@frockbot/plugin-routines 0.3.8 → 0.3.10

package/src/scheduler.test.ts

@@ -10,6 +10,7 @@ import { RoutineInboxStore } from "./inbox-store.js";
 import { createMemoryRoutineStorageV1 } from "./testing.js";
 import {
   routineFireKeyV1,
+  routineKeyV1,
   routineScheduleKeyV1,
   ROUTINE_FAILURE_PAUSE_AFTER,
   ROUTINE_FIRE_LEASE_MS,
@@ -575,7 +576,7 @@ describe("an abandoned firing", () => {
   });
 
   test("releases a lock nothing can decode", async () => {
-    const { storage, scheduler, store, create } = harness({
+    const { storage, time, scheduler, store, create } = harness({
       start: "2026-01-01T08:59:00.000Z",
       schedule: "0 9 * * *",
     });
@@ -759,6 +760,119 @@ describe("a failed firing", () => {
   });
 });
 
+describe("what a failing Routine tells the person", () => {
+  // The inbox entry, the run-log summary and the notification all carried
+  // `tool occurrence "tool:1:1:1" was not settled before step end`.
+  test("writes a sentence, and keeps the kernel string on the run log", async () => {
+    const { storage, time, scheduler, store, create } = harness({
+      start: "2026-01-01T00:00:00.000Z",
+      schedule: "@every 1m",
+    });
+    await store.execute(create, USER);
+    time.set("2026-01-01T00:01:00.000Z");
+    const raw =
+      'Bot turn ended with outcome model-error: tool occurrence "tool:1:1:1" was not settled before step end';
+    await drain(scheduler, { status: "failed", summary: raw });
+
+    const entries = await new RoutineInboxStore(storage, {
+      now: time.now,
+    }).list();
+    expect(entries).toHaveLength(1);
+    expect(entries[0]?.text).toBe(
+      '"Morning brief" did not run: Something inside FrockBot went wrong; the run log has the details.',
+    );
+    expect(entries[0]?.text).not.toContain("tool occurrence");
+    // The operator's copy is untouched.
+    const runs = await storage.list<unknown>({ prefix: ROUTINE_RUN_PREFIX });
+    expect(
+      [...runs.values()].map((row) => decodeRoutineRunEntryV1(row).summary),
+    ).toEqual([raw]);
+  });
+
+  test("a provider's own words reach the person unchanged", async () => {
+    const { storage, time, scheduler, store, create } = harness({
+      start: "2026-01-01T00:00:00.000Z",
+      schedule: "@every 1m",
+    });
+    await store.execute(create, USER);
+    time.set("2026-01-01T00:01:00.000Z");
+    await drain(scheduler, {
+      status: "failed",
+      summary: "the model provider is rate limiting this account",
+    });
+
+    const entries = await new RoutineInboxStore(storage, {
+      now: time.now,
+    }).list();
+    expect(entries[0]?.text).toBe(
+      '"Morning brief" did not run: the model provider is rate limiting this account',
+    );
+  });
+
+  // Sixty rows of the same sentence is not sixty things being wrong.
+  test("folds repeats of one failure into a single entry with a count", async () => {
+    const { storage, time, scheduler, store, create } = harness({
+      start: "2026-01-01T00:00:00.000Z",
+      schedule: "@every 1m",
+    });
+    await store.execute(create, USER);
+    const failure = { status: "failed" as const, summary: "flaked" };
+    for (const minute of ["00:01", "02:00", "04:00"]) {
+      time.set(`2026-01-01T${minute}:00.000Z`);
+      await drain(scheduler, failure);
+    }
+
+    const entries = await new RoutineInboxStore(storage, {
+      now: time.now,
+    }).list();
+    expect(entries).toHaveLength(1);
+    expect(entries[0]?.repeatCount).toBe(3);
+    expect(entries[0]?.createdAt).toBe("2026-01-01T04:00:00.000Z");
+    // Every firing still has its own run-log row; only the inbox collapses.
+    expect(
+      (await storage.list<unknown>({ prefix: ROUTINE_RUN_PREFIX })).size,
+    ).toBeGreaterThanOrEqual(3);
+  });
+
+  test("a different failure gets its own entry", async () => {
+    const { storage, time, scheduler, store, create } = harness({
+      start: "2026-01-01T00:00:00.000Z",
+      schedule: "@every 1m",
+    });
+    await store.execute(create, USER);
+    time.set("2026-01-01T00:01:00.000Z");
+    await drain(scheduler, { status: "failed", summary: "flaked" });
+    time.set("2026-01-01T02:00:00.000Z");
+    await drain(scheduler, { status: "failed", summary: "the disk is full" });
+
+    const entries = await new RoutineInboxStore(storage, {
+      now: time.now,
+    }).list();
+    expect(entries).toHaveLength(2);
+    expect(entries.every((entry) => entry.repeatCount === undefined)).toBe(
+      true,
+    );
+  });
+
+  // The panel showed a "Next run" five minutes in the past that never moved.
+  test("reports a backed-off Routine's next run in the future", async () => {
+    const { storage, time, scheduler, store, create } = harness({
