calendar date in the rule's zone. */
+function localDate(epoch, timeZone) {
+    return Temporal.Instant.fromEpochMilliseconds(epoch).toZonedDateTimeISO(timeZone).toPlainDate();
+}
+/** Skip every local date; used by a rule that selects by time alone. */
+const EVERY_DATE = () => true;
+/** Select the explicit ISO weekdays of one normalized weekly rule. */
+function weekdaySet(weekdays) {
+    const selected = new Set(weekdays);
+    return date => selected.has(date.dayOfWeek);
+}
+/** Find the first actual occurrence after now and, when supplied, after a delivered date. */
+function nextMatchingTarget(time, timeZone, now, matches, afterDate) {
+    let date = localDate(now, timeZone);
+    const lastDate = localDate(MAX_FOUR_DIGIT_YEAR_MS, 'UTC').add({ days: 1 });
+    if (afterDate !== undefined && Temporal.PlainDate.compare(date, afterDate) <= 0) {
+        date = afterDate.add({ days: 1 });
+    }
+    for (; Temporal.PlainDate.compare(date, lastDate) <= 0; date = date.add({ days: 1 })) {
+        if (!matches(date))
+            continue;
+        const target = localInstant(date.toPlainDateTime(time), timeZone);
+        if (target === undefined)
+            continue;
+        if (target > MAX_FOUR_DIGIT_YEAR_MS)
+            return undefined;
+        if (target >= MIN_FOUR_DIGIT_YEAR_MS && target > now)
+            return new Date(target).toISOString();
+    }
+    return undefined;
+}
+/** Find the latest actual occurrence at or before a decision without leaving the committed floor. */
+function latestDueOccurrence(timeZone, matches, time, acceptedAt, savedTarget) {
+    // Offsets are less than 24 hours; a date-line rollback can make the current local date earlier than a due date.
+    let date = localDate(acceptedAt, 'UTC').add({ days: 1 });
+    for (;; date = date.subtract({ days: 1 })) {
+        if (!matches(date))
+            continue;
+        const candidate = localInstant(date.toPlainDateTime(time), timeZone);
+        if (candidate === undefined || candidate > acceptedAt)
+            continue;
+        // A committed target remains due even if current tzdata places the rule before it.
+        return Math.max(candidate, savedTarget);
+    }
+}
+/** Resolve a wall-clock rule only when its decision is at a representable four-digit-year instant. */
+function acceptedDecision(selector, acceptedAt) {
+    if (!Number.isSafeInteger(acceptedAt)
+        || acceptedAt < MIN_FOUR_DIGIT_YEAR_MS || acceptedAt > MAX_FOUR_DIGIT_YEAR_MS) {
+        throw new ScheduleLogError(`${selector} acceptedAt must be a representable four-digit-year instant`);
+    }
+    return acceptedAt;
+}
+/** Find the first actual daily occurrence after now and, when supplied, after a delivered date. */
+function nextDailyTarget(time, timeZone, now, afterDate) {
+    return nextMatchingTarget(time, timeZone, now, EVERY_DATE, afterDate);
+}
+/**
+ * Resolve a daily decision near the decision's local date, not across its missed history.
+ * @param record - Daily rule with a committed earliest unaccepted UTC target.
+ * @param acceptedAt - Explicit wall-clock decision time, at or after the committed target.
+ * @returns Latest actual due occurrence and the next future occurrence on a later local date.
+ */
+export function resolveDailyOccurrence(record, acceptedAt) {
+    const decision = acceptedDecision('daily', acceptedAt);
+    const savedTarget = Date.parse(record.scheduledAt);
+    if (decision < savedTarget)
+        throw new ScheduleLogError('daily dispatch cannot precede the active scheduledAt');
+    const time = dailyTime(record.time);
+    const occurrence = latestDueOccurrence(record.timeZone, EVERY_DATE, time, decision, savedTarget);
+    const occurrenceAt = new Date(occurrence).toISOString();
+    const nextScheduledAt = nextDailyTarget(time, record.timeZone, decision, localDate(occurrence, record.timeZone));
+    return Object.freeze(nextScheduledAt === undefined ? { occurrenceAt } : { occurrenceAt, nextScheduledAt });
+}
+/**
+ * Find the first actual weekly occurrence after now and, when supplied, after a delivered date.
+ * @param time - Normalized local clock time of the rule.
+ * @param timeZone - Explicit zone interpreting that clock time.
+ * @param weekdays - Normalized explicit ISO weekdays of the rule.
+ * @param now - Explicit decision time in epoch milliseconds.
+ * @param afterDate - Local date of the delivered occurrence, excluded from the search.
+ * @returns The first strictly future target, or exhaustion as undefined.
+ */
+function nextWeeklyTarget(time, timeZone, weekdays, now, afterDate) {
+    return nextMatchingTarget(time, timeZone, now, weekdaySet(weekdays), afterDate);
+}
+/**
+ * Resolve a weekly decision near the decision's local date, not across its missed history.
+ * @param record - Weekly rule with a committed earliest unaccepted UTC target.
