@inetafrica/open-claudia 3.4.23 → 3.4.24

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 3.4.24
+
+- A repeating watch keeps polling while its triggered delivery waits for a busy room, waits to retry after a failed or `/stop`-killed run, or runs. A new hit folds into that one pending delivery instead of queueing another, and the delivered prompt says how many more times the check passed and whether its latest run had cleared. On 24 Sep the event-bus watch went unpolled for 7.5 h behind a busy room, and after a killed delivery attempt its polling never resumed. One-shot watches are unchanged, and the 15-minute "⏳ Watch … waiting" line still goes out once per occurrence.
+- A watch whose check times out 3 times in a row now wakes the agent once, marked "Watch check timing out", and keeps polling; any completed check resets the count. A hanging health check used to be logged `idle (check timed out)` and never alarm. The alarm does not use up a one-shot watch.
+- Wakeups more than ~24.8 days out no longer fire at once. `setTimeout` overflows past 2^31-1 ms, which fired a 2028 reminder 61 s after it was set (17 Sep); far wakeups now sleep in chunks and re-plan until due, then fire once. `schedule-wakeup` refuses a `<when>` more than 10 years out, in the CLI and in the loopback route.
+- A queued delivery is no longer stranded when a jobs-store write throws (a full disk, a torn journal). Those paths returned without a retry timer, so the alarm was never tried again; they now keep the retry armed and say so in watch.log. This matches the watch alarms that triggered during long turns on 21 and 23 Sep and were never delivered. A regression test also pins that a delivery queued behind a long turn survives the turn's compaction and runs once at the next idle moment, on the compacted session; that path already worked.
+- `cron-list` and `watch-list` say where a fired job stands (delivery waiting, running, retrying or dead) instead of listing it as still to come. A triggered watch whose delivery was queued read "EXPIRED (fires on next poll)" (21 Sep), and a fired 2028 reminder still read "fires 2028-08-01" (17 Sep).
+- `open-claudia say` and the send-file/voice/photo routes now say which step failed when the channel adapter refuses the upload, instead of a bare `loopback 500: {"ok":false}` (10 Sep). The adapter's own error stays in bot.log.
+- Release gate: `test-provider-pack-review.js` gives each probe child 120 s instead of 30 s and reports a timeout as a timeout rather than "failed (null)" (v3.4.19, job 43703). The parity suite's cap for it rises to 8 minutes so it cannot undercut its children.
+
 ## 3.4.23
 
 - Watch, wakeup and cron turns now stream their progress (interim narration, and thinking under `/verbose`) like chat turns. The live preview was gated to chat turns only, so a watch-woken turn showed the bell notice and "thinking…" and then nothing until its final answer, however long it worked.

package/bin/schedule.js

@@ -8,7 +8,8 @@ Background scheduling — manage wakeups and crons.
 
 Wakeups (one-shot, resumes the same conversation):
   open-claudia schedule-wakeup <when> "<prompt>" [--label "<label>"]
-    <when>: duration (e.g. 30s, 5m, 2h, 1d) OR an ISO datetime (e.g. 2026-05-16T15:00:00Z)
+    <when>: duration (e.g. 30s, 5m, 2h, 1d) OR an ISO datetime (e.g. 2026-05-16T15:00:00Z),
+            at most 10 years out
 
 Crons (recurring):
   open-claudia cron-add "<5-field cron>" "<prompt>" [--label "<label>"] [--project <name>]
@@ -25,6 +26,8 @@ Watches (silent background monitor — polls a shell check, wakes you only on a
                datetime. Default 2h. A watch that reaches its timeout without
                the check ever passing FIRES anyway on the next poll, with the
                prompt marked "Watch expired" — no watch can end silently.
+    A check that times out (30s) 3 times in a row wakes the agent once, marked
+    "Watch check timing out"; the watch keeps polling.
   open-claudia watch-list                        # watches on this channel + master switch state
   open-claudia watch-remove <id>                 # remove a watch by id
   open-claudia watch-on / watch-off              # global master switch for ALL watches (owner)
@@ -37,6 +40,10 @@ switching providers starts a fresh thread.
 `;
 
 const DUR = /^(\d+)\s*(s|sec|secs|m|min|mins|h|hr|hrs|d|day|days)$/i;
+// Mirrors core/scheduler MAX_WAKEUP_HORIZON_MS: a wakeup further out than this
+// is a typo or a mis-parsed <when> (one was set 1273 years out).
+const MAX_WAKEUP_YEARS = 10;
+const MAX_WAKEUP_HORIZON_MS = MAX_WAKEUP_YEARS * 365.25 * 24 * 60 * 60 * 1000;
 
 function parseWhen(s) {
   if (!s) return null;
@@ -63,13 +70,41 @@ function takeFlag(args, name) {
   return v;
 }
 