+      start: "2026-01-01T00:00:00.000Z",
+      schedule: "@every 1m",
+    });
+    await store.execute(create, USER);
+    time.set("2026-01-01T00:01:00.000Z");
+    await drain(scheduler, { status: "failed", summary: "flaked" });
+
+    const next = (await scheduler.nextRuns()).get("brief");
+    expect(next).toBeDefined();
+    expect(Date.parse(next!)).toBeGreaterThan(time.now().getTime());
+    expect(next).toBe(
+      new Date(routineDeadlineV1(await state(storage))).toISOString(),
+    );
+  });
+});
+
 describe("an undecodable Routine record", () => {
   test("degrades that one Routine, never the whole object", async () => {
     const { storage, time, scheduler, store, create } = harness({
@@ -788,3 +902,100 @@ describe("an undecodable Routine record", () => {
     expect(await drain(scheduler)).toHaveLength(1);
   });
 });
+
+describe("a Routine deleted while it was firing", () => {
+  /**
+   * Delete sweeps the record, the clock, the lock, anything queued and the
+   * whole run log. A firing already in flight settled afterwards and wrote a
+   * run entry back under the swept key and an inbox entry naming a Routine
+   * that no longer exists — an orphan the user cannot open, delete, or
+   * explain.
+   */
+  test("leaves no run entry and no inbox entry behind", async () => {
+    const { storage, time, scheduler, store, create } = harness({
+      start: "2026-01-01T08:59:00.000Z",
+      schedule: "0 9 * * *",
+    });
+    await store.execute(create, USER);
+    time.set("2026-01-01T09:00:00.000Z");
+
+    const inbox = new RoutineInboxStore(storage);
+    await scheduler.settle(async () => {
+      // The user deletes it from the panel while the Turn is still running.
+      await store.execute(
+        {
+          schemaVersion: 1,
+          type: "routine/delete",
+          commandId: "cmd-delete",
+          botId: "scout",
+          routineId: "brief",
+        },
+        USER,
+      );
+      return { status: "failed", summary: "the model refused" };
+    });
+
+    expect(
+      storage.keys().filter((key) => key.startsWith(ROUTINE_RUN_PREFIX)),
+    ).toEqual([]);
+    expect(await inbox.list()).toEqual([]);
+    expect(await storage.get(routineFireKeyV1("brief"))).toBeUndefined();
+    expect(await storage.get(routineScheduleKeyV1("brief"))).toBeUndefined();
+    expect(await scheduler.deadlines(storage)).toEqual([]);
+  });
+
+  test("a firing whose Routine still exists settles as it always did", async () => {
+    const { storage, time, scheduler, store, create } = harness({
+      start: "2026-01-01T08:59:00.000Z",
+      schedule: "0 9 * * *",
+    });
+    await store.execute(create, USER);
+    time.set("2026-01-01T09:00:00.000Z");
+    const inbox = new RoutineInboxStore(storage);
+    await drain(scheduler, { status: "failed", summary: "the model refused" });
+    expect(
+      storage.keys().filter((key) => key.startsWith(ROUTINE_RUN_PREFIX)),
+    ).not.toEqual([]);
+    expect(await inbox.list()).toHaveLength(1);
+  });
+});
+
+describe("a stored schedule with no occurrence left", () => {
+  /**
+   * The write path refuses these now, but a record written before it did — or
+   * by an older deploy — is still in storage. The claim used to fall back to
+   * `now + ROUTINE_MISSED_GRACE_MS` when the schedule named no next run, so
+   * the Routine fired a real model Turn every five minutes for ever, with
+   * nothing on screen and no bound on the spend.
+   */
+  test("turns itself off and says why, instead of firing every five minutes", async () => {
+    const { storage, scheduler, store, create } = harness({
+      start: "2026-01-01T00:00:00.000Z",
+      schedule: "0 9 * * *",
+    });
+    await store.execute(create, USER);
+    // February the 30th, straight into storage, past the write-time guard.
+    const stored = (await storage.get(routineKeyV1("brief"))) as Record<
+      string,
+      unknown
+    >;
+    await storage.put(routineKeyV1("brief"), {
+      ...stored,
+      schedule: "0 0 30 2 *",
+    });
+    await storage.delete(routineScheduleKeyV1("brief"));
+
+    expect(await drain(scheduler)).toEqual([]);
+
+    const listed = await store.list("scout");
+    expect(listed.routines[0]!.enabled).toBe(false);
+    const runs = await store.listRuns("scout", "brief");
+    expect(runs.entries[0]!.status).toBe("skipped");
+    expect(runs.entries[0]!.summary).toContain("never comes around again");
+    // And the alarm no longer has anything to arm on for it.
+    expect(await scheduler.deadlines(storage)).toEqual([]);
+
+    // Draining again does not fire it either: it is off and its clock is gone.
+    expect(await drain(scheduler)).toEqual([]);
+  });
+});