+ * @param acceptedAt - Explicit wall-clock decision time, at or after the committed target.
+ * @returns Latest actual due occurrence and the next future occurrence on a selected weekday.
+ */
+export function resolveWeeklyOccurrence(record, acceptedAt) {
+    const decision = acceptedDecision('weekly', acceptedAt);
+    const savedTarget = Date.parse(record.scheduledAt);
+    if (decision < savedTarget)
+        throw new ScheduleLogError('weekly dispatch cannot precede the active scheduledAt');
+    const time = weeklyTime(record.time);
+    const weekdays = normalizeWeekdays(record.weekdays);
+    const occurrence = latestDueOccurrence(record.timeZone, weekdaySet(weekdays), time, decision, savedTarget);
+    const occurrenceAt = new Date(occurrence).toISOString();
+    const nextScheduledAt = nextWeeklyTarget(time, record.timeZone, weekdays, decision, localDate(occurrence, record.timeZone));
+    return Object.freeze(nextScheduledAt === undefined ? { occurrenceAt } : { occurrenceAt, nextScheduledAt });
+}
+/**
+ * Build the local-date predicate of one parsed cron rule under Vixie day-of-month/day-of-week semantics.
+ *
+ * The star flag selects the branch only; it never excuses a field's matched values.
+ * When either field text starts with `*`, a local date must satisfy BOTH fields, so a
+ * stepped star such as `*` followed by `/2` still restricts the dates it matches. A bare
+ * `*` matches every value, which makes that field's match always true and degrades the
+ * AND to the other field, exactly like Vixie's `DOM_STAR`/`DOW_STAR` test. Only when
+ * neither field text starts with `*` does either field matching suffice.
+ * @param parsed - Parsed cron rule with canonical field text and matched values.
+ * @returns Whether one local date matches the rule.
+ */
+function cronDateMatch(parsed) {
+    const months = new Set(parsed.months);
+    const daysOfMonth = new Set(parsed.daysOfMonth);
+    const daysOfWeek = new Set(parsed.daysOfWeek);
+    const dayOfMonthRestricted = !parsed.dayOfMonthStar;
+    const dayOfWeekRestricted = !parsed.dayOfWeekStar;
+    return (date) => {
+        /* v8 ignore next -- both callers pre-filter by month before matching a date. */
+        if (!months.has(date.month))
+            return false;
+        const dayOfMonth = daysOfMonth.has(date.day);
+        const dayOfWeek = daysOfWeek.has(date.dayOfWeek % 7);
+        if (dayOfMonthRestricted && dayOfWeekRestricted)
+            return dayOfMonth || dayOfWeek;
+        return dayOfMonth && dayOfWeek;
+    };
+}
+/** Enumerate one parsed cron rule's local times of day in ascending wall-clock order. */
+function cronTimes(parsed) {
+    const times = [];
+    for (const hour of parsed.hours) {
+        for (const minute of parsed.minutes)
+            times.push(Temporal.PlainTime.from({ hour, minute }));
+    }
+    return times;
+}
+/**
+ * Find the first strictly future cron occurrence without leaving the four-digit UTC year range.
+ *
+ * The walk stops at {@link CRON_SEARCH_HORIZON_YEARS} past the floor date when that
+ * horizon precedes the four-digit ceiling: a rule with no match inside the horizon
+ * never matches, so its search resolves to exhaustion instead of scanning to the ceiling.
+ * @param parsed - Parsed cron rule.
+ * @param timeZone - Explicit zone interpreting its local date and time.
+ * @param floor - Instant every returned target must exceed.
+ * @returns The first matching target, or exhaustion as undefined.
+ */
+function nextCronTarget(parsed, timeZone, floor) {
+    const times = cronTimes(parsed);
+    const matches = cronDateMatch(parsed);
+    const months = new Set(parsed.months);
+    const firstDate = localDate(floor, timeZone);
+    let date = firstDate;
+    // The floor's own local wall clock, so the first date converts only candidates
+    // that can exceed it instead of its whole day of times.
+    const floorTime = Temporal.Instant.fromEpochMilliseconds(floor).toZonedDateTimeISO(timeZone).toPlainTime();
+    const ceiling = localDate(MAX_FOUR_DIGIT_YEAR_MS, 'UTC').add({ days: 1 });
+    const horizon = date.add({ years: CRON_SEARCH_HORIZON_YEARS });
+    const lastDate = Temporal.PlainDate.compare(horizon, ceiling) < 0 ? horizon : ceiling;
+    while (Temporal.PlainDate.compare(date, lastDate) <= 0) {
+        if (!months.has(date.month)) {
+            date = date.add({ months: 1 }).with({ day: 1 });
+            continue;
+        }
+        if (matches(date)) {
+            for (const time of times) {
+                if (date.equals(firstDate) && Temporal.PlainTime.compare(time, floorTime) < 0)
+                    continue;
+                const target = localInstant(date.toPlainDateTime(time), timeZone);
+                if (target === undefined)
+                    continue;
+                if (target > MAX_FOUR_DIGIT_YEAR_MS)
+                    return undefined;
+                if (target >= MIN_FOUR_DIGIT_YEAR_MS && target > floor)
+                    return new Date(target).toISOString();
+            }
+        }
+        date = date.add({ days: 1 });
+    }
+    return undefined;
+}
+/**
+ * Find the latest matching cron occurrence at or before a decision without leaving the committed floor.
