@frockbot/plugin-routines 0.3.9 → 0.3.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frockbot/plugin-routines",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "private": false,
   "type": "module",
   "exports": {
@@ -32,12 +32,12 @@
     "typecheck": "vue-tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@frockbot/client-core": "0.3.9",
-    "@frockbot/client-ui": "0.3.9",
-    "@frockbot/configuration-core": "0.3.9",
-    "@frockbot/kernel-agent-loop": "0.3.9",
-    "@frockbot/kernel-contracts": "0.3.9",
-    "@frockbot/plugin-shell": "0.3.9",
+    "@frockbot/client-core": "0.3.11",
+    "@frockbot/client-ui": "0.3.11",
+    "@frockbot/configuration-core": "0.3.11",
+    "@frockbot/kernel-agent-loop": "0.3.11",
+    "@frockbot/kernel-contracts": "0.3.11",
+    "@frockbot/plugin-shell": "0.3.11",
     "cordis": "4.0.0-rc.8",
     "croner": "10.0.1",
     "vue": "3.5.41"

package/src/backend.ts

@@ -164,10 +164,11 @@ function errorResponse(error: unknown): Response {
       error instanceof Error ? error.message : "Routine request is invalid",
     );
   }
-  return jsonError(
-    500,
-    error instanceof Error ? error.message : "Routine request failed",
-  );
+  // A decode refusal above is the User's own request coming back at them and
+  // says what to fix. Anything reaching here is ours: it names internals the
+  // caller cannot act on, so it goes to the log and the caller gets the fact.
+  console.error("Routine request failed", error);
+  return jsonError(500, "Routine request failed");
 }
 
 /**
@@ -242,13 +243,17 @@ async function deliverHook(
       error.name === "RoutineHookError"
     ) {
       const hookError = error as RoutineHookError;
-      return jsonError(hookError.status, hookError.message);
+      // The wire body, not the reason. A refusal on this route answers the
+      // open internet, and the raw message names deployment internals — which
+      // environment variable is unset, which decoder rejected what.
+      return jsonError(
+        hookError.status,
+        hookError.publicMessage ?? "webhook delivery failed",
+      );
     }
     if (isMissingBot(error)) return jsonError(404, "Routine not found");
-    return jsonError(
-      500,
-      error instanceof Error ? error.message : "webhook delivery failed",
-    );
+    console.error("routine webhook delivery failed", error);
+    return jsonError(500, "webhook delivery failed");
   }
 }
 

package/src/client/RoutineInboxBadge.vue

@@ -6,7 +6,7 @@
 // completion becomes visible is here — a count of what has not been read, and a
 // drawer that reads it. Acknowledging is a command, never a side effect of
 // opening the drawer, so a glance does not clear the badge.
-import { UiButton, UiIcon } from "@frockbot/client-ui";
+import { formatRelativeMomentV1, UiButton, UiIcon } from "@frockbot/client-ui";
 import { frockBotWebDataKey } from "@frockbot/plugin-shell/shared";
 import { computed, inject, ref, watch } from "vue";
 import { routinesStateKey } from "./state.js";
@@ -38,10 +38,27 @@ function toggle(): void {
   if (open.value && botId.value) void routines.value.loadInbox(botId.value);
 }
 
+/** What is unread and on screen right now — never "everything unread". */
+const unreadOnScreen = computed(() =>
+  routines.value.inbox
+    .filter((entry) => !entry.acknowledged)
+    .map((entry) => entry.entryId),
+);
+
 function acknowledge(entryIds: string[]): void {
-  if (!botId.value) return;
+  if (!botId.value || entryIds.length === 0) return;
   void routines.value.acknowledgeInbox(botId.value, entryIds);
 }
+
+/**
+ * "Mark all read" means the entries the reader can see, not every unread entry
+ * the object holds. An empty list acknowledges everything, including a firing
+ * that landed a second ago and has never been rendered — with a `@every 1m`
+ * Routine that is a completion silently marked read and never read.
+ */
+function markAllRead(): void {
+  acknowledge(unreadOnScreen.value);
+}
 </script>
 
 <template>
@@ -61,10 +78,10 @@ function acknowledge(entryIds: string[]): void {
       <header class="routine-inbox__header">
         <h2>Routine completions</h2>
         <UiButton
-          v-if="count > 0"
+          v-if="unreadOnScreen.length > 0"
           variant="ghost"
           :disabled="routines.busy"
-          @click="acknowledge([])"
+          @click="markAllRead()"
           >Mark all read</UiButton
         >
       </header>
@@ -81,7 +98,9 @@ function acknowledge(entryIds: string[]): void {
           <p class="routine-inbox__attribution">{{ entry.attribution }}</p>
           <p class="routine-inbox__text">{{ entry.text }}</p>
           <footer class="routine-inbox__meta">
-            <span>{{ entry.createdAt }}</span>
+            <time :datetime="entry.createdAt">{{
+              formatRelativeMomentV1(entry.createdAt)
+            }}</time>
             <!-- One thing going wrong repeatedly is one entry and a count. -->
             <span v-if="(entry.repeatCount ?? 1) > 1"
               >Happened {{ entry.repeatCount }} times</span

package/src/client/RoutinesSection.vue

@@ -3,7 +3,15 @@
 // Routine. It renders durable state and submits versioned commands; it decides
 // nothing — "Next run" is the moment the scheduler has actually armed an alarm
 // on, sent down with the Routine, and blank when there is none to promise.
-import { UiAnchor, UiButton, UiField, UiIcon } from "@frockbot/client-ui";
+import {
+  browserTimeZoneV1,
+  formatMomentV1,
+  formatRelativeMomentV1,
+  UiAnchor,
+  UiButton,
+  UiField,
+  UiIcon,
+} from "@frockbot/client-ui";
 import { frockBotWebDataKey } from "@frockbot/plugin-shell/shared";
 import { settingsLinkV1 } from "@frockbot/plugin-shell/settings-links";
 import { computed, inject, reactive, ref, watch } from "vue";
@@ -27,7 +35,6 @@ const formOpen = ref(false);
 const openLog = ref<string>();
 const copied = ref(false);
 const openRun = ref<string>();
-
 // An automation Turn never appears in the transcript, so opening a run here is
 // the only way to read one, and it is read-only in both directions: the view
 // carries what happened and no way to act on it.
@@ -50,6 +57,31 @@ const form = reactive({
   timezone: "UTC",
 });
 
