@open-everywhere/core 0.1.0

package/dist/agent/schedules/dispatch.js

@@ -0,0 +1,749 @@
+// The routine DISPATCHER — the one bridge from Eve's static cron to OpenEverywhere's
+// dynamic, NL-created, per-surface routines (Phase 3).
+//
+// Eve's `defineSchedule` is a build-time file: a fixed cron + a handler. OpenEverywhere
+// routines are created at RUNTIME, in-thread, per surface (see tools/create_routine).
+// So we author ONE schedule that ticks every minute and acts as a dispatcher: it
+// reads the durable routine store, finds the routines that are DUE, advances each
+// one's schedule, and starts a session per routine.
+//
+// WHERE THE FIRE LANDS (OPE-144): a triggered flow is a TASK, not a conversation, so it joins the
+// UNIFIED WINDOW at THREAD grain (narrow hands + the `agent` delegator + a resolvable reply) via
+// routines/fire-window.ts, whenever this surface windows AND delegation is armed. Otherwise it falls
+// back to the pre-OPE-144 native `to(channel, target).send(message, { auth })` — byte-identical.
+// Before that change a fire ALWAYS went native, which meant no `wakeId → origin` row, grain `native`,
+// and (flag-on) neither wide hands nor a delegator; see routines/fire-window.ts for the full trace.
+//
+// LIVE-WIRING SEAM: `resolveRoutineTarget` (./routine-dispatch.ts) maps a routine's surfaceKey +
+// stored target to
+// the channel module + adapter target to post back into. Every extracted provider
+// bundle (teams/discord — OPE-114 stage 4) wires its own resolver through
+// `registerRoutineDispatch` (./routine-dispatch.ts, checked FIRST, before the in-core
+// switch below) — the same registry-seam pattern identity/binding.ts and
+// identity/capabilities.ts already use for mappers/manifests. Core keeps ONLY the
+// slack resolver inline, reaching the extracted slack channel through the provider
+// bridge (channels/slack-bridge.ts — fail-closed to dry-run when no Slack provider
+// is registered). A routine on any OTHER
+// surface (or one whose stored target is missing/incomplete) runs DRY-RUN — the
+// dispatcher logs what WOULD fire and does NOT advance its schedule (so the first real
+// fire isn't skipped once the target exists). This mirrors the egress hook's
+// dry-run-until-enforced posture: unresolvable is FAIL-CLOSED to "no send", never a
+// crash and never a send to the wrong place.
+import { defineSchedule } from "eve/schedules";
+import { bridgeConfirmChannelInternal, bridgeSlackForm } from "../channels/slack-bridge.js";
+import { resolveRoutineTarget } from "./routine-dispatch.js";
+import { routineFireAttributes } from "../routines/fire-auth.js";
+import { recheckFireCreator } from "../routines/fire-creator.js";
+import { checkFireEligibility, } from "../routines/fire-eligibility.js";
+import { divertTriggeredFire, jobFireSeatKey, runFireSeatKey } from "../routines/fire-window.js";
+import { mintWakeId } from "../channels/unified-window.js";
+import { auditRoutineDisabled, auditRoutineEligibilityUnresolved, auditRoutineFireLost, auditRoutineSkip } from "../routines/fire-audit.js";
+import { auditFireAttrsSent } from "../routines/fire-carriage.js";
+import { checkBound } from "../routines/bound.js";
+import { foldRoutineOutcome, retireExhaustedRoutine } from "../routines/outcome-fold.js";
+import { listAllRoutines, updateRoutine } from "../routines/store.js";
+import { computeNextRun, isDue, DISPATCH_TICK_MINUTES } from "../routines/schedule.js";
+import { isClockScheduled, isJobRoutine, routinePermissionGeneration, routineReportSurfaceKey } from "../routines/routine.js";
+import { renderFireMessage } from "../routines/fire-message.js";
+import { preFireFallback, runPreFire } from "../routines/pre-fire.js";
+import { gateWaitExpiredReason, gatedOnceExhausted } from "../routines/gate.js";
+import { taintedFireAttrs } from "../access/taint-signal.js";
+import { routinePartition } from "../routines/partition.js";
+import { routineFireHalted } from "../routines/fire-halt.js";
+import { scopeOverBudget } from "../spend/check.js";
+import { emitTelemetry } from "../observability/telemetry.js";
+import { getSettings } from "../settings/settings.js";
+function log(msg) {
+    console.log(`[open-everywhere:routines] ${msg}`);
+}
+// A burst of simultaneously-due routines would otherwise start an unbounded burst
+// of ROOT sessions in one tick — and each root session carries a large token budget
+// (the per-subagent token/depth caps do NOT apply to root sessions). So we bound the
+// number of routine sessions STARTED per tick; the rest stay claimable and fire on a
+// later tick (their nextRunAt is left untouched, so they remain due). Override with
+// routines.maxConcurrency; defaults to a small constant.
+function routineMaxConcurrency() {
+    return getSettings().routines.maxConcurrency;
+}
+// The DispatchTarget shape (channel + receive-target + mode + auth attributes), the provider-bundle
+// routine-dispatch registry, AND the target resolution itself now live in ./routine-dispatch.ts
+// (extracted OPE-114 stage 4 so the adapter-api barrel can re-export the seam without pulling this
+// file's defineSchedule default; resolveRoutineTarget joined them in OPE-139 so the EVENT fan-out —
+// routines/github-fanout.ts, which cannot import this module — resolves through the SAME seam
+// instead of its own hardcoded slack-only branch). Core keeps only the slack resolver inline there,
+// reaching the extracted slack channel through the provider bridge (channels/slack-bridge.ts);
+// discord/teams register their own resolvers from their bundles. A null return runs
+// DRY-RUN, fail-closed (no send, schedule not advanced, never a crash).
+// The routine's scope as a Partition (what the spend check keys on). A routine
+// carries `org` + `surfaceKey` ("platform/workspace/surface"); re-derive the tier
+// keys the same way resolvePartition does — there's no session context to bind yet.
