@poolzin/pool-bot 2026.2.25 → 2026.2.26

package/dist/config/zod-schema.providers-core.js

@@ -1,8 +1,11 @@
 import { z } from "zod";
+import { isSafeScpRemoteHost } from "../infra/scp-host.js";
+import { isValidInboundPathRootPattern } from "../media/inbound-path-policy.js";
+import { resolveDiscordPreviewStreamMode, resolveSlackNativeStreaming, resolveSlackStreamingMode, resolveTelegramPreviewStreamMode, } from "./discord-preview-streaming.js";
 import { normalizeTelegramCommandDescription, normalizeTelegramCommandName, resolveTelegramCustomCommands, } from "./telegram-custom-commands.js";
 import { ToolPolicySchema } from "./zod-schema.agent-runtime.js";
 import { ChannelHeartbeatVisibilitySchema } from "./zod-schema.channels.js";
-import { BlockStreamingChunkSchema, BlockStreamingCoalesceSchema, DmConfigSchema, DmPolicySchema, ExecutableTokenSchema, GroupPolicySchema, HexColorSchema, MarkdownConfigSchema, MSTeamsReplyStyleSchema, ProviderCommandsSchema, ReplyToModeSchema, RetryConfigSchema, requireOpenAllowFrom, } from "./zod-schema.core.js";
+import { BlockStreamingChunkSchema, BlockStreamingCoalesceSchema, DmConfigSchema, DmPolicySchema, ExecutableTokenSchema, GroupPolicySchema, HexColorSchema, MarkdownConfigSchema, MSTeamsReplyStyleSchema, ProviderCommandsSchema, ReplyToModeSchema, RetryConfigSchema, TtsConfigSchema, requireOpenAllowFrom, } from "./zod-schema.core.js";
 import { sensitive } from "./zod-schema.sensitive.js";
 const ToolPolicyBySenderSchema = z.record(z.string(), ToolPolicySchema).optional();
 const DiscordIdSchema = z
@@ -66,6 +69,19 @@ const validateTelegramCustomCommands = (value, ctx) => {
         });
     }
 };
+function normalizeTelegramStreamingConfig(value) {
+    value.streaming = resolveTelegramPreviewStreamMode(value);
+    delete value.streamMode;
+}
+function normalizeDiscordStreamingConfig(value) {
+    value.streaming = resolveDiscordPreviewStreamMode(value);
+    delete value.streamMode;
+}
+function normalizeSlackStreamingConfig(value) {
+    value.nativeStreaming = resolveSlackNativeStreaming(value);
+    value.streaming = resolveSlackStreamingMode(value);
+    delete value.streamMode;
+}
 export const TelegramAccountSchemaBase = z
     .object({
     name: z.string().optional(),
@@ -81,6 +97,7 @@ export const TelegramAccountSchemaBase = z
     replyToMode: ReplyToModeSchema.optional(),
     groups: z.record(z.string(), TelegramGroupSchema.optional()).optional(),
     allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+    defaultTo: z.union([z.string(), z.number()]).optional(),
     groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
     groupPolicy: GroupPolicySchema.optional().default("allowlist"),
     historyLimit: z.number().int().min(0).optional(),
@@ -88,10 +105,12 @@ export const TelegramAccountSchemaBase = z
     dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
     textChunkLimit: z.number().int().positive().optional(),
     chunkMode: z.enum(["length", "newline"]).optional(),
+    streaming: z.union([z.boolean(), z.enum(["off", "partial", "block", "progress"])]).optional(),
     blockStreaming: z.boolean().optional(),
     draftChunk: BlockStreamingChunkSchema.optional(),
     blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
-    streamMode: z.enum(["off", "partial", "block"]).optional().default("partial"),
+    // Legacy key kept for automatic migration to `streaming`.
+    streamMode: z.enum(["off", "partial", "block"]).optional(),
     mediaMaxMb: z.number().positive().optional(),
     timeoutSeconds: z.number().int().positive().optional(),
     retry: RetryConfigSchema,
@@ -124,6 +143,7 @@ export const TelegramAccountSchemaBase = z
 })
     .strict();
 export const TelegramAccountSchema = TelegramAccountSchemaBase.superRefine((value, ctx) => {
+    normalizeTelegramStreamingConfig(value);
     requireOpenAllowFrom({
         policy: value.dmPolicy,
         allowFrom: value.allowFrom,
@@ -136,6 +156,7 @@ export const TelegramAccountSchema = TelegramAccountSchemaBase.superRefine((valu