+ *
+ * The walk stops at {@link CRON_SEARCH_HORIZON_YEARS} before the decision date when that
+ * horizon follows the four-digit floor, which is the local date holding that floor instant
+ * in the rule's own zone: a rule with no match inside the horizon keeps the committed target
+ * instead of scanning back to the floor, and a candidate before the floor instant is skipped.
+ * @param parsed - Parsed cron rule.
+ * @param timeZone - Explicit zone interpreting its local date and time.
+ * @param decision - Wall-clock decision time in epoch milliseconds.
+ * @param savedTarget - Committed target that stays due even when current zone data resolves past it.
+ * @returns The latest due occurrence, or the committed target when no local occurrence is representable.
+ */
+function latestCronOccurrence(parsed, timeZone, decision, savedTarget) {
+    const times = cronTimes(parsed);
+    const matches = cronDateMatch(parsed);
+    const months = new Set(parsed.months);
+    // Offsets are less than 24 hours; a date-line rollback can make a due local date
+    // later than the UTC decision date, which is why the walk starts one day after it.
+    let date = localDate(decision, 'UTC').add({ days: 1 });
+    // The floor is an instant: the earliest local date the walk may reach is the one
+    // holding it in the rule's own zone, and candidates below it are skipped, so a
+    // negative offset can still resolve a due local minute dated before the UTC floor.
+    const floorDate = localDate(MIN_FOUR_DIGIT_YEAR_MS, timeZone);
+    const horizon = date.subtract({ years: CRON_SEARCH_HORIZON_YEARS });
+    const firstDate = Temporal.PlainDate.compare(horizon, floorDate) > 0 ? horizon : floorDate;
+    while (Temporal.PlainDate.compare(date, firstDate) >= 0) {
+        if (!months.has(date.month)) {
+            date = date.with({ day: 1 }).subtract({ days: 1 });
+            continue;
+        }
+        if (matches(date)) {
+            // One conversion of the date's earliest wall clock decides whether the whole
+            // date lies beyond the decision: every later time on it is later too, so the
+            // walk steps back instead of converting the rest of a day that cannot match.
+            // An earliest time that a DST gap removes leaves the bound to the first time
+            // that does exist, and a date with no existing time keeps the full walk.
+            const earliest = times.reduce((found, time) => found ?? localInstant(date.toPlainDateTime(time), timeZone), undefined);
+            if (earliest !== undefined && earliest > decision) {
+                date = date.subtract({ days: 1 });
+                continue;
+            }
+            for (const time of [...times].reverse()) {
+                const candidate = localInstant(date.toPlainDateTime(time), timeZone);
+                if (candidate === undefined || candidate > decision || candidate < MIN_FOUR_DIGIT_YEAR_MS)
+                    continue;
+                // A committed target remains due even if current tzdata places the rule before it.
+                return Math.max(candidate, savedTarget);
+            }
+        }
+        date = date.subtract({ days: 1 });
+    }
+    return savedTarget;
+}
+/**
+ * Resolve a cron decision near the decision's local date, not across its missed history.
+ * @param record - Cron rule with a committed earliest unaccepted UTC target.
+ * @param acceptedAt - Explicit wall-clock decision time, at or after the committed target.
+ * @returns Latest actual due occurrence and the first future occurrence.
+ */
+export function resolveCronOccurrence(record, acceptedAt) {
+    const decision = acceptedDecision('cron', acceptedAt);
+    const savedTarget = Date.parse(record.scheduledAt);
+    if (decision < savedTarget)
+        throw new ScheduleLogError('cron dispatch cannot precede the active scheduledAt');
+    const parsed = parseCronExpression(record.expression);
+    const occurrence = latestCronOccurrence(parsed, record.timeZone, decision, savedTarget);
+    const occurrenceAt = new Date(occurrence).toISOString();
+    const nextScheduledAt = nextCronTarget(parsed, record.timeZone, decision);
+    return Object.freeze(nextScheduledAt === undefined ? { occurrenceAt } : { occurrenceAt, nextScheduledAt });
+}
+/**
+ * Identify recurring Host records explicitly, excluding both one-shot variants.
+ * @param record - Current Host schedule record.
+ * @returns Whether the record uses a recurring rule.
+ */
+export function isRecurringScheduleRecord(record) {
+    return record.kind === 'every' || record.kind === 'daily' || record.kind === 'weekly' || record.kind === 'cron';
+}
+/**
+ * Resolve one due recurring Host record with its rule-specific calendar or interval arithmetic.
+ * @param record - Due recurring rule.
+ * @param acceptedAt - Explicit decision time in epoch milliseconds.
+ * @returns Latest due occurrence and optional future target.