+// Where a job stands once it has fired. A fired job used to stay listed as a
+// future one ("fires 2028-08-01", "EXPIRED (fires on next poll)") while its
+// delivery was queued, running or dead (17 and 21 Sep).
+function jobProgress(j) {
+  const since = j.check && j.watchTriggeredOccurrenceId && j.watchTriggeredOccurrenceId === j.occurrenceId && Number(j.watchTriggeredAt) > 0
+    ? `TRIGGERED ${new Date(Number(j.watchTriggeredAt)).toISOString()}, ` : "";
+  const state = {
+    running: "delivery running",
+    deferred: "delivery waiting for a busy room",
+    failed: `delivery failed (${j.lastError?.code || "error"}), retrying`,
+    "dead-letter": `delivery failed (${j.lastError?.code || "error"}), DEAD: will not fire`,
+  }[j.status];
+  return state ? `${since}${state}` : "";
+}
+
 function fmtJob(j) {
   const when = j.kind === "wakeup"
     ? `fires ${new Date(j.fireAt).toISOString()}`
     : `schedule "${j.schedule}"`;
   const proj = j.project ? ` [${j.project}]` : "";
   const src = j.source ? ` (${j.source})` : "";
-  return `${j.id}  ${j.kind}  ${j.label || "(no label)"}${proj}${src}  ${when}`;
+  const progress = jobProgress(j);
+  return `${j.id}  ${j.kind}  ${j.label || "(no label)"}${proj}${src}  ${when}${progress ? `  [${progress}]` : ""}`;
+}
+
+function fmtWatch(w, now = Date.now()) {
+  const mode = w.repeat ? "repeating" : "one-shot";
+  const progress = jobProgress(w);
+  const expiry = progress ? `  ${progress}`
+    : Number(w.expiresAt) > 0
+      ? (now >= Number(w.expiresAt)
+        ? "  EXPIRED (fires on next poll)"
+        : `  expires ${new Date(Number(w.expiresAt)).toISOString()}`)
+      : "  no expiry (pre-timeout watch)";
+  return `${w.id}  ${mode}  polls "${w.schedule}"${expiry}  check: ${w.check}  → ${w.label || "(no label)"}`;
 }
 
 async function runScheduleWakeup(args) {
@@ -82,6 +117,11 @@ async function runScheduleWakeup(args) {
     console.error(`Could not parse <when>: "${rest[0]}". Use a duration (5m, 2h, 1d) or ISO datetime.`);
     process.exit(2);
   }
+  if (when - Date.now() > MAX_WAKEUP_HORIZON_MS) {
+    const at = new Date(when);
+    console.error(`<when> "${rest[0]}" is ${Number.isNaN(at.getTime()) ? "past any valid date" : at.toISOString()}, more than ${MAX_WAKEUP_YEARS} years out. Check the date; for a far reminder use a yearly cron-add.`);
+    process.exit(2);
+  }
   const prompt = rest.slice(1).join(" ");
   if (!prompt) { console.error("Missing prompt."); process.exit(2); }
   try {
@@ -178,15 +218,7 @@ async function runWatchList() {
     const list = res.watches || [];
     console.log(`Watches: master switch is ${res.enabled ? "ON" : "OFF"}.`);
     if (list.length === 0) { console.log("No watches on this channel."); process.exit(0); }
-    for (const w of list) {
-      const mode = w.repeat ? "repeating" : "one-shot";
-      const expiry = Number(w.expiresAt) > 0
-        ? (Date.now() >= Number(w.expiresAt)
-          ? "  EXPIRED (fires on next poll)"
-          : `  expires ${new Date(Number(w.expiresAt)).toISOString()}`)
-        : "  no expiry (pre-timeout watch)";
-      console.log(`${w.id}  ${mode}  polls "${w.schedule}"${expiry}  check: ${w.check}  → ${w.label || "(no label)"}`);
-    }
+    for (const w of list) console.log(fmtWatch(w));
     process.exit(0);
   } catch (e) { console.error(e.message); process.exit(1); }
 }
@@ -211,6 +243,8 @@ async function runWatchToggle(enabled) {
 