 export const TelegramConfigSchema = TelegramAccountSchemaBase.extend({
     accounts: z.record(z.string(), TelegramAccountSchema.optional()).optional(),
 }).superRefine((value, ctx) => {
+    normalizeTelegramStreamingConfig(value);
     requireOpenAllowFrom({
         policy: value.dmPolicy,
         allowFrom: value.allowFrom,
@@ -224,6 +245,20 @@ const DiscordUiSchema = z
 })
     .strict()
     .optional();
+const DiscordVoiceAutoJoinSchema = z
+    .object({
+    guildId: z.string().min(1),
+    channelId: z.string().min(1),
+})
+    .strict();
+const DiscordVoiceSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    autoJoin: z.array(DiscordVoiceAutoJoinSchema).optional(),
+    tts: TtsConfigSchema.optional(),
+})
+    .strict()
+    .optional();
 export const DiscordAccountSchema = z
     .object({
     name: z.string().optional(),
@@ -243,6 +278,10 @@ export const DiscordAccountSchema = z
     chunkMode: z.enum(["length", "newline"]).optional(),
     blockStreaming: z.boolean().optional(),
     blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+    // Canonical streaming mode. Legacy aliases (`streamMode`, boolean `streaming`) are auto-mapped.
+    streaming: z.union([z.boolean(), z.enum(["off", "partial", "block", "progress"])]).optional(),
+    streamMode: z.enum(["partial", "block", "off"]).optional(),
+    draftChunk: BlockStreamingChunkSchema.optional(),
     maxLinesPerMessage: z.number().int().positive().optional(),
     mediaMaxMb: z.number().positive().optional(),
     retry: RetryConfigSchema,
@@ -275,6 +314,7 @@ export const DiscordAccountSchema = z
     // inheritance in multi-account setups (shallow merge works; nested dm object doesn't).
     dmPolicy: DmPolicySchema.optional(),
     allowFrom: DiscordIdListSchema.optional(),
+    defaultTo: z.string().optional(),
     dm: DiscordDmSchema.optional(),
     guilds: z.record(z.string(), DiscordGuildSchema.optional()).optional(),
     heartbeat: ChannelHeartbeatVisibilitySchema,
@@ -290,6 +330,20 @@ export const DiscordAccountSchema = z
         .strict()
         .optional(),
     ui: DiscordUiSchema,
+    slashCommand: z
+        .object({
+        ephemeral: z.boolean().optional(),
+    })
+        .strict()
+        .optional(),
+    threadBindings: z
+        .object({
+        enabled: z.boolean().optional(),
+        ttlHours: z.number().nonnegative().optional(),
+        spawnSubagentSessions: z.boolean().optional(),
+    })
+        .strict()
+        .optional(),
     intents: z
         .object({
         presence: z.boolean().optional(),
@@ -297,6 +351,7 @@ export const DiscordAccountSchema = z
     })
         .strict()
         .optional(),
+    voice: DiscordVoiceSchema,
     pluralkit: z
         .object({
         enabled: z.boolean().optional(),
@@ -315,6 +370,7 @@ export const DiscordAccountSchema = z
 })
     .strict()
     .superRefine((value, ctx) => {
+    normalizeDiscordStreamingConfig(value);
     const activityText = typeof value.activity === "string" ? value.activity.trim() : "";
     const hasActivity = Boolean(activityText);
     const hasActivityType = value.activityType !== undefined;
@@ -391,6 +447,7 @@ export const GoogleChatAccountSchema = z
     groupPolicy: GroupPolicySchema.optional().default("allowlist"),
     groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
     groups: z.record(z.string(), GoogleChatGroupSchema.optional()).optional(),
+    defaultTo: z.string().optional(),
     serviceAccount: z.union([z.string(), z.record(z.string(), z.unknown())]).optional(),
     serviceAccountFile: z.string().optional(),
     audienceType: z.enum(["app-url", "project-number"]).optional(),
@@ -485,7 +542,9 @@ export const SlackAccountSchema = z
     chunkMode: z.enum(["length", "newline"]).optional(),
     blockStreaming: z.boolean().optional(),
     blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
-    streaming: z.boolean().optional(),
+    streaming: z.union([z.boolean(), z.enum(["off", "partial", "block", "progress"])]).optional(),