+// A `once` trigger fires exactly ONE time — computeNextRun always returns null for it
+// (routines/schedule.ts), so nextRunAt naturally goes to null on every path below. Left
+// at status "active" that would read as a stuck routine ("active, but nothing scheduled,
+// forever") — so a PRE-fire skip (over-budget, OPE-506 ineligible-creator) disables it
+// explicitly here, keeping the row (never deleted) for audit/list visibility with a
+// declined/skipped-at marker in disabledReason. The OPE-151 CONDITION-GATE skip is the one
+// pre-fire skip that does not disable on the FIRST refusal: a gate saying "not yet" is the answer a
+// gate exists to give, so a gated `once` routine keeps its due time and is asked again on the next
+// tick — for up to `GATE_WAIT_MS` (routines/gate.ts), after which it is retired here like any other
+// pre-fire skip, because staying due means re-collecting forever (OPE-1667). A skip that reaches DELIVERY instead
+// (OPE-506) is made terminal by lifecycle.ts applyOutcome once the outcome is known, NOT
+// here — see the fire-path write below for why. The Tag-style "re-arm" pattern is to
+// create a FRESH one-shot, not to resurrect this one (create_routine's tool description
+// says so).
+function onceDisablePatch(r, now, note) {
+    return r.trigger.kind === "once" ? { status: "disabled", disabledReason: `once: ${note} at ${now.toISOString()}` } : {};
+}
+// Was a private copy of this derivation; OPE-163's read-grant check needed the SAME split from a
+// third place, which is where a duplicated identity derivation stops being harmless — so it moved
+// to routines/partition.ts and both legs call it.
+const partitionOf = (r) => routinePartition(r);
+// --- DURABLE-JOB session anchor (OPE-55) ---------------------------------------
+// A `job` routine (routine.ts sessionMode) keeps ONE persistent eve session across fires. eve keys
+// a Slack routine send by `slackContinuationToken(channelId, threadTs || randomUUID())` — so a fire
+// with NO thread gets a fresh UUID ⇒ a fresh session each time (the "stateless" behaviour today).
+// The JOIN is to pin a STABLE `threadTs` anchor: same anchor across fires ⇒ same token ⇒ eve
+// resumes the SAME session. NO new continuation-token grammar (the frozen-grammar invariant): a job
+// session is a plain surface-native token with a stable anchor, exactly how the DM seat (OPE-90)
+// gives a long-lived DM one durable session. The anchor is a REAL Slack ts (so replies thread
+// correctly), captured from a host-posted kickoff on the FIRST fire and stored on the routine.
+//
+// Live kickoff poster: post a job-thread root via chat.postMessage and return its ts. FAIL-SOFT
+// (returns undefined on any error) so a job never blocks on a posting hiccup — it degrades to a
+// fresh-session fire (still ledger-continuous via renderJobMessage's jobState block). Injected in
+// dispatchTick so the branch is testable without live Slack.
+async function liveJobKickoff(channelId, text) {
+    try {
+        const body = new URLSearchParams({ channel: channelId, text });
+        const res = await bridgeSlackForm("chat.postMessage", body.toString());
+        const ts = res?.ts;
+        return typeof ts === "string" && ts.length > 0 ? ts : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A one-line kickoff notice for a job's thread root — the durable anchor the session pins to. */
+function jobKickoffText(r) {
+    return `🔄 Starting job — I'll keep this thread as my working context and update it as I go.\n> ${r.prompt.slice(0, 240)}`;
+}
+// One dispatcher tick, factored out of the schedule handler so it can be driven
+// with an injected clock + fakes in a unit test (mirrors the deps-injection style
+// of the other host-logic tests). Reads the durable store, fires up to the
+// per-tick concurrency cap, and leaves the overflow claimable for the next tick.
+export async function dispatchTick(args) {
+    const { to, waitUntil, appAuth } = args;
+    const now = args.now ?? new Date();
+    const confirmInternal = args.confirmInternal ?? bridgeConfirmChannelInternal;
+    const postJobKickoff = args.postJobKickoff ?? liveJobKickoff;
+    let all;
+    try {
+        all = await listAllRoutines();
+    }
+    catch (err) {
+        log(`tick skipped — store read failed: ${String(err)}`);
+        return;
+    }
+    const due = all
+        .filter((r) => r.status === "active" && isClockScheduled(r.trigger) && isDue(r.nextRunAt, now))
+        // Fire the most-overdue first so a routine can't be starved behind newer ones
+        // when we're over the cap tick after tick.
+        .sort((a, b) => Date.parse(a.nextRunAt ?? "") - Date.parse(b.nextRunAt ?? ""));
+    if (due.length === 0)
+        return;
+    const cap = routineMaxConcurrency();
+    let fired = 0;
+    let dryRun = 0;
+    let deferred = 0;
+    let declined = 0;
+    // OPE-151: a CONDITION GATE skip is counted separately from a budget decline. They read the same
+    // from the row (both settle `skipped` and advance the schedule) and mean opposite things to an
+    // operator: over budget is the deployment's state, a gate saying no is the routine working.
+    let gated = 0;
+    let ineligible = 0;
+    let halted = 0;
+    let retired = 0;
+    for (const r of due) {
+        // THE CEILING (OPE-248), checked BEFORE anything else this iteration does — before the target
+        // resolves, before the concurrency cap, before the budget gate. Three reasons for that position,
+        // and all three are load-bearing:
+        //
+        //   • an exhausted routine must not consume a fire under ANY of the downstream outcomes. Every
+        //     `continue` below leaves the routine due, so a check placed after one of them would be
+        //     skipped for exactly the routines that keep coming back;
+        //   • the DEADLINE has to bind a routine whose target is unresolvable. That path (`!dest`) does
+        //     not advance the schedule, on purpose, so such a routine is due on every tick forever —
+        //     the deadline is the only thing that ever ends it, and a check below the dry-run branch
+        //     would never run for it;
+        //   • it needs no `dest`: the notice resolves its own origin inside disable-notice.ts.
+        //
+        // A routine with no bound reads `exhausted: false` off an absent field and costs one comparison,
+        // so every pre-OPE-248 row and every plain routine takes a byte-identical path.
+        //
+        // OPE-253 added a THIRD dimension to the same verdict — a job blocked by a spend checkpoint on
+        // MAX_STALLED_FIRES fires running (routines/stall.ts) — rather than a second check elsewhere, so
+        // it inherits this position and this fail-soft retire. A stop that drifted out of step with the
+        // ceiling's stop would be the defect OPE-248's own header warns about.
+        const bound = checkBound(r, now);
+        if (bound.exhausted) {
+            retired++;
+            log(`CEILING: ${r.id} on ${r.surfaceKey} stopped — ${bound.reason}`);
+            // Fail-soft, and it must be: a store or posting hiccup while retiring one routine cannot be
+            // allowed to abort the tick and starve every routine behind it in the queue. The row stays
+            // active and is retired on the next tick, which is the same "try again shortly" posture the
+            // deferral path takes.