+/**
+ * The reason the last save was refused, held beside the form rather than in
+ * the section header. The header sits above every Routine card, so on a Bot
+ * with a few Routines the refusal rendered hundreds of pixels off-screen and
+ * the form simply appeared to do nothing.
+ */
+const saveError = ref<string>();
+/** The Routine a delete has been asked for and not yet confirmed. */
+const pendingDelete = ref<RoutineViewV1>();
+
+/**
+ * Whether a refusal is about the schedule, so it can be rendered under the
+ * Schedule field. Every schedule refusal comes from one validator, and it
+ * names cron, the expression, or the time zone.
+ */
+const scheduleError = computed(() =>
+  saveError.value !== undefined &&
+  form.timing === "schedule" &&
+  /cron|schedule|expression|time zone|timezone|occurrence/iu.test(
+    saveError.value,
+  )
+    ? saveError.value
+    : undefined,
+);
+
 watch(
   botId,
   (id) => {
@@ -92,13 +124,22 @@ function summary(routine: RoutineViewV1): string {
     : "Webhook trigger";
 }
 
+/** A durable moment, read in the Routine's own zone — the one it fires on. */
+function moment(routine: RoutineViewV1, iso: string): string {
+  return formatMomentV1(iso, { timeZone: routine.timezone });
+}
+
 function startCreate(): void {
   form.routineId = undefined;
   form.name = "";
   form.prompt = "";
   form.timing = "schedule";
   form.schedule = "0 9 * * *";
-  form.timezone = "UTC";
+  // The reader's own zone, not UTC: a schedule is almost always meant in the
+  // day the person writing it is living in, and the Bot picks the same when it
+  // writes one itself.
+  form.timezone = browserTimeZoneV1();
+  saveError.value = undefined;
   formOpen.value = true;
 }
 
@@ -109,12 +150,14 @@ function startEdit(routine: RoutineViewV1): void {
   form.timing = routine.schedule ? "schedule" : "webhook";
   form.schedule = routine.schedule ?? "";
   form.timezone = routine.timezone;
+  saveError.value = undefined;
   formOpen.value = true;
 }
 
 async function submit(): Promise<void> {
   const id = botId.value;
   if (!id) return;
+  saveError.value = undefined;
   try {
     await routines.value.save(id, {
       ...(form.routineId ? { routineId: form.routineId } : {}),
@@ -126,11 +169,33 @@ async function submit(): Promise<void> {
       timezone: form.timezone.trim(),
     });
     formOpen.value = false;
-  } catch {
-    // The state holds the reason; the form stays open so it can be corrected.
+  } catch (error) {
+    // The form stays open and holds the reason itself, beside the field that
+    // caused it. The section header keeps its copy for the reader who scrolls
+    // back up, but the form no longer refuses in silence.
+    saveError.value =
+      error instanceof Error
+        ? error.message
+        : (routines.value.error ?? "Could not save the Routine");
   }
 }
 
+/**
+ * Deleting takes a Routine, its schedule, its prompt and its whole run log
+ * with it, and the button sits in a row of six others. It asks first.
+ */
+function askDelete(routine: RoutineViewV1): void {
+  pendingDelete.value = routine;
+}
+
+async function confirmDelete(): Promise<void> {
+  const routine = pendingDelete.value;
+  const id = botId.value;
+  pendingDelete.value = undefined;
+  if (!routine || !id) return;
+  await routines.value.remove(id, routine.routineId);
+}
+
 async function toggleLog(routineId: string): Promise<void> {
   const id = botId.value;
   if (!id) return;
@@ -220,7 +285,12 @@ async function toggleLog(routineId: string): Promise<void> {
       <dl class="routine-card__facts">
         <div>
           <dt>Next run</dt>
-          <dd>{{ routine.nextRunAt ?? "—" }}</dd>
+          <dd>
+            <time v-if="routine.nextRunAt" :datetime="routine.nextRunAt">{{
+              moment(routine, routine.nextRunAt)
+            }}</time>
+            <template v-else>—</template>
+          </dd>
         </div>
         <div v-if="routine.trigger">
           <dt>Webhook key</dt>
@@ -234,7 +304,15 @@ async function toggleLog(routineId: string): Promise<void> {
         </div>
         <div>
           <dt>Last run</dt>
-          <dd>{{ routine.lastRunAt ?? "Never" }}</dd>
+          <dd>
+            <time
+              v-if="routine.lastRunAt"
+              :datetime="routine.lastRunAt"
+              :title="moment(routine, routine.lastRunAt)"
+              >{{ formatRelativeMomentV1(routine.lastRunAt) }}</time
+            >
+            <template v-else>Never</template>
+          </dd>
         </div>
         <div>
           <dt>Written by</dt>
@@ -289,11 +367,36 @@ async function toggleLog(routineId: string): Promise<void> {
           type="button"
           variant="danger"
           :disabled="routines.busy"
-          @click="botId && routines.remove(botId, routine.routineId)"
+          @click="askDelete(routine)"
         >
           Delete
         </UiButton>
       </div>
+      <div
+        v-if="pendingDelete?.routineId === routine.routineId"
+        class="routine-confirm"
+        role="alertdialog"
+        :aria-label="`Delete ${routine.name}?`"
+      >
+        <strong>Delete {{ routine.name }}?</strong>
+        <small>
+          Its schedule, its prompt and its whole run log go with it. This can't
+          be undone.
+        </small>
+        <div class="routine-card__actions">
+          <UiButton type="button" @click="pendingDelete = undefined">
+            Cancel
+          </UiButton>
+          <UiButton
+            type="button"
+            variant="danger"
+            :disabled="routines.busy"
+            @click="confirmDelete"
+          >
+            Delete Routine
+          </UiButton>
+        </div>
+      </div>
       <div v-if="openLog === routine.routineId" class="routine-card__log">
         <p
           v-if="(routines.runs[routine.routineId] ?? []).length === 0"
@@ -312,7 +415,13 @@ async function toggleLog(routineId: string): Promise<void> {
               :aria-expanded="openRun === entry.runId"
               @click="toggleRun(routine.routineId, entry.runId)"
             >
-              <span>{{ entry.startedAt }}</span>
+              <span
+                ><time
+                  :datetime="entry.startedAt"
+                  :title="moment(routine, entry.startedAt)"
+                  >{{ formatRelativeMomentV1(entry.startedAt) }}</time
+                ></span
+              >
               <span>{{ entry.trigger }}</span>
               <span>{{ entry.status }}</span>
             </button>
@@ -361,8 +470,20 @@ async function toggleLog(routineId: string): Promise<void> {
           v-model="form.schedule"
           maxlength="256"
           placeholder="0 9 * * *"
+          :aria-invalid="scheduleError ? 'true' : undefined"
+          :aria-describedby="
+            scheduleError ? 'routine-schedule-error' : undefined
+          "
         />
       </UiField>
+      <p
+        v-if="scheduleError"
+        id="routine-schedule-error"
+        class="routine-form__error"
+        role="alert"
+      >
+        {{ scheduleError }}
+      </p>
       <p v-else class="routines__note">
         A delivery key is minted when the Routine is saved, and shown once.
       </p>
@@ -373,6 +494,13 @@ async function toggleLog(routineId: string): Promise<void> {
           placeholder="Australia/Sydney"
         />
       </UiField>
+      <p
+        v-if="saveError && !scheduleError"
+        class="routine-form__error"
+        role="alert"
+      >
+        {{ saveError }}
+      </p>
       <div class="routine-card__actions">
         <UiButton
           type="button"
@@ -576,6 +704,33 @@ async function toggleLog(routineId: string): Promise<void> {
   font-size: var(--frock-text-xs);
 }
 