+    nativeStreaming: z.boolean().optional(),
+    streamMode: z.enum(["replace", "status_final", "append"]).optional(),
     mediaMaxMb: z.number().positive().optional(),
     reactionNotifications: z.enum(["off", "own", "all", "allowlist"]).optional(),
     reactionAllowlist: z.array(z.union([z.string(), z.number()])).optional(),
@@ -518,6 +577,7 @@ export const SlackAccountSchema = z
     // inheritance in multi-account setups (shallow merge works; nested dm object doesn't).
     dmPolicy: DmPolicySchema.optional(),
     allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+    defaultTo: z.string().optional(),
     dm: SlackDmSchema.optional(),
     channels: z.record(z.string(), SlackChannelSchema.optional()).optional(),
     heartbeat: ChannelHeartbeatVisibilitySchema,
@@ -526,6 +586,7 @@ export const SlackAccountSchema = z
 })
     .strict()
     .superRefine((value, ctx) => {
+    normalizeSlackStreamingConfig(value);
     const dmPolicy = value.dmPolicy ?? value.dm?.policy ?? "pairing";
     const allowFrom = value.allowFrom ?? value.dm?.allowFrom;
     const allowFromPath = value.allowFrom !== undefined ? ["allowFrom"] : ["dm", "allowFrom"];
@@ -595,6 +656,7 @@ export const SignalAccountSchemaBase = z
     sendReadReceipts: z.boolean().optional(),
     dmPolicy: DmPolicySchema.optional().default("pairing"),
     allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+    defaultTo: z.string().optional(),
     groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
     groupPolicy: GroupPolicySchema.optional().default("allowlist"),
     historyLimit: z.number().int().min(0).optional(),
@@ -678,6 +740,7 @@ export const IrcAccountSchemaBase = z
     channels: z.array(z.string()).optional(),
     dmPolicy: DmPolicySchema.optional().default("pairing"),
     allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+    defaultTo: z.string().optional(),
     groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
     groupPolicy: GroupPolicySchema.optional().default("allowlist"),
     groups: z.record(z.string(), IrcGroupSchema.optional()).optional(),
@@ -727,17 +790,27 @@ export const IMessageAccountSchemaBase = z
     configWrites: z.boolean().optional(),
     cliPath: ExecutableTokenSchema.optional(),
     dbPath: z.string().optional(),
-    remoteHost: z.string().optional(),
+    remoteHost: z
+        .string()
+        .refine(isSafeScpRemoteHost, "expected SSH host or user@host (no spaces/options)")
+        .optional(),
     service: z.union([z.literal("imessage"), z.literal("sms"), z.literal("auto")]).optional(),
     region: z.string().optional(),
     dmPolicy: DmPolicySchema.optional().default("pairing"),
     allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+    defaultTo: z.string().optional(),
     groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
     groupPolicy: GroupPolicySchema.optional().default("allowlist"),
     historyLimit: z.number().int().min(0).optional(),
     dmHistoryLimit: z.number().int().min(0).optional(),
     dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
     includeAttachments: z.boolean().optional(),
+    attachmentRoots: z
+        .array(z.string().refine(isValidInboundPathRootPattern, "expected absolute path root"))
+        .optional(),
+    remoteAttachmentRoots: z
+        .array(z.string().refine(isValidInboundPathRootPattern, "expected absolute path root"))
+        .optional(),
     mediaMaxMb: z.number().int().positive().optional(),
     textChunkLimit: z.number().int().positive().optional(),
     chunkMode: z.enum(["length", "newline"]).optional(),
@@ -886,6 +959,7 @@ export const MSTeamsConfigSchema = z
         .optional(),
     dmPolicy: DmPolicySchema.optional().default("pairing"),
     allowFrom: z.array(z.string()).optional(),
+    defaultTo: z.string().optional(),
     groupAllowFrom: z.array(z.string()).optional(),
     groupPolicy: GroupPolicySchema.optional().default("allowlist"),
     textChunkLimit: z.number().int().positive().optional(),