+            try {
+                await retireExhaustedRoutine({ routine: r, verdict: bound });
+            }
+            catch (err) {
+                log(`ceiling retire failed for ${r.id} on ${r.surfaceKey}: ${String(err)}`);
+            }
+            continue;
+        }
+        const dest = resolveRoutineTarget(r);
+        // The fire's DESTINATION platform + surfaceKey (OPE-148). These guard reads of `dest` — the
+        // slack-only `confirmInternal` branch and the window divert — so they must describe where the
+        // fire actually LANDS, not where the routine lives. For every routine without a `{kind:"surface"}`
+        // report those are the same string, so this is a no-op for all of them; for a redirected one,
+        // keying either off `r.surfaceKey` would ask a Slack question about a Linear key and silently
+        // fail closed (no trust verdict ⇒ domain skills off) or window the wrong surface's grain.
+        // Ownership, spend (`partitionOf`), GC reach and the `routine.fire` marker keep reading
+        // `r.surfaceKey` — that is the half of the split that stays fused.
+        const fireSurfaceKey = routineReportSurfaceKey(r);
+        const firePlatform = fireSurfaceKey.split("/")[0];
+        if (!dest) {
+            dryRun++;
+            log(`DUE (dry-run, unresolvable channel/target): ${r.id} on ${r.surfaceKey} — "${r.prompt.slice(0, 60)}"`);
+            // OPE-145: a dry-run is a routine that was DUE and did NOT run — indistinguishable from
+            // "never scheduled" from the outside until now, and console logs already proved unobservable
+            // in prod. THROTTLED (fire-audit.ts), because an unwired routine is due on every 10-minutely
+            // tick forever: one row per hour with a `suppressed` count, not 144 identical rows a day.
+            await auditRoutineSkip(r, "unresolved_target", { trigger: r.trigger.kind });
+            continue; // do NOT advance: keep it due until a channel + target exists
+        }
+        if (fired >= cap) {
+            // Over the per-tick cap: leave nextRunAt untouched so it stays due and is
+            // re-claimed on a later tick. Never advanced here => never dropped. DELIBERATELY NOT
+            // AUDITED (OPE-145): this routine is going to fire, just on a later tick — "not yet" is not
+            // a skip, and a row per deferral would be pure tick noise.
+            deferred++;
+            continue;
+        }
+        // Advance from the instant this routine was DUE, not the instant the tick happened to run
+        // it (OPE-146 / audit §S11). The dispatcher ticks every DISPATCH_TICK_MINUTES, so a fire
+        // always lands in [due, due + tick); anchoring the recompute on `now` compounds that
+        // lateness into the period itself and an `everyMinutes: 15` routine settles into a
+        // 20-minute cadence. `notBefore: now` keeps the result strictly in the future, so a long
+        // gap catches up onto the grid instead of replaying a backlog. Cron is wall-clock-anchored
+        // and takes the later of the two — unchanged. A missing/garbage nextRunAt falls back to
+        // `now` (the pre-OPE-146 behaviour), never to NaN.
+        const dueAt = Date.parse(r.nextRunAt ?? "");
+        const next = computeNextRun(r.trigger, Number.isFinite(dueAt) ? new Date(dueAt) : now, now);
+        // Session mode of the fire's surface — resolved per platform in resolveTarget
+        // from positive stored facts (fail-closed to "channel", the capped arm). Reused
+        // both for the budget gate below and for the trust recheck's channel gate.
+        const mode = dest.mode;
+        // Live trust recheck (fail-closed): stamped ONLY on a positive LIVE check at
+        // fire time — confirmChannelInternal (channels/slack-events.ts), the same
+        // fail-closed, TTL-cached (≤5 min) conversations.info gate the name-drop wake
+        // trusts for its own security decision. This is NOT a verdict cached on the
+        // routine at create time (the "re-open-the-leak" case identity/binding.ts warns
+        // about — a channel that goes external must stop being treated as internal):
+        // every fire re-verifies, with the same staleness bound a live message's own
+        // enrichVisibility accepts. Only a Slack CHANNEL fire can be positively
+        // confirmed today — Discord/Teams have no membership-verification
+        // gate even on their INBOUND paths (their mappers leave trust undefined), so
+        // their fires stamp nothing and bindFrom's fail-closed default (external)
+        // keeps shared memory and the runtime domain-skills tier OFF, exactly matching
+        // what a live inbound turn on those surfaces gets. A confirmed-internal Slack
+        // channel arms them — which is what makes "author a skill, then cron a
+        // workflow on it" work at all. Bundle-GRANTED skills (access/request.ts
+        // domainsForSurface) are not trust-gated and arm from the surface stamp alone,
+        // on every platform.
+        // dest.target is provider-open (the DispatchTarget.target widening for extracted bundles), so
+        // read channelId with a typeof guard rather than relying on union narrowing off the channel id.
+        //
+        // POSITION (OPE-275): computed BEFORE the budget gate, because the gate CONSUMES the verdict —
+        // `perDomain["dm"]`/`perDomain["public"]` classify by (mode, trust) (spend/caps.ts
+        // domainNameForScope), and a gate called with `trust: undefined` skips the criteria layer
+        // entirely. That was the hole: `perDomain: { dm: … }` — the documented "every person gets
+        // their own monthly budget" config — declined a person's attended DM turns while their own
+        // everyMinutes DM cron resolved NO cap at all and fired forever. The same verdicts are reused
+        // for the auth stamp below, so the trust the gate classified by and the trust the fired
+        // session binds with cannot disagree.
+        const slackChannelId = firePlatform === "slack" && typeof dest.target.channelId === "string"
+            ? dest.target.channelId
+            : undefined;
+        // Teams' room + identity fields for the eligibility leg below (OPE-522). Unlike Slack's
+        // channelId (read off `dest.target`, the shape a live send actually consumes), these ride on
+        // `dest.attributes` — the raw-fact bag @open-everywhere/provider-teams's resolveTeamsTarget
+        // populates for exactly this kind of downstream-logic read, never the adapter call (see
+        // routine-dispatch.ts's DispatchTarget.target doc). `undefined` on any leg is "cannot check",
+        // not "removed" — checkFireEligibility's Teams branch treats an absent id as a no-op.
+        const teamsChannelId = firePlatform === "teams" && typeof dest.attributes["channel_id"] === "string" ? dest.attributes["channel_id"] : undefined;
+        const teamsTeamId = firePlatform === "teams" && typeof dest.attributes["team_id"] === "string" ? dest.attributes["team_id"] : undefined;
+        const teamsAadObjectId = firePlatform === "teams" && typeof dest.attributes["aad_object_id"] === "string" ? dest.attributes["aad_object_id"] : undefined;
+        // OPE-1810 — the regional Bot Connector endpoint. The membership read turns `teamsTeamId` (the
+        // Connector's `19:…` spelling) into the Microsoft 365 group id Graph takes, and that resolution
+        // is a Connector call addressed HERE. Absent ⇒ the read is unresolvable on an uncached team, and
+        // the fire takes the audited fail-open below rather than a wrong-team read.