 module.exports = {
   HELP,
+  fmtJob,
+  fmtWatch,
   runScheduleWakeup,
   runCronAdd,
   runCronList,

package/core/loopback.js

@@ -58,6 +58,14 @@ function reply(res, code, body) {
   res.end(data);
 }
 
+// An adapter's send* resolves false after logging its own error, so the JSON
+// used to say only {"ok":false} (10 Sep: every `say` failed like that through
+// a Kazee outage). Name the step that failed; the adapter's message may carry
+// request details, so it stays in bot.log.
+function undeliveredReason(adapter, what) {
+  return `${adapter.type || adapter.id} adapter did not deliver the ${what}: the channel rejected it or was unreachable (details in bot.log)`;
+}
+
 function authOk(req) {
   return (req.headers["authorization"] || "") === `Bearer ${token}`;
 }
@@ -154,7 +162,7 @@ async function handleSend(req, res, url, kind) {
   } finally {
     if (kind !== "send-voice") { try { fs.unlinkSync(tmp); } catch (e) {} }
   }
-  return reply(res, ok ? 200 : 500, { ok });
+  return ok ? reply(res, 200, { ok }) : reply(res, 500, { ok, error: undeliveredReason(adapter, kind === "send-voice" ? "voice note" : kind.slice(5)) });
 }
 
 async function handleJson(req, res, url, kind) {
@@ -215,7 +223,7 @@ async function handleJson(req, res, url, kind) {
       return reply(res, 500, { error: `voice send failed: ${e.message}` });
     }
     try { fs.unlinkSync(voicePath); } catch (e) {}
-    return reply(res, ok ? 200 : 500, { ok });
+    return ok ? reply(res, 200, { ok }) : reply(res, 500, { ok, error: undeliveredReason(adapter, "voice note") });
   }
 
   if (kind === "tts") {
@@ -271,6 +279,9 @@ async function handleJson(req, res, url, kind) {
   if (kind === "schedule-wakeup") {
     const fireAt = Number(payload.fireAt);
     if (!Number.isFinite(fireAt) || fireAt <= 0) return reply(res, 400, { error: "missing/invalid fireAt" });
+    if (fireAt - Date.now() > scheduler.MAX_WAKEUP_HORIZON_MS) {
+      return reply(res, 400, { error: "fireAt is more than 10 years out; check the date (a far reminder belongs in a yearly cron)" });
+    }
     if (!payload.prompt) return reply(res, 400, { error: "missing prompt" });
     const job = scheduler.addJob({
       kind: "wakeup",

package/core/runner.js

@@ -2286,8 +2286,8 @@ function queuedNotice(activeRunContext, at = Date.now()) {
   const since = Number(activeRunContext?.admittedAt);
   if (!Number.isFinite(since) || at - since < QUEUED_DETAIL_AFTER_MS) return "Queued.";
   const minutes = Math.floor((at - since) / 60000);
-  const header = String(activeRunContext.userPrompt || "").match(/^\[(Watch triggered|Watch expired|Scheduled cron|Scheduled wakeup) "([^"]*)"/);
-  const kind = header ? { "Watch triggered": "watch", "Watch expired": "watch", "Scheduled cron": "scheduled job", "Scheduled wakeup": "wakeup" }[header[1]] : null;
+  const header = String(activeRunContext.userPrompt || "").match(/^\[(Watch triggered|Watch expired|Watch check timing out|Scheduled cron|Scheduled wakeup) "([^"]*)"/);
+  const kind = header ? { "Watch triggered": "watch", "Watch expired": "watch", "Watch check timing out": "watch", "Scheduled cron": "scheduled job", "Scheduled wakeup": "wakeup" }[header[1]] : null;
   const label = header && header[2].length > 60 ? `${header[2].slice(0, 59).trimEnd()}…` : header?.[2];
   const what = kind ? `the ${kind} "${label}"` : "an earlier message";
   return `Queued behind ${what} (running ${minutes} min). /stop cancels it.`;