package/src/scheduler.ts

@@ -35,6 +35,11 @@ import {
   type RoutineFireV1,
   type RoutineScheduleStateV1,
 } from "./firing.js";
+import {
+  decodeRoutineInboxEntryV1,
+  routineFailureSentenceV1,
+  type RoutineInboxEntryV1,
+} from "./inbox.js";
 import { routineTerminalRecordsV1 } from "./inbox-store.js";
 import {
   decodeRoutineRecordV1,
@@ -53,11 +58,11 @@ import {
   ROUTINE_DEFERRAL_MS,
   ROUTINE_FIRE_LEASE_MS,
   ROUTINE_FIRE_PREFIX,
+  ROUTINE_INBOX_PREFIX,
   ROUTINE_FAILURE_BACKOFF_MS,
   ROUTINE_FAILURE_PAUSE_AFTER,
   ROUTINE_FIRE_TIMEOUT_MS,
   ROUTINE_LIMIT_PER_BOT,
-  ROUTINE_MISSED_GRACE_MS,
   ROUTINE_PREFIX,
   ROUTINE_QUEUE_LIMIT,
   ROUTINE_QUEUE_PREFIX,
@@ -65,6 +70,7 @@ import {
   routineKeyV1,
   routineQueueKeyV1,
   routineQueuePrefixV1,
+  routineRunPrefixV1,
   routineScheduleKeyV1,
 } from "./storage-keys.js";
 