+        const teamsServiceUrl = firePlatform === "teams" && typeof dest.attributes["service_url"] === "string" ? dest.attributes["service_url"] : undefined;
+        // THE BREAK-GLASS HALT (OPE-1602) — the clock leg's half of the shared predicate
+        // (routines/fire-halt.ts; the event fan-out calls the same function). FIRST among the async
+        // gates, before any network recheck, for the reason the eligibility comment below states: a
+        // fire that must not happen at all should not spend a network read deciding whether it can
+        // afford to. Fail-CLOSED, unlike the two gates under it — a halt is the opposite kind of
+        // control, and this leg's store is the one the routines themselves came from.
+        //
+        // 🔴 IT EDITS NO ROW. The ineligible and over-budget branches advance the schedule and carry
+        // `onceDisablePatch`, which would DISABLE a `once` routine outright — permanent loss of a fire
+        // because a temporary halt happened to cover its minute. A halt leaves `nextRunAt` where it is,
+        // so every routine it skipped fires by itself on the first tick after `resume`. The re-attempt
+        // per tick costs one store read, and the skip row is throttled hourly by auditRoutineSkip.
+        if (await routineFireHalted(r, { trigger: r.trigger.kind })) {
+            halted++;
+            log(`SKIPPED (halted): ${r.id} on ${r.surfaceKey} — "${r.prompt.slice(0, 60)}"`);
+            continue;
+        }
+        const internal = slackChannelId !== undefined && mode === "channel" ? await confirmInternal(slackChannelId).catch(() => false) : false;
+        // THE OTHER HALF OF THE SAME RECHECK (OPE-269). `confirmInternal` above answers "is this
+        // CHANNEL still internal"; a DM has no channel membership to ask about — its trust means "is
+        // the PARTNER internal", and on an unattended fire the partner is the person whose DM this is,
+        // i.e. the routine's creator. That question was never asked before this line existed, so a DM
+        // fire fell to the fail-closed default and lost the shared read layer its creator's own live
+        // DM resolves. Same fail-closed posture as the line above, same per-fire freshness: a creator
+        // who has left, been de-vouched, or become a guest yields `false` and the fire binds external.
+        const creatorInternal = await recheckFireCreator({
+            createdBy: r.createdBy,
+            platform: firePlatform,
+            mode,
+            workspaceId: fireSurfaceKey.split("/")[1],
+            ...(args.confirmCreatorInternal ? { check: args.confirmCreatorInternal } : {}),
+        }).catch(() => undefined);
+        // The fire's trust, as the budget gate reads it: positive live evidence or nothing. A DM fire
+        // is its creator's standing; a channel fire is the channel's own recheck; everything
+        // unverifiable is `external` — the SAME fail-closed default the fired session binds with, so
+        // an unverifiable fire is judged by the (typically tighter) `public` criteria budget rather
+        // than escaping classification.
+        const fireTrust = (mode === "dm" ? creatorInternal === true : internal) ? "internal" : "external";
+        // THE CREATOR ELIGIBILITY PREDICATE (OPE-506, Tag's policy verbatim — routines/
+        // fire-eligibility.ts) — checked BEFORE the budget gate, for the same reason budget is checked
+        // before firing: a fire that must not happen at all should not spend a network read deciding
+        // whether it can afford to. "Creator still belongs to the room AND the account is active",
+        // re-derived live with the same fail-closed-on-a-CONFIRMED-no posture the trust rechecks above
+        // take. A confirmed no SKIPS this run — never a failure, never the three-strike counter — and
+        // retries at the routine's own next scheduled fire (no early retry, no backoff). An unresolved
+        // probe is not a "no" and never skips. Never let an eligibility hiccup block a fire outright —
+        // the same fail-open posture the budget check below takes on ITS own errors.
+        const eligibility = await checkFireEligibility({
+            createdBy: r.createdBy,
+            platform: firePlatform,
+            roomId: firePlatform === "teams" ? teamsChannelId : slackChannelId,
+            ...(args.confirmRoomMembership ? { membershipCheck: args.confirmRoomMembership } : {}),
+            ...(args.confirmCreatorActive ? { activeCheck: args.confirmCreatorActive } : {}),
+            ...(teamsTeamId ? { teamsTeamId } : {}),
+            ...(teamsAadObjectId ? { teamsCreatorAadObjectId: teamsAadObjectId } : {}),
+            ...(teamsServiceUrl ? { teamsServiceUrl } : {}),
+            ...(args.confirmTeamsRoomMembership ? { teamsMembershipCheck: args.confirmTeamsRoomMembership } : {}),
+            ...(args.confirmTeamsCreatorActive ? { teamsActiveCheck: args.confirmTeamsCreatorActive } : {}),
+        }).catch(() => ({ eligible: true }));
+        if (!eligibility.eligible) {
+            ineligible++;
+            log(`SKIPPED (${eligibility.reason}): ${r.id} on ${r.surfaceKey} — "${r.prompt.slice(0, 60)}"`);
+            await updateRoutine(r.org, r.surfaceKey, r.id, {
+                lastRunAt: now.toISOString(),
+                nextRunAt: next ? next.toISOString() : null,
+                lastOutcome: "skipped",
+                lastFailureReason: undefined,
+                ...onceDisablePatch(r, now, `skipped (${eligibility.reason})`),
+            });
+            // OPE-145-shaped: this run leaves a durable trace even though no session ever started, exactly
+            // like the over-budget decline right below it. THROTTLED — a creator who stays removed from
+            // the room reports hourly rather than on every tick forever.
+            await auditRoutineSkip(r, eligibility.reason, { trigger: r.trigger.kind }).catch(() => false);
+            continue;
+        }
+        // THE FAIL-OPEN, MADE VISIBLE (OPE-1810). The fire IS eligible, but the Teams room check could
+        // not answer — a Graph permission the install lacks, a team whose group id will not resolve, a
+        // roster larger than the page bound. Tommy's 2026-09-13 ruling keeps that arm firing; it also
+        // requires the arm to leave a row, because a silent fail-open reads exactly like a pass. The
+        // row is throttled hourly per (routine, check), and a failure to write it never blocks the fire.