package/core/scheduler.js

@@ -48,6 +48,18 @@ const BUSY_DELAY_MS = 30 * 1000;
 const BUSY_NOTICE_AFTER_MS = 15 * 60 * 1000;
 // A watch's `check` command is capped so a hung poll can't wedge the tick.
 const WATCH_CHECK_TIMEOUT_MS = 30 * 1000;
+// A hanging check is itself a signal (24 Sep: the Phone health check timed out
+// twice and was only logged idle). This many timeouts in a row wake the agent
+// once, marked "check timing out"; the watch keeps polling, and any completed
+// check resets the count.
+const WATCH_TIMEOUT_ALARM_AFTER = 3;
+// setTimeout holds at most 2^31-1 ms (~24.8 days); a longer delay overflows
+// and fires at once (17 Sep: a 2028 reminder fired 61 s after it was set).
+// Far wakeups sleep in chunks of this size and re-plan until due.
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1 - 1000;
+// schedule-wakeup refuses a fire time further out than this: past it the
+// <when> is a typo or a mis-parse (one wakeup was set 1273 years out).
+const MAX_WAKEUP_HORIZON_MS = 10 * 365.25 * 24 * 60 * 60 * 1000;
 // Every watch carries a hard expiry so none can idle-poll forever: when the
 // deadline lapses with the check still failing, the next poll tick fires the
 // wake anyway (marked expired) instead of skipping silently.
@@ -75,9 +87,25 @@ function terminalRunSucceeded(result) {
 
 // A one-shot fires exactly once then is removed after a successful run: a
 // wakeup, or a watch (a cron carrying a shell `check`) created without repeat
-// polling. A repeat watch stays pending and keeps polling like any cron.
+// polling. A repeat watch stays pending and keeps polling like any cron, and
+// so does any watch whose fire only reported a hanging check.
 function isOneShot(job) {
-  return job.kind === "wakeup" || (!!job.check && !job.repeat);
+  return job.kind === "wakeup" || (!!job.check && !job.repeat && !job.watchCheckTimingOut);
+}
+
+// A repeating watch keeps polling on its schedule while a triggered delivery
+// waits for a busy room, waits for a retry after a failed or /stop-killed run,
+// or runs. New hits fold into that one delivery. Everything else parks on its
+// retry timer alone (24 Sep: the event-bus watch went unpolled for 7.5 h).
+function pollsWhilePending(job) {
+  return !!job?.check && !!job.repeat;
+}
+
+// The watch's trigger is latched and its delivery has not completed.
+function deliveryPending(job) {
+  return pollsWhilePending(job)
+    && job.watchTriggeredOccurrenceId === job.occurrenceId
+    && ["deferred", "failed", "running"].includes(job.status);
 }
 
 function providerIsRunnable(status) {
@@ -288,16 +316,37 @@ function createSchedulerService(dependencies = {}) {
     return null;
   }
 
+  // What a repeating watch's polls saw while its delivery waited.
+  function pendingPollNote(job) {
+    const hits = Number(job.watchExtraHits) || 0;
+    const lastHitAt = Number(job.watchLastHitAt) || 0;
+    const lastClearAt = Number(job.watchLastClearAt) || 0;
+    if (!hits && !lastClearAt) return null;
+    const at = (ms) => new Date(ms).toISOString();
+    const seen = [];
+    if (hits) seen.push(`the check passed ${hits} more time${hits === 1 ? "" : "s"}, the latest at ${at(lastHitAt)}`);
+    seen.push(lastClearAt > lastHitAt
+      ? `its latest run, at ${at(lastClearAt)}, did not pass, so the condition may have cleared`
+      : "the condition was still true at the latest check");
+    return `[This watch kept polling while this delivery waited (queued at ${at(Number(job.watchTriggeredAt) || now())}): ${seen.join("; ")}.]`;
+  }
+
   function wrappedPrompt(job, target) {
     const firedAt = new Date(now()).toISOString();
     const expired = !!(job.check && job.watchExpired);
+    const timingOut = !!(job.check && !expired && job.watchCheckTimingOut);
     const header = job.check
-      ? (expired ? "Watch expired" : "Watch triggered")
+      ? (expired ? "Watch expired" : timingOut ? "Watch check timing out" : "Watch triggered")
       : job.kind === "cron" ? "Scheduled cron" : "Scheduled wakeup";
     const lines = [`[${header} "${job.label}" fired at ${firedAt}; occurrence ${job.occurrenceId}]`];
     if (expired) {
       lines.push("[This watch reached its timeout without its check ever passing — the watched condition did NOT happen. This is a deadline wake-up, not a trigger: investigate why the condition never became true, and arm a new watch if it is still worth waiting for.]");
     }
+    if (timingOut) {
+      lines.push(`[This watch's check timed out ${WATCH_TIMEOUT_ALARM_AFTER} times in a row (each run is capped at ${WATCH_CHECK_TIMEOUT_MS / 1000} s), so the watched condition could not be read. That is itself a signal: find out why the check hangs. This is not a trigger, and the watch keeps polling.]`);
+    }
+    const polled = job.check ? pendingPollNote(job) : null;
+    if (polled) lines.push(polled);
     if (target.fallbackFrom) {
       lines.push(`[Archived provider-neutral brief: the originating ${target.fallbackFrom} provider is unavailable. Its native session is not being resumed; this explicitly configured fallback starts fresh.]`);
     } else if (target.revertedFrom) {
@@ -317,14 +366,36 @@ function createSchedulerService(dependencies = {}) {
     timers.delete(id);
   }
 