+.routine-form__error {
+  margin: 0;
+  color: var(--frock-danger-text);
+  font-size: var(--frock-text-sm);
+}
+
+.routine-confirm {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  border: 1px solid var(--frock-danger-text);
+  border-radius: var(--frock-radius-card);
+  padding: 10px;
+  background: var(--frock-surface);
+}
+
+.routine-confirm strong {
+  color: var(--frock-text);
+  font-size: var(--frock-text-sm);
+  font-weight: 600;
+}
+
+.routine-confirm small {
+  color: var(--frock-text-muted);
+  font-size: var(--frock-text-sm);
+}
+
 .routine-form__timing {
   display: flex;
   gap: 12px;

package/src/client/index.test.ts

@@ -3,6 +3,8 @@ import type {
   ClientPluginContext,
   ClientSlotRegistration,
 } from "@frockbot/client-core";
+import { frockBotWebDataKey } from "@frockbot/plugin-shell/shared";
+import { ref } from "vue";
 import { routinesClientPlugin } from "./index.js";
 import { routinesStateKey, type RoutinesClientState } from "./state.js";
 
@@ -207,3 +209,87 @@ describe("Routines client contribution", () => {
     mounted.dispose();
   });
 });
+
+describe("the completion badge and the state channel", () => {
+  /**
+   * A Routine that finishes cannot speak in the transcript, so the badge is
+   * the only place a completion becomes visible — and it used to read the
+   * inbox only on a Bot switch and on opening the drawer. A firing that
+   * completed while the app sat open left the count stale until something else
+   * happened to reload it, which for a `@every 1m` Routine is most of the day.
+   */
+  test("reads the inbox again when the Bot's runs change", async () => {
+    const inboxReads: string[] = [];
+    let invalidate:
+      ((topic: "computer" | "runs" | undefined) => Promise<void>) | undefined;
+    let stopped = 0;
+    const shell = ref({ activeBotId: "scout" });
+    const context: ClientPluginContext = {
+      transport: {
+        turn: () => Promise.resolve({ runId: "run", text: "", events: [] }),
+        hostedRequest: (path) => {
+          if (path.endsWith("/inbox")) {
+            inboxReads.push(path);
+            return Promise.resolve({
+              schemaVersion: 1,
+              botId: "scout",
+              entries: [],
+              unacknowledged: inboxReads.length,
+            });
+          }
+          return Promise.resolve({
+            schemaVersion: 1,
+            botId: "scout",
+            routines: [],
+          });
+        },
+        watchBotState: (_botId, listener) => {
+          invalidate = listener.invalidate;
+          return () => {
+            stopped += 1;
+          };
+        },
+      },
+      inject: (key) => {
+        if (key === frockBotWebDataKey) return shell as never;
+        throw new Error("unexpected client provider");
+      },
+      provide: () => () => {},
+      slot: () => () => {},
+    };
+    const disposers = routinesClientPlugin(context);
+    if (!Array.isArray(disposers)) throw new Error("expected registrations");
+
+    expect(invalidate).toBeDefined();
+    // A Turn settling on this Bot — an automation Turn is one — refreshes it.
+    await invalidate!("runs");
+    // A resynchronise carries no topic and must not be filtered out.
+    await invalidate!(undefined);
+    // Another subsystem's news is not the badge's business.
+    await invalidate!("computer");
+    expect(inboxReads).toHaveLength(2);
+
+    shell.value = { activeBotId: "other" };
+    await Promise.resolve();
+    expect(stopped).toBe(1);
+    for (const dispose of disposers.toReversed()) dispose();
+  });
+
+  test("does not reach for the shell when the client has no state channel", () => {
+    // The Cordis local host has no channel. Injecting the shell there would
+    // throw on mount and take the whole Contribution with it.
+    const context: ClientPluginContext = {
+      transport: {
+        turn: () => Promise.resolve({ runId: "run", text: "", events: [] }),
+        hostedRequest: () =>
+          Promise.resolve({ schemaVersion: 1, botId: "scout", routines: [] }),
+      },
+      inject: () => {
+        throw new Error("unexpected client provider");
+      },
+      provide: () => () => {},
+      slot: () => () => {},
+    };
+    expect(() => routinesClientPlugin(context)).not.toThrow();
+  });
+});

package/src/client/index.ts

@@ -7,7 +7,8 @@
 // versioned command with its own idempotency key, and every read is decoded at
 // the seam before a component sees it.
 import type { ClientPlugin } from "@frockbot/client-core";
-import { ref } from "vue";
+import { frockBotWebDataKey } from "@frockbot/plugin-shell/shared";
+import { ref, watch } from "vue";
 import {
   decodeRoutineCommandReceiptV1,
   decodeRoutineInboxReceiptV1,
@@ -262,6 +263,40 @@ export const routinesClientPlugin: ClientPlugin = (ctx) => {
     },
   });
 
+  // The badge is the only place a firing that finished becomes visible, and it
+  // used to load only on a Bot switch and on opening the drawer: a Routine that
+  // completed while the app was open left the count stale until something else
+  // happened to reload it. The state channel already says when this Bot's runs
+  // changed — an automation Turn settling is one of those — so the badge reads
+  // the inbox again on that signal rather than polling or waiting for a click.
+  const watchBotState = ctx.transport.watchBotState;
+  if (watchBotState) {
+    const shell = ctx.inject(frockBotWebDataKey);
+    let stopWatching: (() => void) | undefined;
+    watch(
+      () => shell.value.activeBotId,
+      (activeBotId) => {
+        stopWatching?.();
+        stopWatching = undefined;
+        if (!activeBotId) return;
+        stopWatching = watchBotState(activeBotId, {
+          async invalidate(topic) {
+            // `undefined` is a resynchronise, so it is not filtered out.
+            if (topic !== undefined && topic !== "runs") return;
+            if (shell.value.activeBotId !== activeBotId) return;
+            await state.value.loadInbox(activeBotId);
+          },
+          status() {
+            // The badge has nothing to say about the socket itself; a closed
+            // channel simply stops refreshing it, and opening the drawer still
+            // reads the inbox.
+          },
+        });
+      },
+      { immediate: true },
+    );
+  }
+
   return [
     ctx.provide(routinesStateKey, state),
     ctx.slot({