+        if (eligibility.teamsMembershipUnresolved !== undefined) {
+            await auditRoutineEligibilityUnresolved(r, { check: "teams_room_membership", cause: eligibility.teamsMembershipUnresolved }).catch(() => false);
+        }
+        // Spend gate — proactive work has no human ask to decline, so the dispatcher
+        // enforces the same cap the inbound handler does, on EVERY surface INCLUDING DMs
+        // (OPE-267 removed checkCap's DM exemption; a DM fire is now gated exactly like a
+        // channel fire). 🔴 AND IT CANNOT ESCAPE: the ADMIN bypass that lets a human step over
+        // a cap lives in spend/bypass.ts and is consulted ONLY by the attended ingress gates —
+        // never here. That is what keeps "an org admin may always spend in their DM" from
+        // becoming "an org admin's DM ROUTINE may always spend", which would be an unbounded
+        // unattended loop belonging to exactly the people whose routines cost the most.
+        // The absence of a capBypassFor call on this path IS the fence; spend-test.ts asserts
+        // it structurally rather than trusting this comment. A declined fire records `skipped` (a correct
+        // "nothing to do", not a failure — see lifecycle.applyOutcome) and ADVANCES the
+        // schedule, so it retries at its own cadence rather than re-checking the budget
+        // every tick. Fail-open on a check error, mirroring the inbound path: budget
+        // checking never blocks a fire.
+        try {
+            // `r.createdBy` (5th arg) is the PER-USER budget axis (OPE-268). A routine's spend is
+            // recorded under its creator — OPE-269 bound the fire to them precisely so the ledger,
+            // the audit trail and an approval card could say whose it is — so its creator's budget is
+            // the only one that can be compared against those rows without charging one person and
+            // measuring another. It grants the fire nothing: the creator's AUTHORITY is fenced off
+            // separately (actingPrincipalId returns undefined here), and the fire still gets no admin
+            // bypass, so a per-user allowance can raise what a person's own routines spend but can
+            // never move the surface or workspace ceiling above them.
+            // `fireTrust` (4th arg, OPE-275) is the live per-fire recheck computed above — it is what
+            // lets the gate resolve the dm/public criteria budgets for an unattended fire at all.
+            const verdict = await scopeOverBudget(partitionOf(r), mode, now.toISOString(), fireTrust, r.createdBy);
+            if (verdict.over) {
+                declined++;
+                log(`DECLINED (over budget): ${r.id} on ${r.surfaceKey} — ${verdict.reason ?? "cap reached"}`);
+                await updateRoutine(r.org, r.surfaceKey, r.id, {
+                    lastRunAt: now.toISOString(),
+                    nextRunAt: next ? next.toISOString() : null,
+                    lastOutcome: "skipped",
+                    // OPE-177: a decline REPLACES the last outcome, so the reason that belonged to it goes
+                    // with it — otherwise a declined run inherits the previous run's diagnosis.
+                    lastFailureReason: undefined,
+                    ...onceDisablePatch(r, now, "declined (over budget)"),
+                });
+                // OPE-145: `lastOutcome: "skipped"` on the row is overwritten by the NEXT fire, so without
+                // this the decline leaves no lasting trace of why a run is missing. THROTTLED — a scope
+                // that is over budget stays over budget for the rest of the month.
+                // The `.catch` is load-bearing, not decoration: this sits INSIDE the budget-check try, so
+                // an exception here would be swallowed by its "never let budget checking block a fire"
+                // catch and fall through to firing a routine whose schedule was already advanced as
+                // declined. Auditing must never resurrect a declined fire.
+                await auditRoutineSkip(r, "over_budget", { ...(verdict.reason ? { budgetReason: verdict.reason } : {}) }).catch(() => false);
+                continue;
+            }
+        }
+        catch {
+            /* never let budget checking block a fire */
+        }
+        // THE PRE-FIRE STEP (OPE-151, routines/pre-fire.ts) — the routine's declared reads, then its
+        // declared condition gate. It sits HERE, after the spend gate and before the optimistic advance,
+        // and both sides of that position are deliberate:
+        //   • AFTER the budget check, because a scope that is over budget must not pay for a collection
+        //     it will not use, and because being over budget is the deployment's state rather than
+        //     anything a predicate should get an opinion on;
+        //   • BEFORE the advance and the delivery, because "no session, no spend" is the whole claim a
+        //     condition gate makes. A gate consulted after the session started would be an expensive way
+        //     of learning the run was unnecessary.
+        // A routine that declares neither reads nothing and costs nothing (see runPreFire's own note).
+        // `runPreFire` never throws by contract; the fallback exists so that if it ever did, a routine
+        // carrying a GATE fails CLOSED (skipped, with the reason named) rather than firing ungated. A
+        // routine with no gate is unaffected — there is nothing to fail closed about, and it fires
+        // carrying one NOT COLLECTED line per collector it declared. The fallback is BUILT IN ONE PLACE
+        // (routines/pre-fire.ts preFireFallback) because the event fan-out needs the same one, and the
+        // two private copies this replaced had both lost those lines (OPE-1667).
+        const pre = await runPreFire(r, now.toISOString()).catch((err) => preFireFallback(r, err));
+        if (!pre.gate.fire) {
+            // The SAME advance-and-record shape the over-budget decline above uses, for the same reason:
+            // the routine keeps its cadence and re-checks its condition on its own next tick rather than
+            // staying due and re-collecting on every tick in between. `skipped` is the honest outcome —
+            // a correct "nothing to do", never a failure (lifecycle.ts applyOutcome), so a gate used
+            // correctly can never three-strike-disable the routine that uses it.
+            gated++;
+            // The ceiling is read BEFORE the patch below, because the patch is what acts on it.
+            const gateExhausted = r.trigger.kind === "once" && gatedOnceExhausted(r.trigger.at, now);
+            log(`GATED (condition not met): ${r.id} on ${r.surfaceKey} — ${pre.gate.why}${gateExhausted ? " — WAIT EXPIRED, retiring the one-shot" : ""}`);
+            await updateRoutine(r.org, r.surfaceKey, r.id, {
+                // 🔴 `lastRunAt` IS NOT STAMPED HERE, unlike on every other skip arm. It is what
+                // routines/watch.ts firePreamble renders as "previous run" into the fire's own message, and a
+                // gated tick is a run that did NOT happen. A gated `once` routine stays due (below), so
+                // stamping it would rewrite that field on every tick, and the fire that IS the first run
+                // would open with "previous run: 10 minutes ago" instead of "previous run: none — this is
+                // the FIRST run". The `routine.skip` row already carries the instant, so nothing is lost.