@@ -437,7 +443,14 @@ export class RoutineScheduler {
   async nextRuns(): Promise<Map<string, string>> {
     const next = new Map<string, string>();
     for (const { record, state } of await this.#clocks(this.#storage)) {
-      next.set(record.routineId, new Date(state.dueAt).toISOString());
+      // The deadline, not the raw due time: a Routine held back by a deferral
+      // or a failure backoff is next owed a firing when the hold ends. Reading
+      // `dueAt` alone showed a "Next run" that had already gone past and never
+      // moved, for as long as the backoff lasted.
+      next.set(
+        record.routineId,
+        new Date(routineDeadlineV1(state)).toISOString(),
+      );
     }
     return next;
   }
@@ -590,7 +603,9 @@ export class RoutineScheduler {
     record: RoutineRecordV1,
     state: RoutineScheduleStateV1,
     now: Date,
-  ): Promise<ClaimedFiringV1> {
+    // `undefined` when the schedule has no occurrence left: the Routine turns
+    // itself off and there is nothing to fire.
+  ): Promise<ClaimedFiringV1 | undefined> {
     const normalized = normalizeRoutineScheduleV1(
       record.schedule!,
       record.timezone,
@@ -629,13 +644,38 @@ export class RoutineScheduler {
     // re-owe this occurrence.
     const from = missedCount > 1 ? now : new Date(state.dueAt);
     const next = nextRoutineRunV1(normalized, from, anchor);
+    if (next === undefined) {
+      // The schedule has no occurrence left — `0 0 30 2 *` is February the
+      // 30th, and a Routine written before this was refused at write time
+      // still holds one. Falling back to "five minutes from now" turned that
+      // into a real model Turn every five minutes for ever. It is turned off
+      // instead, with a run-log entry that says why, and the firing this claim
+      // was about is abandoned rather than run.
+      await transaction.put(routineKeyV1(record.routineId), {
+        ...record,
+        enabled: false,
+        updatedAt: now.toISOString(),
+      } satisfies RoutineRecordV1);
+      await transaction.delete(routineScheduleKeyV1(record.routineId));
+      await appendRoutineRunEntryV1(transaction, {
+        schemaVersion: 1,
+        entryId: `${routineFireIdV1(record.routineId, String(state.dueAt))}-unreachable`,
+        routineId: record.routineId,
+        runId: routineFireIdV1(record.routineId, String(state.dueAt)),
+        fireId: routineFireIdV1(record.routineId, String(state.dueAt)),
+        trigger: "cron",
+        status: "skipped",
+        startedAt: now.toISOString(),
+        finishedAt: now.toISOString(),
+        summary: `The schedule "${record.schedule}" never comes around again in ${record.timezone}, so this Routine has been turned off. Give it a schedule that does and turn it back on.`,
+      } satisfies RoutineRunEntryV1);
+      return undefined;
+    }
     await transaction.put(routineScheduleKeyV1(record.routineId), {
       schemaVersion: 1,
       routineId: record.routineId,
       anchor: record.updatedAt,
-      dueAt: (
-        next ?? new Date(now.getTime() + ROUTINE_MISSED_GRACE_MS)
-      ).getTime(),
+      dueAt: next.getTime(),
       ...(state.consecutiveFailures === undefined
         ? {}
         : { consecutiveFailures: state.consecutiveFailures }),
@@ -798,14 +838,32 @@ export class RoutineScheduler {
   ): Promise<void> {
     const name = await this.#routineName(transaction, fire.routineId);
     const verb = outcome.status === "cancelled" ? "was stopped" : "did not run";
+    // The sentence, not the kernel string: the raw summary is on the run-log
+    // row this same transaction writes, which is where an operator looks.
+    const text = `"${name}" ${verb}: ${routineFailureSentenceV1(outcome.summary)}`;
+    // The same Routine failing the same way every minute is one thing that is
+    // wrong, not sixty. It folds into the entry already at the head of the
+    // inbox, which keeps its place in the order and gains a count.
+    const repeated = await this.#collapsibleFailure(
+      transaction,
+      fire.routineId,
+      text,
+    );
+    if (repeated) {
+      await transaction.put(repeated.key, {
+        ...repeated.entry,
+        runId: fire.fireId,
+        createdAt: now,
+        repeatCount: (repeated.entry.repeatCount ?? 1) + 1,
+      } satisfies RoutineInboxEntryV1);
+      return;
+    }
     const records = await routineTerminalRecordsV1({
       runId: fire.fireId,
       routineId: fire.routineId,
       routineName: name,
-      responseText:
-        outcome.summary === undefined || outcome.summary.trim().length === 0
-          ? `"${name}" ${verb}.`
-          : `"${name}" ${verb}: ${outcome.summary}`,
+      responseText: text,
+      failure: true,
       now,
       read: (key) => transaction.get(key),
     });
@@ -815,6 +873,41 @@ export class RoutineScheduler {
     }
   }
 
+  /**
+   * The newest inbox entry, when it is an unread repeat of this same failure.
+   *
+   * Only the newest: an entry the User has already read, or one with anything
+   * in front of it, is part of a history rather than the live complaint, and
+   * rewriting it would move a row the User has already looked past.
+   */
+  async #collapsibleFailure(
+    transaction: RoutineStorageWritesV1,
+    routineId: string,
+    text: string,
+  ): Promise<{ key: string; entry: RoutineInboxEntryV1 } | undefined> {
+    const newest = await transaction.list<unknown>({
+      prefix: ROUTINE_INBOX_PREFIX,
+      limit: 1,
+    });
+    for (const [key, stored] of newest) {
+      try {
+        const entry = decodeRoutineInboxEntryV1(stored);
+        if (
+          !entry.acknowledged &&
+          entry.routineId === routineId &&
+          entry.wakeId === undefined &&
+          entry.text === text
+        ) {
+          return { key, entry };
+        }
+      } catch {
+        // An entry that cannot be read is not one to fold into.
+      }
+      return undefined;
+    }
+    return undefined;
+  }
+
   async #settleFiring(
     fire: RoutineFireV1,
     outcome: RoutineFireOutcomeV1,
@@ -823,6 +916,23 @@ export class RoutineScheduler {
     const finishedAt = at.toISOString();
     await this.#storage.transaction(async (transaction) => {
       await transaction.delete(routineFireKeyV1(fire.routineId));
+      // The Routine may have been deleted while this firing was in flight.
+      // Delete sweeps the record, the clock, the lock and the whole run log,
+      // and the settlement then used to re-append a run entry under the swept
+      // key and write an inbox entry naming a Routine that no longer exists —
+      // an orphan the user cannot open, delete, or explain. Nothing outlives
+      // the record it belongs to.
+      if (
+        (await transaction.get<unknown>(routineKeyV1(fire.routineId))) ===
+        undefined
+      ) {
+        const orphans = await transaction.list<unknown>({
+          prefix: routineRunPrefixV1(fire.routineId),
+        });
+        for (const key of orphans.keys()) await transaction.delete(key);
+        await transaction.delete(routineScheduleKeyV1(fire.routineId));
+        return;
+      }
       await this.#recordOutcomeOnClock(transaction, fire, outcome, at);
       if (outcome.status !== "ok") {
         await this.#recordFailureInbox(transaction, fire, outcome, finishedAt);