+  // Drop only a job's delivery (retry) timer; a watch's poll schedule stays.
+  function clearDeliveryTimer(id) {
+    const timer = timers.get(id);
+    if (!timer?.timeout) return;
+    try { clearTimer(timer.timeout); } catch (_) {}
+    if (timer.stop) timers.set(id, { stop: timer.stop });
+    else timers.delete(id);
+  }
+
   function armRetry(job, delay = null) {
-    unscheduleJob(job.id);
-    if (job.disabled || job.status === "dead-letter" || job.status === "succeeded") return;
+    if (job.disabled || job.status === "dead-letter" || job.status === "succeeded") return unscheduleJob(job.id);
+    if (pollsWhilePending(job)) clearDeliveryTimer(job.id);
+    else unscheduleJob(job.id);
     const wait = delay === null
       ? Math.max(0, Number(job.nextAttemptAt || now()) - now())
       : Math.max(0, delay);
     const timeout = setTimer(() => fireJob(job.id, { reason: "retry" }), wait);
-    timers.set(job.id, { timeout });
+    timers.set(job.id, { ...timers.get(job.id), timeout });
+  }
+
+  // A jobs-store write that throws (a full disk, a torn journal) must not
+  // strand a queued delivery: the retry stays armed in memory and the next
+  // attempt re-reads the store. Such a throw used to return with no timer,
+  // so the delivery was never tried again (21 and 23 Sep: watch alarms that
+  // triggered during long turns were never delivered).
+  function keepRetrying(job, error, delay = retryDelayMs) {
+    const failure = stableFailure(error);
+    try { armRetry(job, delay); } catch (_) {}
+    if (job.check) logWatch(job, `delivery bookkeeping failed (${failure.code}) — retrying in ${Math.round(delay / 1000)} s`);
+    return { ok: false, status: "failed", error: failure };
   }
 