package/dist/config/zod-schema.providers.js

@@ -1,11 +1,14 @@
 import { z } from "zod";
-import { BlueBubblesConfigSchema, DiscordConfigSchema, GoogleChatConfigSchema, IMessageConfigSchema, MSTeamsConfigSchema, SignalConfigSchema, SlackConfigSchema, TelegramConfigSchema, } from "./zod-schema.providers-core.js";
+import { BlueBubblesConfigSchema, DiscordConfigSchema, GoogleChatConfigSchema, IMessageConfigSchema, IrcConfigSchema, MSTeamsConfigSchema, SignalConfigSchema, SlackConfigSchema, TelegramConfigSchema, } from "./zod-schema.providers-core.js";
 import { WhatsAppConfigSchema } from "./zod-schema.providers-whatsapp.js";
 import { GroupPolicySchema } from "./zod-schema.core.js";
 import { ChannelHeartbeatVisibilitySchema } from "./zod-schema.channels.js";
 export * from "./zod-schema.providers-core.js";
 export * from "./zod-schema.providers-whatsapp.js";
 export { ChannelHeartbeatVisibilitySchema } from "./zod-schema.channels.js";
+const ChannelModelByChannelSchema = z
+    .record(z.string(), z.record(z.string(), z.string()))
+    .optional();
 export const ChannelsSchema = z
     .object({
     defaults: z
@@ -15,9 +18,11 @@ export const ChannelsSchema = z
     })
         .strict()
         .optional(),
+    modelByChannel: ChannelModelByChannelSchema,
     whatsapp: WhatsAppConfigSchema.optional(),
     telegram: TelegramConfigSchema.optional(),
     discord: DiscordConfigSchema.optional(),
+    irc: IrcConfigSchema.optional(),
     googlechat: GoogleChatConfigSchema.optional(),
     slack: SlackConfigSchema.optional(),
     signal: SignalConfigSchema.optional(),

package/dist/config/zod-schema.session.js

@@ -4,6 +4,7 @@ import { parseDurationMs } from "../cli/parse-duration.js";
 import { ElevatedAllowFromSchema } from "./zod-schema.agent-runtime.js";
 import { createAllowDenyChannelRulesSchema } from "./zod-schema.allowdeny.js";
 import { GroupChatSchema, InboundDebounceSchema, NativeCommandsSettingSchema, QueueSchema, TtsConfigSchema, } from "./zod-schema.core.js";
+import { sensitive } from "./zod-schema.sensitive.js";
 const SessionResetConfigSchema = z
     .object({
     mode: z.union([z.literal("daily"), z.literal("idle")]).optional(),
@@ -56,6 +57,13 @@ export const SessionSchema = z
     })
         .strict()
         .optional(),
+    threadBindings: z
+        .object({
+        enabled: z.boolean().optional(),
+        ttlHours: z.number().nonnegative().optional(),
+    })
+        .strict()
+        .optional(),
     maintenance: z
         .object({
         mode: z.enum(["enforce", "warn"]).optional(),
@@ -106,6 +114,35 @@ export const MessagesSchema = z
     ackReaction: z.string().optional(),
     ackReactionScope: z.enum(["group-mentions", "group-all", "direct", "all"]).optional(),
     removeAckAfterReply: z.boolean().optional(),
+    statusReactions: z
+        .object({
+        enabled: z.boolean().optional(),
+        emojis: z
+            .object({
+            thinking: z.string().optional(),
+            tool: z.string().optional(),
+            coding: z.string().optional(),
+            web: z.string().optional(),
+            done: z.string().optional(),
+            error: z.string().optional(),
+            stallSoft: z.string().optional(),
+            stallHard: z.string().optional(),
+        })
+            .strict()
+            .optional(),
+        timing: z
+            .object({
+            debounceMs: z.number().int().min(0).optional(),
+            stallSoftMs: z.number().int().min(0).optional(),
+            stallHardMs: z.number().int().min(0).optional(),
+            doneHoldMs: z.number().int().min(0).optional(),
+            errorHoldMs: z.number().int().min(0).optional(),
+        })
+            .strict()
+            .optional(),
+    })
+        .strict()
+        .optional(),
     suppressToolErrors: z.boolean().optional(),
     tts: TtsConfigSchema,
 })
@@ -120,11 +157,13 @@ export const CommandsSchema = z
     bashForegroundMs: z.number().int().min(0).max(30_000).optional(),
     config: z.boolean().optional(),
     debug: z.boolean().optional(),
-    restart: z.boolean().optional(),
+    restart: z.boolean().optional().default(true),
     useAccessGroups: z.boolean().optional(),
     ownerAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+    ownerDisplay: z.enum(["raw", "hash"]).optional().default("raw"),
+    ownerDisplaySecret: z.string().optional().register(sensitive),
     allowFrom: ElevatedAllowFromSchema.optional(),
 })
     .strict()
     .optional()
-    .default({ native: "auto", nativeSkills: "auto" });
+    .default(() => ({ native: "auto", nativeSkills: "auto", restart: true, ownerDisplay: "raw" }));