package/src/hook.test.ts

@@ -66,7 +66,19 @@ describe("the hook token", () => {
       (error: unknown) => error,
     );
     expect(refusal).toBeInstanceOf(RoutineHookError);
-    expect((refusal as RoutineHookError).status).toBe(500);
+    // A door that was never given a key is unavailable, not broken, and the
+    // caller is told that and nothing more: the reason names the deployment's
+    // secret variable and stays in the log.
+    expect((refusal as RoutineHookError).status).toBe(503);
+    expect((refusal as RoutineHookError).message).toContain(
+      "ROUTINE_HOOK_SECRET",
+    );
+    expect((refusal as RoutineHookError).publicMessage).toBe(
+      "webhook delivery is not configured",
+    );
+    expect((refusal as RoutineHookError).publicMessage).not.toContain(
+      "ROUTINE_HOOK_SECRET",
+    );
   });
 
   test("a key version is part of the token, so a rotation is a new token", async () => {
@@ -92,14 +104,13 @@ describe("the hook token", () => {
 });
 
 describe("delivery identity", () => {
-  test("is the content when the caller sent no idempotency key", async () => {
-    expect(await routineDeliveryIdV1("brief", '{"a":1}')).toBe(
-      await routineDeliveryIdV1("brief", '{"a":1}'),
+  test("is unique per request when the caller sent no idempotency key", async () => {
+    // Two real events with the same payload are two deliveries. Hashing the
+    // body used to turn the second one into a `duplicate` receipt and no
+    // firing, with nothing anywhere saying an event had been swallowed.
+    expect(await routineDeliveryIdV1("brief", '{"ping":true}')).not.toBe(
+      await routineDeliveryIdV1("brief", '{"ping":true}'),
     );
-    expect(await routineDeliveryIdV1("brief", '{"a":1}')).not.toBe(
-      await routineDeliveryIdV1("brief", '{"a":2}'),
-    );
-    // Two Routines receiving the same body are two deliveries.
     expect(await routineDeliveryIdV1("brief", "{}")).not.toBe(
       await routineDeliveryIdV1("other", "{}"),
     );
@@ -235,9 +246,11 @@ describe("the durable half of the check", () => {
     const receipt = await store.execute(create, USER);
     const token = (receipt as { hook: { token: string } }).hook.token;
 
-    const first = await deliver(store, token, '{"event":"push"}');
+    // A replay is a delivery the caller itself said was the same one, by
+    // sending the key twice.
+    const first = await deliver(store, token, '{"event":"push"}', "evt-1");
     expect(first.status).toBe("accepted");
-    const second = await deliver(store, token, '{"event":"push"}');
+    const second = await deliver(store, token, '{"event":"push"}', "evt-1");
     expect(second).toEqual({ status: "duplicate", fireId: first.fireId });
 
     const fired: string[] = [];
@@ -250,6 +263,29 @@ describe("the durable half of the check", () => {
     expect(fired).toEqual([first.fireId]);
   });
 
+  test("two distinct deliveries with identical bodies are two firings", async () => {
+    const { scheduler, store, create } = harness();
+    const receipt = await store.execute(create, USER);
+    const token = (receipt as { hook: { token: string } }).hook.token;
+
+    // A provider that sends `{"event":"push"}` twice sent two events. Without
+    // an `Idempotency-Key` nothing has claimed they are the same delivery, and
+    // the second used to be answered `duplicate` and never fired — a swallowed
+    // event with no trace anywhere.
+    const first = await deliver(store, token, '{"event":"push"}');
+    const second = await deliver(store, token, '{"event":"push"}');
+    expect(first.status).toBe("accepted");
+    expect(second.status).toBe("accepted");
+    expect(second.fireId).not.toBe(first.fireId);
+
+    const fired: string[] = [];
+    await scheduler.settle(async (fire) => {
+      fired.push(fire.fireId);
+      return { status: "ok" };
+    });
+    expect(fired.sort()).toEqual([first.fireId, second.fireId].sort());
+  });
+
   test("a rotated key retires the one before it", async () => {
     const { store, create } = harness();
     const created = await store.execute(create, USER);

package/src/hook.ts

@@ -70,9 +70,18 @@ export interface RoutineDeliveryReceiptV1 {
 export class RoutineHookError extends Error {
   override readonly name = "RoutineHookError";
   readonly status: number;
-  constructor(status: number, message: string) {
+  /**
+   * What an anonymous caller is told. It is deliberately separate from
+   * `message`: the delivery route answers the open internet, and a refusal
+   * used to hand back the raw reason — including the name of the deployment's
+   * signing-secret variable and whether it was missing or merely short. The
+   * detail stays in `message` for the log; this is the wire body.
+   */
+  readonly publicMessage: string;
+  constructor(status: number, message: string, publicMessage?: string) {
     super(message);
     this.status = status;
+    this.publicMessage = publicMessage ?? message;
   }
 }
 
@@ -124,8 +133,10 @@ export function constantTimeEqualsV1(left: string, right: string): boolean {
 async function signingKey(secret: string): Promise<CryptoKey> {
   if (typeof secret !== "string" || secret.length < 16) {
     throw new RoutineHookError(
-      500,
+      503,
       "ROUTINE_HOOK_SECRET is missing or too short for webhook delivery",
+      // The caller learns the door is shut, not how it is built.
+      "webhook delivery is not configured",
     );
   }
   return crypto.subtle.importKey(
@@ -282,30 +293,39 @@ export function decodeRoutineHookKeyV1(value: unknown): RoutineHookKeyV1 {
 }
 
 /**
- * The delivery id one request is remembered by: the caller's `Idempotency-Key`
- * when it sent one, and otherwise the content itself. Either way the same
- * delivery twice is one firing.
+ * The delivery id one request is remembered by.
+ *
+ * Idempotency is the caller's claim to make, and only the caller can make it:
+ * an `Idempotency-Key` says "this is the same delivery I already sent", and
+ * two deliveries under one key are one firing. Without a key the id is unique
+ * per request, so two deliveries are two firings.
+ *
+ * It used to hash the body when no key was sent. That reads as a safety net
+ * and is really a silent decision about someone else's data: a provider
+ * POSTing `{"ping":true}` twice — two real events, identical payloads — got
+ * one firing and a `duplicate` receipt for the second, with nothing anywhere
+ * saying an event had been dropped. Coalescing without being asked to is worse
+ * than firing twice, because the caller can see a double firing and cannot see
+ * a swallowed one.
  */
 export async function routineDeliveryIdV1(
   routineId: string,
   body: string,
   idempotencyKey?: string | null,
 ): Promise<string> {
-  if (idempotencyKey) {
-    const trimmed = idempotencyKey.trim().slice(0, 256);
-    if (trimmed.length > 0) {
-      return hex(
-        await crypto.subtle.digest(
-          "SHA-256",
-          TEXT.encode(`key${routineId}${trimmed}`),
-        ),
-      );
-    }
+  const trimmed = idempotencyKey?.trim().slice(0, 256) ?? "";
+  if (trimmed.length > 0) {
+    return hex(
+      await crypto.subtle.digest(
+        "SHA-256",
+        TEXT.encode(`key${routineId}${trimmed}`),
+      ),
+    );
   }
   return hex(
     await crypto.subtle.digest(
       "SHA-256",
-      TEXT.encode(`body${routineId}${body}`),
+      TEXT.encode(`delivery${routineId}${crypto.randomUUID()}`),
     ),
   );
 }

package/src/inbox-store.ts

@@ -208,6 +208,33 @@ export interface StoredPendingInputV1 {
   input: PendingBotInputV1;
 }
 
+/**
+ * The inputs one drain carries, under the pending-input bound.
+ *
+ * The bound exists so a burst cannot hand a single Turn an unbounded prompt,
+ * and it used to be a flat `slice(-16)` over everything queued. But the four
+ * input kinds are not interchangeable. A dropped `wake` still has an inbox
+ * entry, so the user can read it and nothing is lost; an `approval`, a
+ * `machine-result` or a `superseded-turn` writes no entry anywhere, so
+ * dropping one silently loses a decision the user made or a result a machine
+ * produced. Those are kept whole and the cap falls on the wakes alone — the
+ * only kind that can be dropped and still be read.
+ */
+export function retainedPendingInputsV1(
+  inputs: readonly PendingBotInputV1[],
+): PendingBotInputV1[] {
+  if (inputs.length <= ROUTINE_PENDING_INPUT_LIMIT) return [...inputs];
+  const durable = inputs.filter((input) => input.kind !== "wake");
+  const budget = ROUTINE_PENDING_INPUT_LIMIT - durable.length;
+  if (budget <= 0) return durable;
+  const keptWakes = new Set(
+    inputs.filter((input) => input.kind === "wake").slice(-budget),
+  );
+  return inputs.filter(
+    (input) => input.kind !== "wake" || keptWakes.has(input),
+  );
+}
+
 export class RoutineInboxStore {
   readonly #storage: RoutineStorageV1;
   readonly #now: () => Date;
@@ -365,7 +392,7 @@ export class RoutineInboxStore {
       // active run, so no firing can settle while it runs and no wake can
       // arrive behind this read; an empty receipt would be a record of nothing.
       if (inputs.length === 0) return [];
-      const retained = inputs.slice(-ROUTINE_PENDING_INPUT_LIMIT);
+      const retained = retainedPendingInputsV1(inputs);
       await transaction.put(receiptKey, {
         schemaVersion: 1,
         runId,
@@ -377,15 +404,40 @@ export class RoutineInboxStore {
     });
   }
 
-  /** Trim the inbox to its retention bound, oldest first. */
+  /** Trim the inbox to its retention bound, acknowledged entries first. */
   async #trimInbox(): Promise<void> {
     const stored = await this.#storage.list<unknown>({
       prefix: ROUTINE_INBOX_PREFIX,
     });
-    const keys = [...stored.keys()].sort();
-    if (keys.length <= ROUTINE_INBOX_LIMIT) return;
-    for (const key of keys.slice(ROUTINE_INBOX_LIMIT)) {
+    // Inbox keys are descending, so ascending key order is newest first and
+    // the oldest entry is the last of them.
+    const entries = [...stored.entries()]
+      .sort(([left], [right]) => left.localeCompare(right))
+      .reverse();
+    let excess = entries.length - ROUTINE_INBOX_LIMIT;
+    if (excess <= 0) return;
+    // Read entries go first, oldest read before newest, and only then unread
+    // ones. Trimming purely by age used to drop a completion the reader had
+    // never seen while a dozen they had already acknowledged sat beside it —
+    // the inbox is the only place a firing ever speaks, so what has not been
+    // read is the last thing to lose.
+    const acknowledged: string[] = [];
+    const unread: string[] = [];
+    for (const [key, value] of entries) {
+      let read = false;
+      try {
+        read = decodeRoutineInboxEntryV1(value).acknowledged;
+      } catch {
+        // An entry nothing can decode says nothing to anyone; it is the first
+        // thing worth reclaiming space from.
+        read = true;
+      }
+      (read ? acknowledged : unread).push(key);
+    }
+    for (const key of [...acknowledged, ...unread]) {
+      if (excess <= 0) return;
       await this.#storage.delete(key);
+      excess -= 1;
     }
   }
 

package/src/inbox.test.ts

@@ -7,11 +7,16 @@ import {
   routineHandoffTextV1,
   subagentAttributionV1,
 } from "./inbox.js";
-import { RoutineInboxStore, routineTerminalRecordsV1 } from "./inbox-store.js";
+import {
+  retainedPendingInputsV1,
+  RoutineInboxStore,
+  routineTerminalRecordsV1,
+} from "./inbox-store.js";
 import { createMemoryRoutineStorageV1 } from "./testing.js";
 import {
   ROUTINE_INBOX_LIMIT,
   ROUTINE_INBOX_PREFIX,
+  ROUTINE_PENDING_INPUT_LIMIT,
   ROUTINE_WAKE_PREFIX,
 } from "./storage-keys.js";
 