   function markFailure(job, failure, options = {}) {
@@ -367,7 +438,7 @@ function createSchedulerService(dependencies = {}) {
     armRetry(updated, busyDelayMs);
     if (noticeDue) {
       const minutes = Math.floor(waited / 60000);
-      const what = updated.watchExpired ? "timed out" : "triggered";
+      const what = updated.watchExpired ? "timed out" : updated.watchCheckTimingOut ? "raised a check-timeout alarm" : "triggered";
       try {
         Promise.resolve(send(`⏳ Watch "${updated.label}" ${what} ${minutes} min ago and is waiting for the current run to end. /stop ends that run so the watch can go.`)).catch(() => {});
       } catch (_) { /* a notice only */ }
@@ -416,6 +487,10 @@ function createSchedulerService(dependencies = {}) {
       watchTriggeredOccurrenceId: null,
       watchTriggeredAt: null,
       watchExpired: false,
+      watchCheckTimingOut: false,
+      watchExtraHits: 0,
+      watchLastHitAt: null,
+      watchLastClearAt: null,
       advisoryOccurrenceId: null,
     });
     if (reset && timers.get(job.id)?.timeout) scheduleJob(reset);
@@ -440,6 +515,10 @@ function createSchedulerService(dependencies = {}) {
       return { ok: false, status: job.status, skipped: true };
     }
     if (job.status === "running" && Number(job.nextAttemptAt || 0) > now()) {
+      // fireJob already turned away a fire in flight here, so this lease was
+      // left by an earlier process: look again when it lapses. Returning with
+      // no timer stranded the job until the next restart.
+      armRetry(job);
       return { ok: false, status: "running", skipped: true, inFlight: true };
     }
     if (job.status === "succeeded" && isOneShot(job)) {
@@ -469,15 +548,28 @@ function createSchedulerService(dependencies = {}) {
         // persisted before expiry existed (no expiresAt) keep polling forever.
         const expiresAt = Number(job.expiresAt || 0);
         if (!(expiresAt > 0 && now() >= expiresAt)) {
-          logWatch(job, check && check.timedOut ? "idle (check timed out)" : `idle (check exit ${check ? check.code : "?"})`);
-          return { ok: false, status: "watch-idle", skipped: true };
+          // Timeouts in a row; a completed check resets the count. Only the
+          // WATCH_TIMEOUT_ALARM_AFTER-th wakes the agent, so a check that stays
+          // hung alarms once rather than on every later poll.
+          const timedOut = !!check?.timedOut;
+          const previous = Number(job.watchTimeoutStreak) || 0;
+          const streak = timedOut ? previous + 1 : 0;
+          if (streak !== WATCH_TIMEOUT_ALARM_AFTER) {
+            if (streak !== previous) {
+              try { jobsStore.update(job.id, { watchTimeoutStreak: streak }); } catch (_) { /* best effort */ }
+            }
+            logWatch(job, timedOut ? `idle (check timed out, ${streak} in a row)` : `idle (check exit ${check ? check.code : "?"})`);
+            return { ok: false, status: "watch-idle", skipped: true };
+          }
+          job = { ...job, watchExpired: false, watchCheckTimingOut: true, watchTimeoutStreak: streak };
+        } else {
+          // Expiry ends the watch's window: one-shot removal even for --repeat
+          // (the woken agent re-arms if still wanted). Persisted so a retry of a
+          // failed expiry fire keeps the same semantics across restarts.
+          job = { ...job, repeat: false, watchExpired: true, watchCheckTimingOut: false };
         }
-        // Expiry ends the watch's window: one-shot removal even for --repeat
-        // (the woken agent re-arms if still wanted). Persisted so a retry of a
-        // failed expiry fire keeps the same semantics across restarts.
-        job = { ...job, repeat: false, watchExpired: true };
       } else {
-        job = { ...job, watchExpired: false };
+        job = { ...job, watchExpired: false, watchCheckTimingOut: false, watchTimeoutStreak: 0 };
       }
       // Latch the condition before admission or notification. Delivery retries
       // and restarts must not run the check again or change an expiry's meaning.
@@ -487,6 +579,8 @@ function createSchedulerService(dependencies = {}) {
           nextAttemptAt: now(),
           repeat: job.repeat,
           watchExpired: job.watchExpired,
+          watchCheckTimingOut: job.watchCheckTimingOut,
+          watchTimeoutStreak: Number(job.watchTimeoutStreak) || 0,
           watchTriggeredOccurrenceId: job.occurrenceId,
           watchTriggeredAt: now(),
         });
@@ -495,13 +589,15 @@ function createSchedulerService(dependencies = {}) {
       } catch (error) {
         return { ok: false, status: "failed", error: stableFailure(error) };
       }
-      logWatch(job, job.watchExpired ? "expired without firing — delivery queued" : "triggered (check passed) — delivery queued");
+      logWatch(job, job.watchExpired ? "expired without firing — delivery queued"
+        : job.watchCheckTimingOut ? `check timed out ${WATCH_TIMEOUT_ALARM_AFTER} times in a row — delivery queued`
+          : "triggered (check passed) — delivery queued");
     }
 