+                //
+                // 🔴 A `once` ROUTINE IS LEFT DUE, AND IS NEVER DISABLED HERE FOR SAYING "NOT YET". This is
+                // the one pre-fire skip that must not retire a one-shot, and the motivating example is
+                // exactly a one-shot: "tell the customer their bug is fixed", gated on the release actually
+                // serving. At its scheduled minute the release is still building — and `computeNextRun`
+                // returns null for `once`, so writing `nextRunAt` here would take the row out of `isDue` and
+                // the customer would never be told. "Not yet" is the whole answer a gate exists to give, so
+                // the row keeps its due time and the gate is asked again on the next tick. Every other
+                // trigger kind advances, exactly as the over-budget decline above does.
+                //
+                // 🔴 BUT THE WAIT IS BOUNDED (OPE-1667, routines/gate.ts GATE_WAIT_MS). Staying due means
+                // being re-collected on EVERY tick, and a collector is a real outbound read — so a one-shot
+                // whose condition never holds read the world every ten minutes forever, behind a skip row
+                // throttled to one an hour. Past the wait the one-shot is retired here, with the same patch
+                // shape the over-budget decline uses — `nextRunAt` nulled beside the disable, so a retired
+                // row never reads as "disabled, and yet due since yesterday" — and a `routine.disabled` row
+                // below saying so.
+                ...(r.trigger.kind === "once"
+                    ? gateExhausted
+                        ? { nextRunAt: null, ...onceDisablePatch(r, now, gateWaitExpiredReason(r.gate)) }
+                        : {}
+                    : { nextRunAt: next ? next.toISOString() : null }),
+                lastOutcome: "skipped",
+                // Cleared with the outcome it belongs to, exactly as the decline above clears it.
+                lastFailureReason: undefined,
+            });
+            await auditRoutineSkip(r, "condition_gate", {
+                ...(pre.gate.gate ? { gate: pre.gate.gate } : {}),
+                gateReason: pre.gate.why,
+            }).catch(() => false);
+            // 🔴 THE FINAL ROW, AND IT CANNOT BE THE SKIP ROW. `auditRoutineSkip` is throttled to one row
+            // per (routine, reason) per hour, so the tick that retires the one-shot is the likeliest of
+            // all to have its skip row suppressed — the routine has been writing `condition_gate` rows for
+            // a day. `auditRoutineDisabled` is unthrottled and is written at most once per routine, which
+            // is exactly the shape of this fact.
+            if (gateExhausted) {
+                await auditRoutineDisabled(r, `once: ${gateWaitExpiredReason(r.gate)}`, r.consecutiveFailures, undefined, {
+                    ...(pre.gate.gate ? { gate: pre.gate.gate } : {}),
+                    gateReason: pre.gate.why,
+                }).catch(() => undefined);
+            }
+            continue;
+        }
+        // Advance the schedule first (optimistic) so an overlapping tick can't
+        // double-fire it — but DON'T claim an outcome here: ok/failed is only known
+        // when the fired session finishes. We stamp the routine link onto the
+        // session's auth so agent/hooks/routine-outcome.ts records the real result
+        // (and lets a repeatedly-failing routine self-disable). `lastOutcome` is
+        // CLEARED on every fire ("outcome pending") so a `skipped` seen at session end
+        // was written by THIS run — the invariant settleOutcome (lifecycle.ts) rests on.
+        try {
+            await updateRoutine(r.org, r.surfaceKey, r.id, {
+                lastRunAt: now.toISOString(),
+                nextRunAt: next ? next.toISOString() : null,
+                lastOutcome: undefined,
+                // OPE-177: the DECLARED failure reason is cleared with the outcome it belongs to, for the
+                // same invariant and in the same write. Without this a run that declared "payments API 500"
+                // would leave its words on the row, and the NEXT run's session-level crash would be audited
+                // under a diagnosis nobody in that run ever gave.
+                lastFailureReason: undefined,
+                // THE STALL FACT (OPE-253) is cleared with the outcome it belongs to, in the same write, for
+                // the SAME invariant `lastFailureReason` rests on: a value present when the fold reads the row
+                // was written by THIS run. That is the whole mechanism by which a stall run stays CONSECUTIVE
+                // — its absence at the fold is what breaks the run (routines/stall.ts stallFoldPatch) — and it
+                // is also what makes the stall recorder idempotent per fire (outcome-fold.ts
+                // recordCheckpointStall treats "already set" as "this fire is already counted"). Written
+                // unconditionally, exactly like the two fields above it: clearing an absent field changes no
+                // stored JSON, and conditioning it would leave a stale stamp on the one path — a routine that
+                // stalled once, long ago — where it does the damage.
+                lastStallAt: undefined,
+                // MANUAL-RUN REQUEST CONSUMED (OPE-147). `run_routine_now` sets `manualRunAt` and makes the
+                // routine due; this fire IS that run, so the flag is cleared in the SAME optimistic advance
+                // that guards against a double-fire. Clearing it here — not at session end — is what makes
+                // "run it now" one extra run rather than a mode the routine gets stuck in: whatever happens
+                // to the fired session, the next tick sees an ordinary scheduled routine again.
+                ...(r.manualRunAt !== undefined ? { manualRunAt: undefined } : {}),
+                // THE FIRE COUNT (OPE-248) — incremented in the SAME optimistic advance that guards against
+                // a double-fire, so the counter and the schedule can never disagree about how many fires
+                // happened. It counts fires ATTEMPTED, not fires that succeeded: a job whose every fire is
+                // lost at delivery is exactly a job that should still hit a ceiling, and counting outcomes
+                // instead would make the ceiling depend on the same session-end hook that the three-strike
+                // fold already covers. Written ONLY for a bounded routine, so an unbounded row's patch — and
+                // therefore its stored JSON — is byte-identical to before.
+                //
+                // 🔴 A STALLED FIRE COUNTS (OPE-253), and it is decided here rather than left accidental. A
+                // fire soft-blocked by a spend checkpoint still WOKE the session, ran a turn, read, replied and
+                // billed tokens — "fires attempted" is exactly what it is, and exempting it would make the
+                // stall the one way a fire can consume real budget without consuming any ceiling, which
+                // inverts what the ceiling is for. It would also re-open the hole OPE-248 closed on any row
+                // carrying a `maxFires` and no `until`: with stalls exempt, such a job could stall forever
+                // against a frozen counter with nothing left to bind it.
+                //
+                // What OPE-253 changes is not whether a stall counts but how much of the ceiling it can burn:
+                // the stall dimension trips at 3 (routines/stall.ts), so a job that cannot act retires after
+                // ~3 wasted fires instead of grinding out all 200 and then reporting that nothing failed.