+ */
+export function resolveRecurringOccurrence(record, acceptedAt) {
+    switch (record.kind) {
+        case 'every': return resolveEveryOccurrence(record, acceptedAt);
+        case 'daily': return resolveDailyOccurrence(record, acceptedAt);
+        case 'weekly': return resolveWeeklyOccurrence(record, acceptedAt);
+        case 'cron': return resolveCronOccurrence(record, acceptedAt);
+    }
+}
 /** Apply one decoded dispatch to its exact active record. */
 function dispatchedRecord(record, change) {
     const hasAcceptedAt = 'acceptedAt' in change;
@@ -464,9 +968,8 @@ function dispatchedRecord(record, change) {
 /**
  * Apply already-decoded Schedule changes to one complete fold value.
  *
- * This is the single transition authority shared by full-log replay and the
- * incremental Session projection. One mutable Map/Set pair spans the whole
- * batch; the returned arrays are materialized and frozen once.
+ * The transition authority for full-log replay. One mutable Map/Set pair spans
+ * the whole batch; the returned arrays are materialized and frozen once.
  * @param folded - complete active records and used-id history before the changes.
  * @param changes - strictly decoded durable mutations in log order.
  * @returns the complete fold value after every mutation.
@@ -553,13 +1056,14 @@ export function allocateScheduleId(folded) {
 }
 /**
  * Validate a model after rule and compute its durable target.
- * @param id - Already allocated session-local id.
+ * @param id - Already allocated task id.
  * @param prompt - Reminder content supplied at creation.
  * @param afterSeconds - Requested positive delay.
- * @param now - Single creation-time wall-clock sample in epoch milliseconds.
+ * @param now - Single rule-acceptance wall-clock sample in epoch milliseconds.
+ * @param title - Required task name supplied at creation.
  * @returns Frozen durable after record.
  */
-export function createAfterScheduleRecord(id, prompt, afterSeconds, now) {
+export function createAfterScheduleRecord(id, prompt, afterSeconds, now, title) {
     const normalizedPrompt = prompt.trim();
     if (normalizedPrompt.length === 0) {
         throw new ScheduleInputError('invalid_prompt', 'prompt must be non-empty after trimming.');
@@ -572,6 +1076,7 @@ export function createAfterScheduleRecord(id, prompt, afterSeconds, now) {
     return Object.freeze({
         id,
         kind: 'after',
+        title: scheduleTitle(title),
         prompt: normalizedPrompt,
         afterSeconds,
         scheduledAt: futureInstant(target, now),
@@ -579,17 +1084,32 @@ export function createAfterScheduleRecord(id, prompt, afterSeconds, now) {
 }
 /**
  * Validate an absolute selector and compute its sole durable UTC target.
- * @param id - Already allocated session-local id.
+ * @param id - Already allocated task id.
  * @param prompt - Reminder content supplied at creation.
  * @param at - Explicit-offset instant or structured local calendar value.
- * @param now - Single creation-time wall-clock sample in epoch milliseconds.
+ * @param now - Single rule-acceptance wall-clock sample in epoch milliseconds.
+ * @param title - Required task name supplied at creation.
  * @returns Frozen durable absolute one-shot record.
  */
-export function createAtScheduleRecord(id, prompt, at, now) {
+export function createAtScheduleRecord(id, prompt, at, now, title) {
     const normalizedPrompt = prompt.trim();
     if (normalizedPrompt.length === 0) {
         throw new ScheduleInputError('invalid_prompt', 'prompt must be non-empty after trimming.');
     }
+    return Object.freeze({
+        id,
+        kind: 'at',
+        title: scheduleTitle(title),
+        prompt: normalizedPrompt,
+        scheduledAt: futureInstant(parseAtInput(at), now),
+    });
+}
+/**
+ * Parse an absolute selector without requiring it to be future.
+ * @param at - Explicit-offset instant or strict local calendar input.
+ * @returns Resolved epoch milliseconds; malformed input throws ScheduleInputError.
+ */
+export function parseAtInput(at) {
     let target;
     if (typeof at === 'string') {
         target = parseOffsetInstant(at);
@@ -615,22 +1135,18 @@ export function createAtScheduleRecord(id, prompt, at, now) {
     else {
         throw new ScheduleInputError('invalid_rule', 'at must be an explicit-offset string or local calendar object.');
     }
-    return Object.freeze({
-        id,
-        kind: 'at',
-        prompt: normalizedPrompt,
-        scheduledAt: futureInstant(target, now),
-    });
+    return target;
 }
 /**
- * Validate a fixed-rate selector and compute its first creation-aligned target.
- * @param id - Already allocated session-local id.
+ * Validate a fixed-rate selector and compute the first target of a new interval anchor.
+ * @param id - Already allocated task id.
  * @param prompt - Reminder content supplied at creation.
  * @param everySeconds - Requested fixed safe-integer interval.
- * @param now - Single creation-time wall-clock sample in epoch milliseconds.
+ * @param now - Single rule-acceptance wall-clock sample in epoch milliseconds.
+ * @param title - Required task name supplied at creation.
  * @returns Frozen durable fixed-rate record.