@@ -435,3 +440,99 @@ describe("a Turn the User's next message replaced", () => {
     ).not.toContain("Subagents");
   });
 });
+
+describe("the pending-input cap", () => {
+  /**
+   * The four input kinds are not interchangeable. A dropped `wake` still has
+   * an inbox entry the user can read; an `approval`, a `machine-result` or a
+   * `superseded-turn` writes no entry anywhere, so dropping one loses a
+   * decision the user made or a result a machine produced, silently.
+   */
+  test("keeps every non-wake input and spends the budget on the wakes", async () => {
+    const store = storage();
+    const inbox = new RoutineInboxStore(store);
+    for (let index = 0; index < ROUTINE_PENDING_INPUT_LIMIT + 4; index += 1) {
+      await settle(store, { runId: `rf-${index}`, handoff: `wake ${index}` });
+    }
+    await inbox.enqueue({
+      schemaVersion: 1,
+      kind: "approval",
+      approvalId: "ap-1",
+      decision: "approved",
+      createdAt: NOW,
+    });
+    await inbox.enqueue({
+      schemaVersion: 1,
+      kind: "superseded-turn",
+      runId: "run-9",
+      unfinishedWork: true,
+      createdAt: NOW,
+    });
+
+    const drained = await inbox.drainInto("chat-run-1");
+    expect(drained).toHaveLength(ROUTINE_PENDING_INPUT_LIMIT);
+    // The approval decision and the superseded Turn survive; a flat
+    // `slice(-16)` used to drop whichever of them sat behind enough wakes.
+    expect(drained.filter((input) => input.kind === "approval")).toHaveLength(
+      1,
+    );
+    expect(
+      drained.filter((input) => input.kind === "superseded-turn"),
+    ).toHaveLength(1);
+    expect(drained.filter((input) => input.kind === "wake")).toHaveLength(
+      ROUTINE_PENDING_INPUT_LIMIT - 2,
+    );
+  });
+
+  test("keeps every durable input even when they alone exceed the bound", () => {
+    const approvals = Array.from(
+      { length: ROUTINE_PENDING_INPUT_LIMIT + 3 },
+      (_unused, index) =>
+        ({
+          schemaVersion: 1,
+          kind: "approval",
+          approvalId: `ap-${index}`,
+          decision: "approved",
+          createdAt: NOW,
+        }) as const,
+    );
+    // Over the bound is a problem worth having; losing an approval decision
+    // with nothing anywhere recording it is not.
+    expect(retainedPendingInputsV1(approvals)).toHaveLength(approvals.length);
+  });
+});
+
+describe("inbox retention", () => {
+  test("gives up read entries before unread ones", async () => {
+    const store = storage();
+    const inbox = new RoutineInboxStore(store);
+    for (let index = 0; index < ROUTINE_INBOX_LIMIT; index += 1) {
+      await settle(store, {
+        runId: `rf-${String(index).padStart(4, "0")}`,
+        responseText: `run ${index}`,
+      });
+    }
+    // The reader has caught up on everything so far.
+    await inbox.acknowledge([]);
+    // Five more land while they are away.
+    for (let index = 0; index < 5; index += 1) {
+      await settle(store, {
+        runId: `rf-new-${index}`,
+        responseText: `fresh ${index}`,
+      });
+    }
+
+    const entries = await inbox.list();
+    expect(entries).toHaveLength(ROUTINE_INBOX_LIMIT);
+    // Trimming purely by age used to drop whatever was oldest regardless of
+    // whether it had ever been read. Nothing unread is gone here.
+    const unread = entries.filter((entry) => !entry.acknowledged);
+    expect(unread.map((entry) => entry.text)).toEqual([
+      "fresh 4",
+      "fresh 3",
+      "fresh 2",
+      "fresh 1",
+      "fresh 0",
+    ]);
+  });
+});

package/src/scheduler.test.ts

@@ -10,6 +10,7 @@ import { RoutineInboxStore } from "./inbox-store.js";
 import { createMemoryRoutineStorageV1 } from "./testing.js";
 import {
   routineFireKeyV1,
+  routineKeyV1,
   routineScheduleKeyV1,
   ROUTINE_FAILURE_PAUSE_AFTER,
   ROUTINE_FIRE_LEASE_MS,
@@ -575,7 +576,7 @@ describe("an abandoned firing", () => {
   });
 
   test("releases a lock nothing can decode", async () => {
-    const { storage, scheduler, store, create } = harness({
+    const { storage, time, scheduler, store, create } = harness({
       start: "2026-01-01T08:59:00.000Z",
       schedule: "0 9 * * *",
     });
@@ -901,3 +902,100 @@ describe("an undecodable Routine record", () => {
     expect(await drain(scheduler)).toHaveLength(1);
   });
 });
+
+describe("a Routine deleted while it was firing", () => {
+  /**
+   * Delete sweeps the record, the clock, the lock, anything queued and the
+   * whole run log. A firing already in flight settled afterwards and wrote a
+   * run entry back under the swept key and an inbox entry naming a Routine
+   * that no longer exists — an orphan the user cannot open, delete, or
+   * explain.
+   */
+  test("leaves no run entry and no inbox entry behind", async () => {
+    const { storage, time, scheduler, store, create } = harness({
+      start: "2026-01-01T08:59:00.000Z",
+      schedule: "0 9 * * *",
+    });
+    await store.execute(create, USER);
+    time.set("2026-01-01T09:00:00.000Z");
+
+    const inbox = new RoutineInboxStore(storage);
+    await scheduler.settle(async () => {
+      // The user deletes it from the panel while the Turn is still running.
+      await store.execute(
+        {
+          schemaVersion: 1,
+          type: "routine/delete",
+          commandId: "cmd-delete",
+          botId: "scout",
+          routineId: "brief",
+        },
+        USER,
+      );
+      return { status: "failed", summary: "the model refused" };
+    });
+
+    expect(
+      storage.keys().filter((key) => key.startsWith(ROUTINE_RUN_PREFIX)),
+    ).toEqual([]);
+    expect(await inbox.list()).toEqual([]);
+    expect(await storage.get(routineFireKeyV1("brief"))).toBeUndefined();
+    expect(await storage.get(routineScheduleKeyV1("brief"))).toBeUndefined();
+    expect(await scheduler.deadlines(storage)).toEqual([]);
+  });
+
+  test("a firing whose Routine still exists settles as it always did", async () => {
+    const { storage, time, scheduler, store, create } = harness({
+      start: "2026-01-01T08:59:00.000Z",
+      schedule: "0 9 * * *",
+    });
+    await store.execute(create, USER);
+    time.set("2026-01-01T09:00:00.000Z");
+    const inbox = new RoutineInboxStore(storage);
+    await drain(scheduler, { status: "failed", summary: "the model refused" });
+    expect(
+      storage.keys().filter((key) => key.startsWith(ROUTINE_RUN_PREFIX)),
+    ).not.toEqual([]);
+    expect(await inbox.list()).toHaveLength(1);
+  });
+});
+
+describe("a stored schedule with no occurrence left", () => {
+  /**
+   * The write path refuses these now, but a record written before it did — or
+   * by an older deploy — is still in storage. The claim used to fall back to
+   * `now + ROUTINE_MISSED_GRACE_MS` when the schedule named no next run, so
+   * the Routine fired a real model Turn every five minutes for ever, with
+   * nothing on screen and no bound on the spend.
+   */
+  test("turns itself off and says why, instead of firing every five minutes", async () => {
+    const { storage, scheduler, store, create } = harness({
+      start: "2026-01-01T00:00:00.000Z",
+      schedule: "0 9 * * *",
+    });
+    await store.execute(create, USER);
+    // February the 30th, straight into storage, past the write-time guard.
+    const stored = (await storage.get(routineKeyV1("brief"))) as Record<
+      string,
+      unknown
+    >;
+    await storage.put(routineKeyV1("brief"), {
+      ...stored,
+      schedule: "0 0 30 2 *",
+    });
+    await storage.delete(routineScheduleKeyV1("brief"));
+
+    expect(await drain(scheduler)).toEqual([]);
+
+    const listed = await store.list("scout");
+    expect(listed.routines[0]!.enabled).toBe(false);
+    const runs = await store.listRuns("scout", "brief");
+    expect(runs.entries[0]!.status).toBe("skipped");
+    expect(runs.entries[0]!.summary).toContain("never comes around again");
+    // And the alarm no longer has anything to arm on for it.
+    expect(await scheduler.deadlines(storage)).toEqual([]);
+
+    // Draining again does not fire it either: it is off and its clock is gone.
+    expect(await drain(scheduler)).toEqual([]);
+  });
+});