package/src/shared.test.ts

@@ -97,10 +97,14 @@ describe("RoutineViewV1", () => {
     });
     if (receipt.status !== "applied") throw new Error("unreachable");
     const view = receipt.routine;
-    // The Bot writer's Session and Turn stay in the durable record.
-    expect(view.createdBy).toEqual({ kind: "bot", botId: "scout" });
-    expect(JSON.stringify(view)).not.toContain("tim:scout");
-    expect(JSON.stringify(view)).not.toContain("turn-1");
+    // The Bot writer's Session and Turn travel with it: they are provenance,
+    // not key material, and the journey asks the record to name the Turn.
+    expect(view.createdBy).toEqual({
+      kind: "bot",
+      botId: "scout",
+      sessionId: "tim:scout",
+      turnId: "turn-1",
+    });
     expect(decodeRoutineViewV1(JSON.parse(JSON.stringify(view)))).toEqual(view);
     expect(
       decodeRoutineCommandReceiptV1(JSON.parse(JSON.stringify(receipt))),

package/src/shared.ts

@@ -55,12 +55,16 @@ export const ROUTINE_LIST_MAX = 100;
 export const ROUTINE_RUN_LIST_MAX = 50;
 
 /**
- * Who wrote a Routine, as the client is told it. The Session and Turn a Bot
- * writer records stay in the durable record: the UI needs to say "the Bot wrote
- * this", not to replay the Turn that did.
+ * Who wrote a Routine, as the client is told it.
+ *
+ * A Bot writer names the Session and the Turn it wrote from. The panel only
+ * says "the Bot wrote this", but provenance that cannot answer "which Turn?"
+ * is not provenance: the audit trail and the run log both address a Turn, and
+ * a Routine that a Bot wrote must be traceable to the one that wrote it.
  */
 export type RoutineWriterViewV1 =
-  { kind: "user" } | { kind: "bot"; botId: string };
+  | { kind: "user" }
+  | { kind: "bot"; botId: string; sessionId: string; turnId: string };
 
 /** One Routine as the hosted client sees it. Never any key material. */
 export interface RoutineViewV1 {
@@ -420,10 +424,17 @@ function decodeRoutineWriterViewV1(
   if (candidate.kind !== "bot") {
     throw new RoutineDecodeError(`${label} kind is invalid`);
   }
-  routineExactKeys(candidate, ["kind", "botId"], [], label);
+  routineExactKeys(
+    candidate,
+    ["kind", "botId", "sessionId", "turnId"],
+    [],
+    label,
+  );
   return {
     kind: "bot",
     botId: routineText(candidate.botId, 128, `${label} botId`),
+    sessionId: routineText(candidate.sessionId, 128, `${label} sessionId`),
+    turnId: routineText(candidate.turnId, 128, `${label} turnId`),
   };
 }
 
@@ -709,6 +720,10 @@ export interface RoutineInboxEntryViewV1 {
   createdAt: string;
   acknowledged: boolean;
   acknowledgedAt?: string;
+  /** How many firings this entry stands for; absent means one. */
+  repeatCount?: number;
+  /** The firing did not work. */
+  failure?: true;
 }
 
 export interface RoutineInboxViewV1 {

package/src/store.test.ts

@@ -54,11 +54,19 @@ describe("RoutineStore.execute", () => {
     expect(listed.routines).toHaveLength(1);
   });
 