  */
-export function createEveryScheduleRecord(id, prompt, everySeconds, now) {
+export function createEveryScheduleRecord(id, prompt, everySeconds, now, title) {
     const normalizedPrompt = prompt.trim();
     if (normalizedPrompt.length === 0) {
         throw new ScheduleInputError('invalid_prompt', 'prompt must be non-empty after trimming.');
@@ -646,22 +1162,393 @@ export function createEveryScheduleRecord(id, prompt, everySeconds, now) {
     return Object.freeze({
         id,
         kind: 'every',
+        title: scheduleTitle(title),
         prompt: normalizedPrompt,
         everySeconds,
         scheduledAt: futureInstant(target, now),
     });
 }
+/**
+ * Create a daily wall-clock rule with a strictly future committed UTC target.
+ * @param id - Already allocated task identity.
+ * @param prompt - Reminder content supplied at creation.
+ * @param daily - Strict local time and explicit IANA zone.
+ * @param now - Single rule-acceptance wall-clock sample in epoch milliseconds.
+ * @param title - Required task name supplied at creation.
+ * @returns Frozen daily record; absent future dates throw time_out_of_range.
+ */
+export function createDailyScheduleRecord(id, prompt, daily, now, title) {
+    const normalizedPrompt = prompt.trim();
+    if (normalizedPrompt.length === 0) {
+        throw new ScheduleInputError('invalid_prompt', 'prompt must be non-empty after trimming.');
+    }
+    const { time, timeZone } = parseDailyInput(daily);
+    if (!Number.isSafeInteger(now) || now < MIN_FOUR_DIGIT_YEAR_MS || now > MAX_FOUR_DIGIT_YEAR_MS) {
+        throw new ScheduleInputError('time_out_of_range', 'Daily creation time must be a representable four-digit-year UTC instant.');
+    }
+    const scheduledAt = nextDailyTarget(dailyTime(time), timeZone, now);
+    if (scheduledAt === undefined) {
+        throw new ScheduleInputError('time_out_of_range', 'No future daily occurrence is representable as a four-digit-year UTC instant.');
+    }
+    return Object.freeze({
+        id, kind: 'daily', title: scheduleTitle(title), prompt: normalizedPrompt, time, timeZone, scheduledAt,
+    });
+}
+/**
+ * Normalize a daily selector without calculating a new committed target.
+ * @param daily - Strict local time and explicit IANA zone.
+ * @returns Normalized time and canonical zone; malformed input throws ScheduleInputError.
+ */
+export function parseDailyInput(daily) {
+    if (!isRecord(daily) || !hasExactKeys(daily, ['time', 'time_zone']) || typeof daily['time'] !== 'string') {
+        throw new ScheduleInputError('invalid_rule', 'daily must contain exactly time and time_zone, with time HH:mm:ss and optional 1-3 fractional digits.');
+    }
+    if (typeof daily['time_zone'] !== 'string') {
+        throw new ScheduleInputError('invalid_time_zone', 'time_zone must be a string.');
+    }
+    return {
+        time: dailyTime(daily['time']).toString({ fractionalSecondDigits: 3 }),
+        timeZone: canonicalizeTimeZone(daily['time_zone']),
+    };
+}
+/**
+ * Create a weekly wall-clock rule with a strictly future committed UTC target.
+ * @param id - Already allocated task identity.
+ * @param prompt - Reminder content supplied at creation.
+ * @param weekly - Strict local time, explicit IANA zone, and explicit ISO weekday set.
+ * @param now - Single rule-acceptance wall-clock sample in epoch milliseconds.
+ * @param title - Required task name supplied at creation.
+ * @returns Frozen weekly record; absent future weekdays throw time_out_of_range.
+ */
+export function createWeeklyScheduleRecord(id, prompt, weekly, now, title) {
+    const normalizedPrompt = prompt.trim();
+    if (normalizedPrompt.length === 0) {
+        throw new ScheduleInputError('invalid_prompt', 'prompt must be non-empty after trimming.');
+    }
+    const { time, timeZone, weekdays } = parseWeeklyInput(weekly);
+    if (!Number.isSafeInteger(now) || now < MIN_FOUR_DIGIT_YEAR_MS || now > MAX_FOUR_DIGIT_YEAR_MS) {
+        throw new ScheduleInputError('time_out_of_range', 'Weekly creation time must be a representable four-digit-year UTC instant.');
+    }
+    const scheduledAt = nextWeeklyTarget(weeklyTime(time), timeZone, weekdays, now);
+    if (scheduledAt === undefined) {
+        throw new ScheduleInputError('time_out_of_range', 'No future weekly occurrence is representable as a four-digit-year UTC instant.');
+    }
+    return Object.freeze({
+        id, kind: 'weekly', title: scheduleTitle(title), prompt: normalizedPrompt, time, timeZone,
+        weekdays, scheduledAt,
+    });
+}
+/**
+ * Create a cron wall-clock rule with a strictly future committed UTC target.
+ * @param id - Already allocated task identity.
+ * @param prompt - Reminder content supplied at creation.
+ * @param cron - Strict five-field expression and explicit IANA zone.
+ * @param now - Single rule-acceptance wall-clock sample in epoch milliseconds.
+ * @param title - Required task name supplied at creation.
+ * @returns Frozen cron record; absent future occurrences throw time_out_of_range.
+ */
+export function createCronScheduleRecord(id, prompt, cron, now, title) {
+    const normalizedPrompt = prompt.trim();
+    if (normalizedPrompt.length === 0) {
+        throw new ScheduleInputError('invalid_prompt', 'prompt must be non-empty after trimming.');
+    }
+    const { expression, timeZone } = parseCronInput(cron);
+    if (!Number.isSafeInteger(now) || now < MIN_FOUR_DIGIT_YEAR_MS || now > MAX_FOUR_DIGIT_YEAR_MS) {
+        throw new ScheduleInputError('time_out_of_range', 'Cron creation time must be a representable four-digit-year UTC instant.');
+    }
+    const scheduledAt = nextCronTarget(parseCronExpression(expression), timeZone, now);
+    if (scheduledAt === undefined) {
+        throw new ScheduleInputError('time_out_of_range', 'No future cron occurrence is representable as a four-digit-year UTC instant.');
+    }
+    return Object.freeze({
+        id, kind: 'cron', title: scheduleTitle(title), prompt: normalizedPrompt, expression, timeZone, scheduledAt,
+    });
+}
+/**
+ * Normalize a weekly selector without calculating a new committed target.
+ * @param weekly - Strict local time, explicit IANA zone, and explicit ISO weekday set.
+ * @returns Normalized time, canonical zone, and unique ascending weekdays; malformed input throws ScheduleInputError.
+ */
+export function parseWeeklyInput(weekly) {
+    if (!isRecord(weekly)
+        || !hasExactKeys(weekly, ['time', 'time_zone', 'weekdays'])
+        || typeof weekly['time'] !== 'string') {
+        throw new ScheduleInputError('invalid_rule', 'weekly must contain exactly time, time_zone, and weekdays, with time HH:mm:ss and optional 1-3 fractional digits.');
+    }
+    if (typeof weekly['time_zone'] !== 'string') {
+        throw new ScheduleInputError('invalid_time_zone', 'time_zone must be a string.');
+    }
+    return {
+        time: weeklyTime(weekly['time']).toString({ fractionalSecondDigits: 3 }),
+        timeZone: canonicalizeTimeZone(weekly['time_zone']),
+        weekdays: normalizeWeekdays(weekly['weekdays']),
+    };
+}
+const CRON_FIELDS = [
+    { name: 'minute', min: 0, max: 59, canonicalMax: 59 },
+    { name: 'hour', min: 0, max: 23, canonicalMax: 23 },
+    { name: 'day-of-month', min: 1, max: 31, canonicalMax: 31 },
+    { name: 'month', min: 1, max: 12, canonicalMax: 12 },
+    { name: 'day-of-week', min: 0, max: 7, canonicalMax: 6 },
+];
+/** Build the stable diagnostic for one malformed cron field element. */
+function invalidCronField(spec, element) {
+    return new ScheduleInputError('invalid_rule', `cron.expression ${spec.name} field element ${JSON.stringify(element)} must be *, a value, a-b, */n, a-b/n, `
+        + 'or a comma-separated list of those.');
+}
+/** Read one in-range cron field value. */
+function cronFieldValue(text, spec) {
+    const value = Number(text);
+    if (!Number.isSafeInteger(value) || value < spec.min || value > spec.max) {
+        throw new ScheduleInputError('invalid_rule', `cron.expression ${spec.name} field value ${text} is outside ${spec.min}-${spec.max}.`);
+    }
+    return value;
+}
+/** Read one positive cron field step. */
+function cronFieldStep(text, spec) {
+    const step = Number(text);
+    if (!Number.isSafeInteger(step) || step < 1) {
+        throw new ScheduleInputError('invalid_rule', `cron.expression ${spec.name} field step must be a positive integer.`);
+    }
+    return step;
+}
+/** Expand one comma-separated cron field into its matched value set. */
+function cronFieldValues(raw, spec) {
+    const matched = new Set();
+    for (const element of raw.split(',')) {
+        if (element.length === 0) {
+            throw new ScheduleInputError('invalid_rule', `cron.expression ${spec.name} field must not contain an empty list element.`);
+        }
+        if (element === '*') {
+            for (let value = spec.min; value <= spec.max; value += 1)
+                matched.add(value);
+            continue;
+        }
+        if (element.startsWith('*')) {
+            const stepped = /^\*\/(?<step>\d+)$/.exec(element);
+            const groups = stepped?.groups;
+            if (groups === undefined)
+                throw invalidCronField(spec, element);
+            const stepText = groups['step'];
+            /* v8 ignore next -- a successful fixed regex always provides the step group. */
+            if (stepText === undefined)
+                throw invalidCronField(spec, element);
+            const step = cronFieldStep(stepText, spec);
+            for (let value = spec.min; value <= spec.max; value += step)
+                matched.add(value);
+            continue;
+        }
+        const parsed = /^(?<start>\d+)(?:-(?<end>\d+))?(?:\/(?<step>\d+))?$/.exec(element);
+        const groups = parsed?.groups;
+        if (groups === undefined)
+            throw invalidCronField(spec, element);
+        const startText = groups['start'];
+        /* v8 ignore next -- a successful fixed regex always provides the start group. */
+        if (startText === undefined)
+            throw invalidCronField(spec, element);
+        const start = cronFieldValue(startText, spec);
+        const end = groups['end'];
+        const stepText = groups['step'];
+        if (end === undefined) {
+            if (stepText !== undefined)
+                throw invalidCronField(spec, element);
+            matched.add(start);
+            continue;
+        }
+        const last = cronFieldValue(end, spec);
+        if (start > last) {
+            throw new ScheduleInputError('invalid_rule', `cron.expression ${spec.name} field range ${start}-${last} is inverted.`);
+        }
+        const step = stepText === undefined ? 1 : cronFieldStep(stepText, spec);
+        for (let value = start; value <= last; value += step)
+            matched.add(value);
+    }
+    const values = new Set();
+    for (const value of matched) {
+        values.add(spec.canonicalMax !== spec.max && value === spec.max ? spec.min : value);
+    }
+    return [...values].sort((left, right) => left - right);
+}
+/**
+ * Read one value the encoder already proved present.