package/src/scheduler.ts

@@ -63,7 +63,6 @@ import {
   ROUTINE_FAILURE_PAUSE_AFTER,
   ROUTINE_FIRE_TIMEOUT_MS,
   ROUTINE_LIMIT_PER_BOT,
-  ROUTINE_MISSED_GRACE_MS,
   ROUTINE_PREFIX,
   ROUTINE_QUEUE_LIMIT,
   ROUTINE_QUEUE_PREFIX,
@@ -71,6 +70,7 @@ import {
   routineKeyV1,
   routineQueueKeyV1,
   routineQueuePrefixV1,
+  routineRunPrefixV1,
   routineScheduleKeyV1,
 } from "./storage-keys.js";
 
@@ -603,7 +603,9 @@ export class RoutineScheduler {
     record: RoutineRecordV1,
     state: RoutineScheduleStateV1,
     now: Date,
-  ): Promise<ClaimedFiringV1> {
+    // `undefined` when the schedule has no occurrence left: the Routine turns
+    // itself off and there is nothing to fire.
+  ): Promise<ClaimedFiringV1 | undefined> {
     const normalized = normalizeRoutineScheduleV1(
       record.schedule!,
       record.timezone,
@@ -642,13 +644,38 @@ export class RoutineScheduler {
     // re-owe this occurrence.
     const from = missedCount > 1 ? now : new Date(state.dueAt);
     const next = nextRoutineRunV1(normalized, from, anchor);
+    if (next === undefined) {
+      // The schedule has no occurrence left — `0 0 30 2 *` is February the
+      // 30th, and a Routine written before this was refused at write time
+      // still holds one. Falling back to "five minutes from now" turned that
+      // into a real model Turn every five minutes for ever. It is turned off
+      // instead, with a run-log entry that says why, and the firing this claim
+      // was about is abandoned rather than run.
+      await transaction.put(routineKeyV1(record.routineId), {
+        ...record,
+        enabled: false,
+        updatedAt: now.toISOString(),
+      } satisfies RoutineRecordV1);
+      await transaction.delete(routineScheduleKeyV1(record.routineId));
+      await appendRoutineRunEntryV1(transaction, {
+        schemaVersion: 1,
+        entryId: `${routineFireIdV1(record.routineId, String(state.dueAt))}-unreachable`,
+        routineId: record.routineId,
+        runId: routineFireIdV1(record.routineId, String(state.dueAt)),
+        fireId: routineFireIdV1(record.routineId, String(state.dueAt)),
+        trigger: "cron",
+        status: "skipped",
+        startedAt: now.toISOString(),
+        finishedAt: now.toISOString(),
+        summary: `The schedule "${record.schedule}" never comes around again in ${record.timezone}, so this Routine has been turned off. Give it a schedule that does and turn it back on.`,
+      } satisfies RoutineRunEntryV1);
+      return undefined;
+    }
     await transaction.put(routineScheduleKeyV1(record.routineId), {
       schemaVersion: 1,
       routineId: record.routineId,
       anchor: record.updatedAt,
-      dueAt: (
-        next ?? new Date(now.getTime() + ROUTINE_MISSED_GRACE_MS)
-      ).getTime(),
+      dueAt: next.getTime(),
       ...(state.consecutiveFailures === undefined
         ? {}
         : { consecutiveFailures: state.consecutiveFailures }),
@@ -889,6 +916,23 @@ export class RoutineScheduler {
     const finishedAt = at.toISOString();
     await this.#storage.transaction(async (transaction) => {
       await transaction.delete(routineFireKeyV1(fire.routineId));
+      // The Routine may have been deleted while this firing was in flight.
+      // Delete sweeps the record, the clock, the lock and the whole run log,
+      // and the settlement then used to re-append a run entry under the swept
+      // key and write an inbox entry naming a Routine that no longer exists —
+      // an orphan the user cannot open, delete, or explain. Nothing outlives
+      // the record it belongs to.
+      if (
+        (await transaction.get<unknown>(routineKeyV1(fire.routineId))) ===
+        undefined
+      ) {
+        const orphans = await transaction.list<unknown>({
+          prefix: routineRunPrefixV1(fire.routineId),
+        });
+        for (const key of orphans.keys()) await transaction.delete(key);
+        await transaction.delete(routineScheduleKeyV1(fire.routineId));
+        return;
+      }
       await this.#recordOutcomeOnClock(transaction, fire, outcome, at);
       if (outcome.status !== "ok") {
         await this.#recordFailureInbox(transaction, fire, outcome, finishedAt);

package/src/shared.test.ts

@@ -97,10 +97,14 @@ describe("RoutineViewV1", () => {
     });
     if (receipt.status !== "applied") throw new Error("unreachable");
     const view = receipt.routine;
-    // The Bot writer's Session and Turn stay in the durable record.
-    expect(view.createdBy).toEqual({ kind: "bot", botId: "scout" });
-    expect(JSON.stringify(view)).not.toContain("tim:scout");
-    expect(JSON.stringify(view)).not.toContain("turn-1");
+    // The Bot writer's Session and Turn travel with it: they are provenance,
+    // not key material, and the journey asks the record to name the Turn.
+    expect(view.createdBy).toEqual({
+      kind: "bot",
+      botId: "scout",
+      sessionId: "tim:scout",
+      turnId: "turn-1",
+    });
     expect(decodeRoutineViewV1(JSON.parse(JSON.stringify(view)))).toEqual(view);
     expect(
       decodeRoutineCommandReceiptV1(JSON.parse(JSON.stringify(receipt))),

package/src/shared.ts

@@ -55,12 +55,16 @@ export const ROUTINE_LIST_MAX = 100;
 export const ROUTINE_RUN_LIST_MAX = 50;
 