     const adapter = resolveAdapter(job);
     if (!adapter) {
       try { return markFailure(job, { code: "SCHEDULED_ADAPTER_UNAVAILABLE", message: "Saved channel adapter is unavailable" }); }
-      catch (error) { return { ok: false, status: "failed", error: stableFailure(error) }; }
+      catch (error) { return keepRetrying(job, error); }
     }
     const canonicalUserId = job.canonicalUserId || canonicalForChannel(adapter.type, job.channelId);
     const userId = String(job.userId || (adapter.type === "telegram" ? job.channelId : canonicalUserId || job.channelId || ""));
@@ -531,7 +627,7 @@ function createSchedulerService(dependencies = {}) {
       const state = stateForUser(canonicalUserId);
       if (state.runningProcess || state.preparingRun || state.isCompacting) {
         try { return markBusy(job); }
-        catch (error) { return { ok: false, status: "failed", error: stableFailure(error) }; }
+        catch (error) { return keepRetrying(job, error, busyDelayMs); }
       }
 
       const target = executionTarget(job, state);
@@ -541,7 +637,7 @@ function createSchedulerService(dependencies = {}) {
             code: "SCHEDULED_PROVIDER_UNAVAILABLE",
             message: `Saved provider ${job.provider} is unavailable and no explicit fallback is configured`,
           });
-        } catch (error) { return { ok: false, status: "failed", error: stableFailure(error) }; }
+        } catch (error) { return keepRetrying(job, error); }
       }
 
       const project = projectDescriptor(job);
@@ -559,8 +655,14 @@ function createSchedulerService(dependencies = {}) {
         scheduledJobId: job.id,
         originRunId: job.originRunId || null,
       };
-      // Admission is synchronous and precedes all notification delivery.
-      const runContext = admit(prompt, project.dir, null, runOptions);
+      // Admission is synchronous and precedes all notification delivery. A
+      // refusal is a failed attempt, never a rejection that drops the job.
+      let runContext;
+      try { runContext = admit(prompt, project.dir, null, runOptions); }
+      catch (error) {
+        try { return markFailure(job, error); }
+        catch (persistError) { return keepRetrying(job, persistError); }
+      }
 
       let running;
       try {
@@ -575,11 +677,13 @@ function createSchedulerService(dependencies = {}) {
         });
         if (!running) throw new Error("scheduled attempt could not be persisted");
       } catch (error) {
-        return { ok: false, status: "failed", error: stableFailure(error) };
+        return keepRetrying(job, error);
       }
 
       const advisory = job.check
-        ? (job.watchExpired ? `⏰ Watch "${job.label}" timed out without triggering — waking anyway` : `🔔 Watch "${job.label}" triggered`)
+        ? (job.watchExpired ? `⏰ Watch "${job.label}" timed out without triggering — waking anyway`
+          : job.watchCheckTimingOut ? `⚠️ Watch "${job.label}": its check timed out ${WATCH_TIMEOUT_ALARM_AFTER} times in a row`
+            : `🔔 Watch "${job.label}" triggered`)
         : `Wakeup: ${job.label}`;
       // Say so when the run is NOT on the provider this room is set to: an
       // unexplained error from a provider the room never selected is worse than
@@ -601,16 +705,70 @@ function createSchedulerService(dependencies = {}) {
       try { result = await runInProvider(prompt, runContext.cwd, null, { ...runOptions, runContext }); }
       catch (error) {
         try { return markFailure(running, error, { attemptAlreadyCounted: true }); }
-        catch (persistError) { return { ok: false, status: "failed", error: stableFailure(persistError) }; }
+        catch (persistError) { return keepRetrying(running, persistError); }
       }
       if (!terminalRunSucceeded(result)) {
         try { return markFailure(running, result, { attemptAlreadyCounted: true }); }
-        catch (error) { return { ok: false, status: "failed", error: stableFailure(error), result }; }
+        catch (error) { return { ...keepRetrying(running, error), result }; }
       }
       return settleSuccess(running, result, target);
     });
   }
 