package/dist/cron/run-log.js

@@ -93,6 +93,9 @@ export async function readCronRunLogEntries(filePath, opts) {
                     }
                     : undefined,
             };
+            if (typeof obj.delivered === "boolean") {
+                entry.delivered = obj.delivered;
+            }
             if (typeof obj.sessionId === "string" && obj.sessionId.trim().length > 0) {
                 entry.sessionId = obj.sessionId;
             }

package/dist/cron/schedule.js

@@ -35,7 +35,11 @@ export function computeNextRunAtMs(schedule, nowMs) {
         const steps = Math.max(1, Math.floor((elapsed + everyMs - 1) / everyMs));
         return anchor + steps * everyMs;
     }
-    const expr = schedule.expr.trim();
+    const exprSource = schedule.expr;
+    if (typeof exprSource !== "string") {
+        throw new Error("invalid cron schedule: expr is required");
+    }
+    const expr = exprSource.trim();
     if (!expr) {
         return undefined;
     }
@@ -43,17 +47,24 @@ export function computeNextRunAtMs(schedule, nowMs) {
         timezone: resolveCronTimezone(schedule.tz),
         catch: false,
     });
-    // Cron operates at second granularity, so floor nowMs to the start of the
-    // current second.  This prevents the lookback from landing inside a matching
-    // second — if nowMs is e.g. 12:00:00.500 and the pattern fires at second 0,
-    // a 1ms lookback (12:00:00.499) is still *within* that second, causing
-    // croner to skip ahead to the next occurrence (e.g. the following day).
-    // Flooring first ensures the lookback always falls in the *previous* second.
-    const nowSecondMs = Math.floor(nowMs / 1000) * 1000;
-    const next = cron.nextRun(new Date(nowSecondMs - 1));
+    const next = cron.nextRun(new Date(nowMs));
     if (!next) {
         return undefined;
     }
     const nextMs = next.getTime();
-    return Number.isFinite(nextMs) && nextMs >= nowSecondMs ? nextMs : undefined;
+    if (!Number.isFinite(nextMs)) {
+        return undefined;
+    }
+    if (nextMs > nowMs) {
+        return nextMs;
+    }
+    // Guard against same-second rescheduling loops: if croner returns
+    // "now" (or an earlier instant), retry from the next whole second.
+    const nextSecondMs = Math.floor(nowMs / 1000) * 1000 + 1000;
+    const retry = cron.nextRun(new Date(nextSecondMs));
+    if (!retry) {
+        return undefined;
+    }
+    const retryMs = retry.getTime();
+    return Number.isFinite(retryMs) && retryMs > nowMs ? retryMs : undefined;
 }