 /**
- * Who wrote a Routine, as the client is told it. The Session and Turn a Bot
- * writer records stay in the durable record: the UI needs to say "the Bot wrote
- * this", not to replay the Turn that did.
+ * Who wrote a Routine, as the client is told it.
+ *
+ * A Bot writer names the Session and the Turn it wrote from. The panel only
+ * says "the Bot wrote this", but provenance that cannot answer "which Turn?"
+ * is not provenance: the audit trail and the run log both address a Turn, and
+ * a Routine that a Bot wrote must be traceable to the one that wrote it.
  */
 export type RoutineWriterViewV1 =
-  { kind: "user" } | { kind: "bot"; botId: string };
+  | { kind: "user" }
+  | { kind: "bot"; botId: string; sessionId: string; turnId: string };
 
 /** One Routine as the hosted client sees it. Never any key material. */
 export interface RoutineViewV1 {
@@ -420,10 +424,17 @@ function decodeRoutineWriterViewV1(
   if (candidate.kind !== "bot") {
     throw new RoutineDecodeError(`${label} kind is invalid`);
   }
-  routineExactKeys(candidate, ["kind", "botId"], [], label);
+  routineExactKeys(
+    candidate,
+    ["kind", "botId", "sessionId", "turnId"],
+    [],
+    label,
+  );
   return {
     kind: "bot",
     botId: routineText(candidate.botId, 128, `${label} botId`),
+    sessionId: routineText(candidate.sessionId, 128, `${label} sessionId`),
+    turnId: routineText(candidate.turnId, 128, `${label} turnId`),
   };
 }
 

package/src/store.test.ts

@@ -54,11 +54,19 @@ describe("RoutineStore.execute", () => {
     expect(listed.routines).toHaveLength(1);
   });
 
-  test("records a Bot writer as the Bot, and the view names no Session", async () => {
+  test("records a Bot writer as the Bot, naming the Turn that wrote it", async () => {
     const routines = store();
     const receipt = await routines.execute(create(), BOT);
     if (receipt.status !== "applied") throw new Error("unreachable");
-    expect(receipt.routine.createdBy).toEqual({ kind: "bot", botId: "scout" });
+    // Provenance that cannot answer "which Turn?" is not provenance: the view
+    // used to carry the Bot id alone, so a Routine a Bot wrote could not be
+    // traced back to the Turn that wrote it.
+    expect(receipt.routine.createdBy).toEqual({
+      kind: "bot",
+      botId: "scout",
+      sessionId: "tim:scout",
+      turnId: "turn-7",
+    });
     const stored = await routines.read("brief");
     expect(stored?.createdBy).toEqual(BOT);
   });
@@ -259,3 +267,43 @@ describe("RoutineStore run log", () => {
     expect(log.entries[0]).toMatchObject({ status: "failed" });
   });
 });
+
+describe("a schedule that never comes around", () => {
+  /**
+   * `0 0 30 2 *` is February the 30th: croner parses it happily and then never
+   * names a next run. It used to be stored, and the scheduler's clock then fell
+   * back to "five minutes from now" on every claim, so the Routine burned a
+   * whole model Turn every five minutes for ever. A schedule with no future
+   * occurrence is not a schedule.
+   */
+  test("is refused at write time, and nothing is stored", async () => {
+    const routines = store();
+    await expect(
+      routines.execute(create({ schedule: "0 0 30 2 *" }), USER),
+    ).rejects.toThrow(/never comes around again/u);
+    await expect(
+      routines.execute(
+        create({ commandId: "cmd-2", schedule: "0 0 31 4 *" }),
+        USER,
+      ),
+    ).rejects.toThrow(/never comes around again/u);
+    expect((await routines.list("scout")).routines).toHaveLength(0);
+  });
+
+  test("names the expression and the zone, so the field can be corrected", async () => {
+    const routines = store();
+    const refusal = await routines
+      .execute(create({ schedule: "0 0 30 2 *" }), USER)
+      .catch((error: unknown) => error);
+    expect((refusal as Error).message).toContain("0 0 30 2 *");
+    expect((refusal as Error).message).toContain("Australia/Sydney");
+  });
+
+  test("an ordinary rare schedule is still accepted", async () => {
+    const routines = store();
+    // February the 29th happens; it is simply not every year.
+    await expect(
+      routines.execute(create({ schedule: "0 0 29 2 *" }), USER),
+    ).resolves.toMatchObject({ status: "applied" });
+  });
+});

package/src/store.ts

@@ -21,6 +21,7 @@
 // trigger kind, and minting is D3's.
 import {
   isRoutineTimezoneV1,
+  nextRoutineRunV1,
   normalizeRoutineScheduleV1,
   RoutineScheduleError,
 } from "./cron.js";
@@ -161,9 +162,17 @@ export interface RoutineStoreOptionsV1 {
 }
 
 function writerView(writer: RoutineWriterV1): RoutineWriterViewV1 {
+  // The Session and Turn travel with the Bot writer. A Routine a Bot wrote is
+  // provenance, and provenance that cannot name the Turn it came from is only
+  // half a record: "the Bot wrote this" is not answerable to "which Turn?".
   return writer.kind === "user"
     ? { kind: "user" }
-    : { kind: "bot", botId: writer.botId };
+    : {
+        kind: "bot",
+        botId: writer.botId,
+        sessionId: writer.sessionId,
+        turnId: writer.turnId,
+      };
 }
 
 /**
@@ -774,8 +783,12 @@ export class RoutineStore {
       );
     }
     if (decoded.schedule !== undefined) {
+      let normalized;
       try {
-        normalizeRoutineScheduleV1(decoded.schedule, decoded.timezone);
+        normalized = normalizeRoutineScheduleV1(
+          decoded.schedule,
+          decoded.timezone,
+        );
       } catch (error) {
         throw new RoutineDecodeError(
           error instanceof RoutineScheduleError
@@ -783,6 +796,17 @@ export class RoutineStore {
             : `Routine schedule is invalid: ${String(error)}`,
         );
       }
+      // A syntactically valid expression can still name a moment that never
+      // arrives — `0 0 30 2 *` is February the 30th. It used to be accepted,
+      // and then the clock fell back to "five minutes from now" on every claim,
+      // so the Routine burned a whole model Turn every five minutes for ever.
+      // A schedule that never comes around is not a schedule.
+      const now = this.#now();
+      if (nextRoutineRunV1(normalized, now, now) === undefined) {
+        throw new RoutineDecodeError(
+          `schedule "${decoded.schedule}" never comes around again in ${decoded.timezone}`,
+        );
+      }
     }
     return decoded;
   }