+ * @param values - matched value set the parser always fills.
+ * @param index - index the caller derived from that set.
+ * @returns the value at that index.
+ */
+function cronFieldValueAt(values, index) {
+    const value = values[index];
+    /* v8 ignore next -- a parsed cron field always matches at least one value. */
+    if (value === undefined)
+        throw new ScheduleLogError('cron field encoding requires a non-empty value set');
+    return value;
+}
+/** Encode one matched value set as the shortest equivalent comma-separated cron field.
+ * @param values - Matched values in ascending order.
+ * @returns Field text that re-parses to exactly `values`, never spelled with a leading `*`.
+ */
+function encodeCronField(values) {
+    const first = cronFieldValueAt(values, 0);
+    if (values.length === 1)
+        return String(first);
+    const last = cronFieldValueAt(values, values.length - 1);
+    const step = cronFieldValueAt(values, 1) - first;
+    let uniform = true;
+    for (let index = 2; index < values.length; index += 1) {
+        if (cronFieldValueAt(values, index) - cronFieldValueAt(values, index - 1) !== step) {
+            uniform = false;
+            break;
+        }
+    }
+    if (uniform) {
+        if (step === 1)
+            return `${first}-${last}`;
+        return `${first}-${last}/${step}`;
+    }
+    const parts = [];
+    let runStart = first;
+    for (let index = 1; index < values.length; index += 1) {
+        const current = cronFieldValueAt(values, index);
+        const previous = cronFieldValueAt(values, index - 1);
+        if (current === previous + 1)
+            continue;
+        parts.push(runStart === previous ? String(runStart) : `${runStart}-${previous}`);
+        runStart = current;
+    }
+    const final = cronFieldValueAt(values, values.length - 1);
+    parts.push(runStart === final ? String(runStart) : `${runStart}-${final}`);
+    return parts.join(',');
+}
+/**
+ * One uniform walk from a field's minimum, folded exactly as a parsed field folds.
+ * @param spec - Field range and canonical maximum.
+ * @param step - Positive step of the walk.
+ * @returns Ascending values `step` produces from the minimum.
+ */
+function starWalk(spec, step) {
+    const walked = new Set();
+    for (let value = spec.min; value <= spec.max; value += step) {
+        walked.add(spec.canonicalMax !== spec.max && value === spec.max ? spec.min : value);
+    }
+    return [...walked].sort((left, right) => left - right);
+}
+/**
+ * Canonical spelling of a field whose text started with `*`.
+ *
+ * Only a `*`-prefixed spelling keeps the star flag, and only the bare star or a star-step
+ * (a `*` followed by `/n`) admits a leading `*`, so the encoding is the bare star for every
+ * value, otherwise the widest star-step walk plus any remaining values as a list.
+ * Re-parsing therefore reproduces both the star flag and the matched set, which is what
+ * keeps day-of-month/day-of-week AND/OR selection stable across a stored canonical
+ * expression.
+ * @param values - Matched values in ascending order.
+ * @param spec - Field range and canonical maximum.
+ * @returns Canonical field text that starts with `*`.
+ */
+function encodeStarCronField(values, spec) {
+    if (values.length === spec.canonicalMax - spec.min + 1)
+        return '*';
+    const present = new Set(values);
+    let bestStep;
+    let bestWalk = [];
+    for (let step = 1; step <= spec.max - spec.min + 1; step += 1) {
+        const walk = starWalk(spec, step);
+        if (walk.length > bestWalk.length && walk.every(value => present.has(value))) {
+            bestStep = step;
+            bestWalk = walk;
+        }
+    }
+    /* v8 ignore next -- the widest step yields the single minimum, which every `*`-led field matches. */
+    if (bestStep === undefined)
+        throw new ScheduleInputError('invalid_rule', `${spec.name} cannot keep a leading \`*\`.`);
+    const walked = new Set(bestWalk);
+    const remaining = values.filter(value => !walked.has(value));
+    const walkText = `*/${bestStep}`;
+    return remaining.length === 0
+        ? walkText
+        : `${walkText},${encodeCronField(remaining)}`;
+}
+/**
+ * Parse one cron field into its matched values, canonical spelling, and star flag.