-  test("records a Bot writer as the Bot, and the view names no Session", async () => {
+  test("records a Bot writer as the Bot, naming the Turn that wrote it", async () => {
     const routines = store();
     const receipt = await routines.execute(create(), BOT);
     if (receipt.status !== "applied") throw new Error("unreachable");
-    expect(receipt.routine.createdBy).toEqual({ kind: "bot", botId: "scout" });
+    // Provenance that cannot answer "which Turn?" is not provenance: the view
+    // used to carry the Bot id alone, so a Routine a Bot wrote could not be
+    // traced back to the Turn that wrote it.
+    expect(receipt.routine.createdBy).toEqual({
+      kind: "bot",
+      botId: "scout",
+      sessionId: "tim:scout",
+      turnId: "turn-7",
+    });
     const stored = await routines.read("brief");
     expect(stored?.createdBy).toEqual(BOT);
   });
@@ -259,3 +267,43 @@ describe("RoutineStore run log", () => {
     expect(log.entries[0]).toMatchObject({ status: "failed" });
   });
 });
+
+describe("a schedule that never comes around", () => {
+  /**
+   * `0 0 30 2 *` is February the 30th: croner parses it happily and then never
+   * names a next run. It used to be stored, and the scheduler's clock then fell
+   * back to "five minutes from now" on every claim, so the Routine burned a
+   * whole model Turn every five minutes for ever. A schedule with no future
+   * occurrence is not a schedule.
+   */
+  test("is refused at write time, and nothing is stored", async () => {
+    const routines = store();
+    await expect(
+      routines.execute(create({ schedule: "0 0 30 2 *" }), USER),
+    ).rejects.toThrow(/never comes around again/u);
+    await expect(
+      routines.execute(
+        create({ commandId: "cmd-2", schedule: "0 0 31 4 *" }),
+        USER,
+      ),
+    ).rejects.toThrow(/never comes around again/u);
+    expect((await routines.list("scout")).routines).toHaveLength(0);
+  });
+
+  test("names the expression and the zone, so the field can be corrected", async () => {
+    const routines = store();
+    const refusal = await routines
+      .execute(create({ schedule: "0 0 30 2 *" }), USER)
+      .catch((error: unknown) => error);
+    expect((refusal as Error).message).toContain("0 0 30 2 *");
+    expect((refusal as Error).message).toContain("Australia/Sydney");
+  });
+
+  test("an ordinary rare schedule is still accepted", async () => {
+    const routines = store();
+    // February the 29th happens; it is simply not every year.
+    await expect(
+      routines.execute(create({ schedule: "0 0 29 2 *" }), USER),
+    ).resolves.toMatchObject({ status: "applied" });
+  });
+});

package/src/store.ts

@@ -21,6 +21,7 @@
 // trigger kind, and minting is D3's.
 import {
   isRoutineTimezoneV1,
+  nextRoutineRunV1,
   normalizeRoutineScheduleV1,
   RoutineScheduleError,
 } from "./cron.js";
@@ -161,9 +162,17 @@ export interface RoutineStoreOptionsV1 {
 }
 
 function writerView(writer: RoutineWriterV1): RoutineWriterViewV1 {
+  // The Session and Turn travel with the Bot writer. A Routine a Bot wrote is
+  // provenance, and provenance that cannot name the Turn it came from is only
+  // half a record: "the Bot wrote this" is not answerable to "which Turn?".
   return writer.kind === "user"
     ? { kind: "user" }
-    : { kind: "bot", botId: writer.botId };
+    : {
+        kind: "bot",
+        botId: writer.botId,
+        sessionId: writer.sessionId,
+        turnId: writer.turnId,
+      };
 }
 
 /**
@@ -774,8 +783,12 @@ export class RoutineStore {
       );
     }
     if (decoded.schedule !== undefined) {
+      let normalized;
       try {
-        normalizeRoutineScheduleV1(decoded.schedule, decoded.timezone);
+        normalized = normalizeRoutineScheduleV1(
+          decoded.schedule,
+          decoded.timezone,
+        );
       } catch (error) {
         throw new RoutineDecodeError(
           error instanceof RoutineScheduleError
@@ -783,6 +796,17 @@ export class RoutineStore {
             : `Routine schedule is invalid: ${String(error)}`,
         );
       }
+      // A syntactically valid expression can still name a moment that never
+      // arrives — `0 0 30 2 *` is February the 30th. It used to be accepted,
+      // and then the clock fell back to "five minutes from now" on every claim,
+      // so the Routine burned a whole model Turn every five minutes for ever.
+      // A schedule that never comes around is not a schedule.
+      const now = this.#now();
+      if (nextRoutineRunV1(normalized, now, now) === undefined) {
+        throw new RoutineDecodeError(
+          `schedule "${decoded.schedule}" never comes around again in ${decoded.timezone}`,
+        );
+      }
     }
     return decoded;
   }