+                ...(r.bound ? { fireCount: (r.fireCount ?? 0) + 1 } : {}),
+                // OPE-506: a `once` routine is NO LONGER disabled here, pre-emptively, before its outcome is
+                // known. It goes through delivery/the session exactly like a recurring routine, and
+                // lifecycle.ts applyOutcome (via the fold, either ingress) is what makes it terminal
+                // AFTERWARDS — with a `disabledReason` that reflects what actually happened (success or the
+                // real failure), rather than the generic "fired" note a failure could never overwrite. The
+                // row is briefly `active` with `nextRunAt: null` between this write and the fold — harmless:
+                // `nextRunAt: null` already keeps it out of `due` (isDue), so it cannot double-fire, and
+                // every routine kind already carries the identical brief window today.
+            });
+            // DURABLE-JOB session join (OPE-55): a `job` routine resumes ONE persistent session across
+            // fires by pinning a STABLE thread anchor in the receive target — same anchor ⇒ same
+            // `slackContinuationToken(channelId, anchor)` ⇒ eve resumes the same session. On the FIRST
+            // fire (no anchor yet) host-post a kickoff thread-root and store its ts; later fires reuse it.
+            // Slack-only in v1 (the surface OE token-controls + can host-post into); a job on any other
+            // surface fires FRESH each time but still gets LEDGER continuity via renderJobMessage's
+            // jobState block (Slice 2 without Slice 1). Fail-soft: a failed kickoff post degrades to a
+            // fresh-session fire (never blocks). Non-job routines skip all of this (byte-identical).
+            let fireTarget = dest.target;
+            let jobAnchor = r.jobSessionAnchor;
+            if (isJobRoutine(r)) {
+                if (firePlatform === "slack" && "channelId" in dest.target && typeof dest.target.channelId === "string") {
+                    const channelId = dest.target.channelId;
+                    if (!jobAnchor) {
+                        jobAnchor = await postJobKickoff(channelId, jobKickoffText(r));
+                        if (jobAnchor) {
+                            await updateRoutine(r.org, r.surfaceKey, r.id, { jobSessionAnchor: jobAnchor });
+                        }
+                        else {
+                            log(`job ${r.id}: kickoff post failed — firing fresh this tick (no session join)`);
+                        }
+                    }
+                    if (jobAnchor)
+                        fireTarget = { channelId, threadTs: jobAnchor };
+                }
+                else {
+                    log(`job ${r.id} on ${r.surfaceKey}: durable-job session-join is Slack-only in v1 — firing with ledger continuity only`);
+                }
+            }
+            // The stamped attribute bag (platform identity + live trust + root-DM grain + job stamps +
+            // the routine marker) is built by routines/fire-auth.ts — the ONE shape, shared with the
+            // EVENT fan-out (routines/github-fanout.ts) since OPE-143. `mode==="dm"`/`"mpim"`, the
+            // positive stored facts it keys the grain stamp on, are the same ones
+            // resolveRoutineTarget derives; the full rationale for each stamp lives in that module.
+            //
+            // THE FIRE'S OWN ID is minted first, because the bag carries it (OPE-626). One uuid names this
+            // fire in three places — the auth bag's per-fire stamp, the run seat key, and the window
+            // divert's wake id — so the outcome fold latches the same fire on both delivery legs.
+            const fireWakeId = mintWakeId();
+            const markedAuth = {
+                ...appAuth,
+                attributes: {
+                    ...appAuth.attributes,
+                    ...routineFireAttributes(r, dest.attributes, mode, internal, creatorInternal, fireWakeId),
+                    // A durable Slack job is dispatched INSIDE the host-created kickoff thread. The durable
+                    // wake origin and the binding snapshot must therefore name the same thread; leaving the
+                    // original channel-only auth here makes the binding/origin guard correctly refuse the
+                    // mismatched authority before the job can start.
+                    ...(firePlatform === "slack" && isJobRoutine(r) && jobAnchor ? { thread_ts: jobAnchor } : {}),
+                    // OPE-151 TAINT STAMP, exactly the shape routines/ingress.ts stamps for an event fire. A
+                    // collector's output is whatever an external system returned, and `renderCollectedBlock`
+                    // fences it HERE — on the dispatcher's tick, where the taint half of `ingestUntrusted`
+                    // would fail-soft to a no-op — so without this stamp the fired session would run with a
+                    // CLEAN taint signal while its opening message carried an outside party's bytes. The
+                    // fired turn seeds the real signal from it (hooks/spawn-taint.ts TAINT_SEED_ATTRS).
+                    //
+                    // CONDITIONAL on the collection actually carrying data, for the reason the webhook plane's
+                    // `trigger-only` posture is: a fire whose every collector FAILED carries only our own prose
+                    // saying so, and stamping it anyway would make the signal mean "this routine collects"
+                    // instead of "an outside party wrote something here" — degrading `remember`'s quarantine
+                    // and every approval card's warning line for a fire that read nothing.
+                    ...taintedFireAttrs(pre.tainted),
+                },
+            };
+            // OPE-144 — the fire's WAKE ORIGIN, host-derived from the resolved target. A durable JOB
+            // narrows it to the stored thread anchor so the job's answers land in the job's own thread
+            // (the same anchor the native path pinned the session on); every other fire replies where the
+            // routine posts. `undefined` on any platform whose bundle hasn't declared an origin ⇒ the
+            // native path below, unchanged.
+            const fireOrigin = dest.origin && dest.origin.platform === "slack" && isJobRoutine(r) && jobAnchor
+                ? { ...dest.origin, threadTs: jobAnchor }
+                : dest.origin;
+            // A job resumes ONE seat across fires (a STABLE seat key); every other fire is its own run.
+            // The job seat carries the routine's AUTHORITY GENERATION (OPE-147), so an `edit_routine`
+            // rotates it: the edited job resumes on a FRESH eve session rather than one whose backscroll
+            // still holds the prompt it was told to stop following. Continuity is preserved by the
+            // ledger, which renderJobMessage re-injects — the same path a session lost to rotation takes.
+            const seatKey = isJobRoutine(r) ? jobFireSeatKey(r.id, routinePermissionGeneration(r)) : runFireSeatKey(fireWakeId);
+            // ONE definition of what a fire is told (routines/fire-message.ts) — shared with the
+            // `create_routine` PREVIEW, so the preview cannot describe a message the dispatcher wouldn't
+            // send. Renders from the local PRE-advance `r`, so the preamble's "previous run" is the run
+            // before this one.
+            // OPE-151: the fire's PRE-RUN COLLECTION rides the same one definition. `collected` is a
+            // per-FIRE input rather than a field of the row, so it is a parameter — but it goes through
+            // renderFireMessage, not around it, so `create_routine`'s preview still describes the shape of
+            // the message this line sends.
+            const message = renderFireMessage(r, pre.collected);
+            // THE DELIVERY, one decision: join the unified window at THREAD grain when this surface windows
+            // and delegation is armed (routines/fire-window.ts), else the pre-OPE-144 native `to(...).send(...)` —
+            // byte-identical, same message, same target, same auth. Both legs share the SAME loud catch, so
+            // the OPE-145 `routine.fire_lost` forensic row is written wherever the fire is lost.
+            const deliver = async () => {
+                // FIRE-CARRIAGE PROBE, SENT SIDE (OPE-483 — routines/fire-carriage.ts). Written BEFORE the
+                // delivery decision, for two reasons: the row then exists even when the delivery throws and
+                // the fire is lost, and it describes the bag THIS module attached rather than whatever a
+                // downstream leg adds to it. The window divert stamps its own grain/window attributes on
+                // top, so on that leg the session's SEEN keys are a strict superset of these — the invariant
+                // that holds on both legs is SENT ⊆ SEEN, and a SEEN set missing a SENT key is the defect.
+                // Names only, never values; fail-soft by contract.
+                await auditFireAttrsSent(r, markedAuth.attributes, fireWakeId);
+                if (fireOrigin) {
+                    const diverted = await divertTriggeredFire(to, { message, surfaceKey: fireSurfaceKey, origin: fireOrigin, seatKey, auth: markedAuth, wakeId: fireWakeId });
+                    if (diverted)
+                        return;
+                }
+                // `message` was rendered above through routines/fire-message.ts (job protocol / watch
+                // post-on-diff protocol / plain preamble+prompt, silent block folded into each).
+                // Job fire: the STABLE thread anchor (fireTarget) pins the session; every other fire uses
+                // the resolved target unchanged.
+                await to(dest.channel, fireTarget).send(message, { auth: markedAuth });
+            };
+            // A rejected delivery (adapter precondition, missing platform token, API failure, or a
+            // refused unified divert) must never surface as an unhandled rejection from the tick —
+            // the fire is lost; the routine-outcome hook never runs (the session never
+            // started), so lastOutcome stays pending and a human reading list_routines
+            // sees the gap.
+            //
+            // OPE-145: the gap used to be the ONLY signal, and only if someone was looking. A
+            // `routine.fire_lost` row now says so durably. It carries `sessionId: null` on purpose —
+            // there is genuinely no session to join to, and an absent field would read as a
+            // recording bug rather than as the fact.
+            //
+            // OPE-146: and it now COUNTS. A rejected delivery is a failed run, so it folds through the
+            // same seam the session-end hook uses (routines/outcome-fold.ts) — three of them and the
+            // routine self-disables, with a `routine.disabled` row, exactly as three crashed sessions
+            // would. Before this the counter only ever saw eve session outcomes, so a routine on an
+            // archived channel (or one the bot was kicked from) retried on every tick forever, burning
+            // a per-tick concurrency slot and leaving nothing but a log line. This is also the ONLY
+            // mechanism the deployment has for "removing it from the surface ends it" — there is no
+            // membership enumerator anywhere in the tree.
+            //
+            // ORDER IS LOAD-BEARING: `routine.fire_lost` is written FIRST, so the loss is recorded
+            // even if the fold's store write is the thing that's broken. The fold's own failure is
+            // logged and swallowed — a forensics/bookkeeping step must never turn a lost fire into an
+            // unhandled rejection out of the tick.
+            waitUntil(deliver().catch(async (err) => {
+                log(`fire delivery failed for ${r.id} on ${r.surfaceKey}: ${String(err)}`);
+                await auditRoutineFireLost(r, String(err));
+                try {
+                    const folded = await foldRoutineOutcome({
+                        marker: { id: r.id, surfaceKey: r.surfaceKey, org: r.org },
+                        sessionOutcome: "failed",
+                        at: now,
+                    });
+                    if (folded.folded) {
+                        log(`delivery failure folded for ${r.id} [${r.surfaceKey}] ` +
+                            `(fails=${folded.consecutiveFailures}${folded.disabled ? ", AUTO-DISABLED" : ""})`);
+                    }
+                }
+                catch (foldErr) {
+                    log(`delivery-failure fold skipped for ${r.id}: ${String(foldErr)}`);
+                }
+            }));
+            fired++;
+            emitTelemetry("oe.feature.used", { "oe.feature": "routine_fired", "oe.outcome": "ok" });
+        }
+        catch (err) {
+            log(`failed to dispatch ${r.id} on ${r.surfaceKey}: ${String(err)}`);
+            emitTelemetry("oe.feature.used", { "oe.feature": "routine_fired", "oe.outcome": "failed" });
+        }
+    }
+    log(`tick: ${due.length} due -> ${fired} fired, ${dryRun} dry-run, ${declined} declined, ${gated} condition-gated, ${ineligible} ineligible, ${deferred} deferred` +
+        `${halted > 0 ? `, ${halted} halted` : ""}${retired > 0 ? `, ${retired} retired at ceiling` : ""} (cap ${cap})`);
+}
+export default defineSchedule({
+    // Tick every 10 minutes (UTC). The nextRunAt model is tick-cadence-independent, so
+    // a routine fires on the first tick at/after its due time, never double-fires —
+    // the cost of a slower tick is only LATENESS (worst case ~10 min after due).
+    //
+    // Why 10 and not every minute: each tick reads the routine store, and on a
+    // scale-to-zero Postgres (Neon) a query every minute defeats autosuspend entirely —
+    // the compute endpoint stays awake 24/7 and compute-hours become the whole bill
+    // (observed live 2026-07-07: ~84% duty cycle, spend ≈ pure compute). The tick
+    // cadence must comfortably exceed the DB's suspend timeout for it to ever sleep.
+    // If a deployment genuinely needs minute-resolution routines, tighten this cron
+    // AND accept an always-on database — that's the trade, make it knowingly.
+    // Built from routines/schedule.ts's DISPATCH_TICK_MINUTES so the tick cadence, the
+    // schedule-advance floor, and spend/reporting.ts's cadence predictions can never drift
+    // apart (OPE-146 — the prediction used to assume a routine could fire every minute).
+    cron: `*/${DISPATCH_TICK_MINUTES} * * * *`,
+    async run(args) {
+        await dispatchTick(args);
+    },
+});
+//# sourceMappingURL=dispatch.js.map