+ *
+ * The star flag tests the field text's first character, which is how Vixie sets
+ * `DOM_STAR`/`DOW_STAR`: a stepped star (`*` followed by `/2`) is a star although
+ * it matches half the range, while an explicit full range such as `1-31` is
+ * restricted. Canonicalization preserves the flag: a `*`-led field keeps a `*`-led
+ * spelling, and a field that did not start with `*` is never spelled as a star-step.
+ */
+function parseCronField(raw, spec) {
+    const values = cronFieldValues(raw, spec);
+    const star = raw.startsWith('*');
+    return Object.freeze({
+        values: Object.freeze(values),
+        canonical: star ? encodeStarCronField(values, spec) : encodeCronField(values),
+        star,
+    });
+}
+/** Parse and canonicalize one strict five-field cron expression. */
+function parseCronExpression(expression) {
+    if (typeof expression !== 'string' || expression.length === 0 || expression.trim() !== expression) {
+        throw new ScheduleInputError('invalid_rule', 'cron.expression must be a non-empty trimmed string.');
+    }
+    const fields = expression.split(/\s+/);
+    if (fields.length !== 5) {
+        throw new ScheduleInputError('invalid_rule', 'cron.expression must contain exactly five whitespace-separated fields: '
+            + 'minute hour day-of-month month day-of-week.');
+    }
+    const [minute, hour, dayOfMonth, month, dayOfWeek] = fields.map((field, index) => {
+        const fieldSpec = CRON_FIELDS[index];
+        /* v8 ignore next -- the five-field split bounds this index. */
+        if (fieldSpec === undefined)
+            throw new ScheduleLogError('cron field specification is missing');
+        return parseCronField(field, fieldSpec);
+    });
+    return Object.freeze({
+        expression: [minute, hour, dayOfMonth, month, dayOfWeek].map(field => field.canonical).join(' '),
+        minutes: minute.values,
+        hours: hour.values,
+        daysOfMonth: dayOfMonth.values,
+        months: month.values,
+        daysOfWeek: dayOfWeek.values,
+        dayOfMonthStar: dayOfMonth.star,
+        dayOfWeekStar: dayOfWeek.star,
+    });
+}
+/**
+ * Canonicalize one strict five-field cron expression.
+ * @param expression - Candidate `minute hour day-of-month month day-of-week` expression.
+ * @returns The canonical expression; malformed or unsupported input throws ScheduleInputError.
+ */
+export function canonicalizeCronExpression(expression) {
+    return parseCronExpression(expression).expression;
+}
+/**
+ * Normalize a cron selector without calculating a new committed target.
+ * @param cron - Strict five-field expression and explicit IANA zone.
+ * @returns The canonical expression and canonical zone; malformed input throws ScheduleInputError.
+ */
+export function parseCronInput(cron) {
+    if (!isRecord(cron) || !hasExactKeys(cron, ['expression', 'time_zone']) || typeof cron['expression'] !== 'string') {
+        throw new ScheduleInputError('invalid_rule', 'cron must contain exactly expression and time_zone, with a five-field cron expression.');
+    }
+    if (typeof cron['time_zone'] !== 'string') {
+        throw new ScheduleInputError('invalid_time_zone', 'time_zone must be a string.');
+    }
+    return {
+        expression: parseCronExpression(cron['expression']).expression,
+        timeZone: canonicalizeTimeZone(cron['time_zone']),
+    };
+}
 /**
  * Derive one execution-local management view.
  * @param record - Active durable record.
  * @param now - Wall-clock sample used for its timing state.
- * @returns Complete session-local view.
+ * @returns Complete Host delivery view.
  */
 export function scheduleView(record, now) {
     return Object.freeze({
         ...record,
         state: now >= Date.parse(record.scheduledAt) ? 'overdue' : 'scheduled',
-        deliveryMode: 'session-local',
+        deliveryMode: 'host',
     });
 }
 /**
@@ -679,11 +1566,11 @@ export function renderReminderFraming(record) {
     ].join('\n');
 }
 /**
- * Render one injection-resistant fixed-rate batch in target and create order.
+ * Render one injection-resistant recurring batch in the supplied order.
  * @param reminders - Complete admitted batch with one latest occurrence per record.
  * @returns Stable model-visible text whose dynamic payload is canonical JSON.
  */
-export function renderEveryReminderBatchFraming(reminders) {
+export function renderRecurringReminderBatchFraming(reminders) {
     const payload = reminders.map(({ record, occurrenceAt }) => ({
         schedule_id: record.id,
         occurrence_at: occurrenceAt,