package/dist/cron/service/ops.js

@@ -1,22 +1,40 @@
-import { applyJobPatch, computeJobNextRunAtMs, createJob, findJobOrThrow, isJobDue, nextWakeAtMs, recomputeNextRuns, } from "./jobs.js";
+import { applyJobPatch, computeJobNextRunAtMs, createJob, findJobOrThrow, isJobDue, nextWakeAtMs, recomputeNextRuns, recomputeNextRunsForMaintenance, } from "./jobs.js";
 import { locked } from "./locked.js";
 import { ensureLoaded, persist, warnIfDisabled } from "./store.js";
 import { armTimer, emit, executeJob, runMissedJobs, stopTimer, wake } from "./timer.js";
+async function ensureLoadedForRead(state) {
+    await ensureLoaded(state, { skipRecompute: true });
+    if (!state.store) {
+        return;
+    }
+    // Use the maintenance-only version so that read-only operations never
+    // advance a past-due nextRunAtMs without executing the job (#16156).
+    const changed = recomputeNextRunsForMaintenance(state);
+    if (changed) {
+        await persist(state);
+    }
+}
 export async function start(state) {
+    if (!state.deps.cronEnabled) {
+        state.deps.log.info({ enabled: false }, "cron: disabled");
+        return;
+    }
+    const startupInterruptedJobIds = new Set();
     await locked(state, async () => {
-        if (!state.deps.cronEnabled) {
-            state.deps.log.info({ enabled: false }, "cron: disabled");
-            return;
-        }
         await ensureLoaded(state, { skipRecompute: true });
         const jobs = state.store?.jobs ?? [];
         for (const job of jobs) {
             if (typeof job.state.runningAtMs === "number") {
                 state.deps.log.warn({ jobId: job.id, runningAtMs: job.state.runningAtMs }, "cron: clearing stale running marker on startup");
                 job.state.runningAtMs = undefined;
+                startupInterruptedJobIds.add(job.id);
             }
         }
-        await runMissedJobs(state);
+        await persist(state);
+    });
+    await runMissedJobs(state, { skipJobIds: startupInterruptedJobIds });
+    await locked(state, async () => {
+        await ensureLoaded(state, { forceReload: true, skipRecompute: true });
         recomputeNextRuns(state);
         await persist(state);
         armTimer(state);
@@ -32,13 +50,7 @@ export function stop(state) {
 }
 export async function status(state) {
     return await locked(state, async () => {
-        await ensureLoaded(state, { skipRecompute: true });
-        if (state.store) {
-            const changed = recomputeNextRuns(state);
-            if (changed) {
-                await persist(state);
-            }
-        }
+        await ensureLoadedForRead(state);
         return {
             enabled: state.deps.cronEnabled,
             storePath: state.deps.storePath,
@@ -49,13 +61,7 @@ export async function status(state) {
 }
 export async function list(state, opts) {
     return await locked(state, async () => {
-        await ensureLoaded(state, { skipRecompute: true });
-        if (state.store) {
-            const changed = recomputeNextRuns(state);
-            if (changed) {
-                await persist(state);
-            }
-        }
+        await ensureLoadedForRead(state);
         const includeDisabled = opts?.includeDisabled === true;
         const jobs = (state.store?.jobs ?? []).filter((j) => includeDisabled || j.enabled);
         return jobs.toSorted((a, b) => (a.state.nextRunAtMs ?? 0) - (b.state.nextRunAtMs ?? 0));
@@ -90,7 +96,7 @@ export async function add(state, input) {
 export async function update(state, id, patch) {
     return await locked(state, async () => {
         warnIfDisabled(state, "update");
-        await ensureLoaded(state);
+        await ensureLoaded(state, { skipRecompute: true });
         const job = findJobOrThrow(state, id);
         const now = state.deps.nowMs();
         applyJobPatch(job, patch);
@@ -121,6 +127,14 @@ export async function update(state, id, patch) {
                 job.state.runningAtMs = undefined;
             }
         }
+        else if (job.enabled) {
+            // Non-schedule edits should not mutate other jobs, but still repair a
+            // missing/corrupt nextRunAtMs for the updated job.
+            const nextRun = job.state.nextRunAtMs;
+            if (typeof nextRun !== "number" || !Number.isFinite(nextRun)) {
+                job.state.nextRunAtMs = computeJobNextRunAtMs(job, now);
+            }
+        }
         await persist(state);
         armTimer(state);
         emit(state, {