+  // Poll a repeating watch whose delivery is still pending. Nothing new is
+  // queued: a hit is counted into that delivery (its prompt says so), a
+  // completed miss is noted as a possible clear, a timeout is only logged.
+  async function pollPendingWatch(job) {
+    if (!watchesEnabled()) {
+      logWatch(job, "skipped (watches disabled globally)");
+      return { ok: false, status: "watch-disabled", skipped: true };
+    }
+    if (checksInFlight.has(job.id)) return { ok: false, status: "watch-checking", skipped: true };
+    checksInFlight.add(job.id);
+    let check;
+    try { check = await runWatchCheck(job.check, job); }
+    catch (_) { check = { code: 1, timedOut: false }; }
+    finally { checksInFlight.delete(job.id); }
+    try {
+      const latest = jobsStore.get(job.id);
+      // The delivery may have finished while the check ran; the result then
+      // belongs to no pending occurrence.
+      if (!latest || latest.occurrenceId !== job.occurrenceId || !deliveryPending(latest)) {
+        return { ok: false, status: "watch-idle", skipped: true };
+      }
+      if (check?.timedOut) {
+        logWatch(latest, "idle (check timed out) — delivery still pending");
+        return { ok: false, status: "watch-idle", skipped: true };
+      }
+      const hit = check?.code === 0;
+      const extraHits = (Number(latest.watchExtraHits) || 0) + (hit ? 1 : 0);
+      jobsStore.update(job.id, {
+        ...(hit ? { watchExtraHits: extraHits, watchLastHitAt: now() } : { watchLastClearAt: now() }),
+        ...(latest.watchTimeoutStreak ? { watchTimeoutStreak: 0 } : {}),
+      });
+      logWatch(latest, hit
+        ? `triggered again (check passed) — folded into the pending delivery (${extraHits} more)`
+        : `idle (check exit ${check ? check.code : "?"}) — delivery still pending`);
+      return { ok: false, status: hit ? "watch-folded" : "watch-idle", skipped: true, extraHits };
+    } catch (error) {
+      return { ok: false, status: "failed", error: stableFailure(error) };
+    }
+  }
+
+  // A cron's schedule. A pending job fires on each tick; a repeating watch
+  // whose delivery is still pending is only polled.
+  function armCron(job) {
+    if (!validateCron(job.schedule)) return false;
+    const task = scheduleCron(job.schedule, () => {
+      const current = jobsStore.get(job.id);
+      if (!current || current.disabled) return;
+      if (current.status === "pending") fireJob(current.id, { reason: "cron" });
+      else if (deliveryPending(current)) pollPendingWatch(current);
+    });
+    timers.set(job.id, { stop: () => task.stop?.() });
+    return true;
+  }
+
   function scheduleJob(job) {
     unscheduleJob(job.id);
     if (!job || job.disabled || ["archived", "dead-letter"].includes(job.status)) return false;
@@ -619,6 +777,7 @@ function createSchedulerService(dependencies = {}) {
       return false;
     }
     if (["failed", "deferred", "running"].includes(job.status)) {
+      if (pollsWhilePending(job)) armCron(job);
       armRetry(job, Math.max(0, Number(job.nextAttemptAt || now()) - now()));
       return true;
     }
@@ -636,20 +795,20 @@ function createSchedulerService(dependencies = {}) {
         } catch (_) {}
         return false;
       }
-      const timeout = setTimer(() => fireJob(job.id, { reason: fireAt < now() ? "missed" : "timer" }), Math.max(0, fireAt - now()));
+      const wait = Math.max(0, fireAt - now());
+      // Too far out for one timer: sleep a chunk, then re-plan from the store.
+      const timeout = wait > MAX_TIMER_DELAY_MS
+        ? setTimer(() => {
+          try {
+            const current = jobsStore.get(job.id);
+            if (current) scheduleJob(current);
+          } catch (_) { /* init() re-plans on the next boot */ }
+        }, MAX_TIMER_DELAY_MS)
+        : setTimer(() => fireJob(job.id, { reason: fireAt < now() ? "missed" : "timer" }), wait);
       timers.set(job.id, { timeout });
       return true;
     }
-    if (job.kind === "cron") {
-      if (!validateCron(job.schedule)) return false;
-      const task = scheduleCron(job.schedule, () => {
-        const current = jobsStore.get(job.id);
-        if (!current || current.disabled || current.status !== "pending") return;
-        fireJob(current.id, { reason: "cron" });
-      });
-      timers.set(job.id, { stop: () => task.stop?.() });
-      return true;
-    }
+    if (job.kind === "cron") return armCron(job);
     return false;
   }
 
@@ -809,6 +968,9 @@ module.exports = {
   RETRY_DELAY_MS,
   BUSY_DELAY_MS,
   DEFAULT_WATCH_TIMEOUT_MS,
+  WATCH_TIMEOUT_ALARM_AFTER,
+  MAX_TIMER_DELAY_MS,
+  MAX_WAKEUP_HORIZON_MS,
   createSchedulerService,
   parseFallbacks,
   terminalRunSucceeded,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.4.23",
+  "version": "3.4.24",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {